Analysis
-
max time kernel
27s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13-03-2023 09:39
Static task
static1
Behavioral task
behavioral1
Sample
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe
Resource
win7-20230220-en
General
-
Target
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe
-
Size
276KB
-
MD5
354895bd5079cc205b265799b71ec05c
-
SHA1
1016ac93fad8d1706255e96f7807c1950bd3d78c
-
SHA256
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c
-
SHA512
792fd2aa10633cb5b59ae51b2e124d9e2765f1d830b9f785666ef09683380e765b299fb528d319662dedcc0503914a95e5a30a128c021f20bb3498c047395b8f
-
SSDEEP
3072:qmEFfQzn7IRveaMP7osVhZTTqadpBtrWAbTJhzoxM7viqOUAX6xJ9n+T6:UFYznoeaMZXbSAp8pz+
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1948 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 680 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 680 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.execmd.exedescription pid process target process PID 1992 wrote to memory of 1948 1992 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 1992 wrote to memory of 1948 1992 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 1992 wrote to memory of 1948 1992 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 1992 wrote to memory of 1948 1992 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 1948 wrote to memory of 680 1948 cmd.exe taskkill.exe PID 1948 wrote to memory of 680 1948 cmd.exe taskkill.exe PID 1948 wrote to memory of 680 1948 cmd.exe taskkill.exe PID 1948 wrote to memory of 680 1948 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe"C:\Users\Admin\AppData\Local\Temp\485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken