Analysis
-
max time kernel
85s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2023 09:39
Static task
static1
Behavioral task
behavioral1
Sample
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe
Resource
win7-20230220-en
General
-
Target
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe
-
Size
276KB
-
MD5
354895bd5079cc205b265799b71ec05c
-
SHA1
1016ac93fad8d1706255e96f7807c1950bd3d78c
-
SHA256
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c
-
SHA512
792fd2aa10633cb5b59ae51b2e124d9e2765f1d830b9f785666ef09683380e765b299fb528d319662dedcc0503914a95e5a30a128c021f20bb3498c047395b8f
-
SSDEEP
3072:qmEFfQzn7IRveaMP7osVhZTTqadpBtrWAbTJhzoxM7viqOUAX6xJ9n+T6:UFYznoeaMZXbSAp8pz+
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3584 4816 WerFault.exe 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe 840 4816 WerFault.exe 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe 5104 4816 WerFault.exe 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe 2836 4816 WerFault.exe 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe 3916 4816 WerFault.exe 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe 3888 4816 WerFault.exe 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1948 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1948 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.execmd.exedescription pid process target process PID 4816 wrote to memory of 3712 4816 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 4816 wrote to memory of 3712 4816 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 4816 wrote to memory of 3712 4816 485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe cmd.exe PID 3712 wrote to memory of 1948 3712 cmd.exe taskkill.exe PID 3712 wrote to memory of 1948 3712 cmd.exe taskkill.exe PID 3712 wrote to memory of 1948 3712 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe"C:\Users\Admin\AppData\Local\Temp\485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4816 -ip 48161⤵