Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2023 11:27
Static task
static1
Behavioral task
behavioral1
Sample
9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe
Resource
win7-20230220-en
General
-
Target
9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe
-
Size
286KB
-
MD5
67215a65f0750a47be8239b1f0e52ccf
-
SHA1
c3e13bd46d93894d74fddfda1586dfdcffd836a0
-
SHA256
9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4
-
SHA512
c11861b1c5fdc480ea154c1e5c4e22a590c99f6714541997e536dfa485ed82532a5d6387bd40383aae3a8d3f86f060f96af47f6db3b4d929dba097db53b66d42
-
SSDEEP
6144:9af5UIKNEUtGWCZxD+WQ6WAc+BziMBXn/tz/JExFFtj:9afCvNntGWU1+sWAJ1RJEFtj
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
pid pid_target Process procid_target 1304 3896 WerFault.exe 85 4236 3896 WerFault.exe 85 3616 3896 WerFault.exe 85 4808 3896 WerFault.exe 85 3448 3896 WerFault.exe 85 1648 3896 WerFault.exe 85 3708 3896 WerFault.exe 85 -
Kills process with taskkill 1 IoCs
pid Process 4692 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4692 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3896 wrote to memory of 2060 3896 9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe 98 PID 3896 wrote to memory of 2060 3896 9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe 98 PID 3896 wrote to memory of 2060 3896 9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe 98 PID 2060 wrote to memory of 4692 2060 cmd.exe 102 PID 2060 wrote to memory of 4692 2060 cmd.exe 102 PID 2060 wrote to memory of 4692 2060 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe"C:\Users\Admin\AppData\Local\Temp\9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 7442⤵
- Program crash
PID:1304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 7842⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 9162⤵
- Program crash
PID:3616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 7722⤵
- Program crash
PID:4808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 7722⤵
- Program crash
PID:3448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 9162⤵
- Program crash
PID:1648
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "9654564e437afa4a9cfb133343e379c8c3c69f53f5b81f4cf2425c9cb9a487f4.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 9762⤵
- Program crash
PID:3708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3896 -ip 38961⤵PID:2000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3896 -ip 38961⤵PID:4408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3896 -ip 38961⤵PID:3312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3896 -ip 38961⤵PID:220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3896 -ip 38961⤵PID:1912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3896 -ip 38961⤵PID:3784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3896 -ip 38961⤵PID:1808