Analysis
-
max time kernel
28s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2023 00:40
Static task
static1
Behavioral task
behavioral1
Sample
0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe
Resource
win7-20230220-en
General
-
Target
0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe
-
Size
274KB
-
MD5
fc9d6c44a166ea2f7f93de619b904481
-
SHA1
e47a116cf55e7f3dbb141f0dc4b6c75875fec38a
-
SHA256
0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b
-
SHA512
4a60cc0a48f6ec442e6244d9b1a488b6644e250f726631dab286470eee80ccc5f86296abcbacdda233d4f7dbc24973fd8e1476ad302dba21c2302bc9c8a72cf2
-
SSDEEP
6144:QgnrhUFa2TGI5Z6p+F8duWDHoGjiXECnrSenXJ0v:Qgnr/2TGI5Z6pjEWSBneen5u
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1860 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1812 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1812 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.execmd.exedescription pid process target process PID 1196 wrote to memory of 1860 1196 0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe cmd.exe PID 1196 wrote to memory of 1860 1196 0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe cmd.exe PID 1196 wrote to memory of 1860 1196 0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe cmd.exe PID 1196 wrote to memory of 1860 1196 0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe cmd.exe PID 1860 wrote to memory of 1812 1860 cmd.exe taskkill.exe PID 1860 wrote to memory of 1812 1860 cmd.exe taskkill.exe PID 1860 wrote to memory of 1812 1860 cmd.exe taskkill.exe PID 1860 wrote to memory of 1812 1860 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe"C:\Users\Admin\AppData\Local\Temp\0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0bae28922ad0fc2e5d92b6bf45fd23efb20c2639fafef7bcb0e12b642e2a9f5b.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken