Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2023, 12:48
Static task
static1
Behavioral task
behavioral1
Sample
4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe
Resource
win7-20230220-en
General
-
Target
4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe
-
Size
385KB
-
MD5
34f8808d1a51641fac355ba5c92f7114
-
SHA1
eb6774b48254e0b37f357dffb5ea620bc8cca5f3
-
SHA256
4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f
-
SHA512
dfff6523cf9393c3a9e41925c6a8905ea4be3155a46334193ed839b783288ed7ccb9fe946411d2c1e896eb839d8cb3e76ed1cadb1987f616fdede1940d2146a5
-
SSDEEP
3072:t5uIKIRGXJuLGNafEnyKWus/1T6J2d+kVojCI40+/xJP92VBY3TQGcuD4EBWrFVU:YI6uLGcE70dpd+kVx1x/2VWxcu8sWR
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
pid pid_target Process procid_target 2000 1180 WerFault.exe 85 3148 1180 WerFault.exe 85 1564 1180 WerFault.exe 85 1744 1180 WerFault.exe 85 3412 1180 WerFault.exe 85 1268 1180 WerFault.exe 85 1176 1180 WerFault.exe 85 -
Kills process with taskkill 1 IoCs
pid Process 4820 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4820 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1180 wrote to memory of 3708 1180 4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe 98 PID 1180 wrote to memory of 3708 1180 4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe 98 PID 1180 wrote to memory of 3708 1180 4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe 98 PID 3708 wrote to memory of 4820 3708 cmd.exe 101 PID 3708 wrote to memory of 4820 3708 cmd.exe 101 PID 3708 wrote to memory of 4820 3708 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe"C:\Users\Admin\AppData\Local\Temp\4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 7322⤵
- Program crash
PID:2000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 7282⤵
- Program crash
PID:3148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 9362⤵
- Program crash
PID:1564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 9762⤵
- Program crash
PID:1744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 9762⤵
- Program crash
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 9642⤵
- Program crash
PID:1268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4fbb67c0ef74f07ac1b31dba5d136938735bbd00544d27b4931a4a79e12f1f5f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 11362⤵
- Program crash
PID:1176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1180 -ip 11801⤵PID:3892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1180 -ip 11801⤵PID:1560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1180 -ip 11801⤵PID:628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1180 -ip 11801⤵PID:4092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1180 -ip 11801⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1180 -ip 11801⤵PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1180 -ip 11801⤵PID:1836