c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099 | Triage

Analysis

max time kernel
60s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 09:33

Sharing

Report Analysis Logs

General

Target

GetPass.exe
Size

52KB
MD5

d25ab00267a9da1944bad9e1115ad428
SHA1

9470006b8763054e14d0e4708a3708e490cacfe9
SHA256

07fc745c29db1e2db61089d8d46299078794d7127120d04c07e0a1ea6933a6df
SHA512

a5906883361a4ce9ee6e3556808f886ee05e84063bbc7e394a33463767e8670eba5cb9f76abef894fcd8607eb3d197ef69e321996246c1f93d463748aaacb206
SSDEEP

768:Feizs4ulZdVEUHw+0QcKbUyQV8gmDzQn3pVok:w3vpHwPQngyOWDCVok

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3612 3680 WerFault.exe GetPass.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

GetPass.exe

description pid process

Token: SeDebugPrivilege 3680 GetPass.exe

C:\Users\Admin\AppData\Local\Temp\GetPass.exe
"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 348
2⤵
- Program crash
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3680 -ip 3680
1⤵
PID:5052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads