Analysis Overview
SHA256
d6f8e72751e5a14dc069c663f526065b718efaa6c1fb8152aede260877ff3cdf
Threat Level: Known bad
The file 4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.zip was found to be: Known bad.
Malicious Activity Summary
GCleaner
Downloads MZ/PE file
Unsigned PE
Program crash
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-02 13:09
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-02 13:09
Reported
2024-04-02 13:12
Platform
win7-20240221-en
Max time kernel
122s
Max time network
126s
Command Line
Signatures
GCleaner
Downloads MZ/PE file
Processes
C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe
"C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | download.visualstudio.microsoft.com | udp |
| FR | 68.232.34.200:80 | download.visualstudio.microsoft.com | tcp |
Files
memory/2092-1-0x0000000000250000-0x0000000000350000-memory.dmp
memory/2092-2-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/2092-3-0x00000000003C0000-0x00000000003FC000-memory.dmp
memory/2092-5-0x0000000000250000-0x0000000000350000-memory.dmp
memory/2092-10-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/2092-11-0x0000000000250000-0x0000000000350000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-02 13:09
Reported
2024-04-02 13:12
Platform
win10v2004-20240226-en
Max time kernel
147s
Max time network
156s
Command Line
Signatures
GCleaner
Downloads MZ/PE file
Program crash
Processes
C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe
"C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 740
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 748
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 744
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 852
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 840
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 980
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 788
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3700 -ip 3700
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 952
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.136.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | download.visualstudio.microsoft.com | udp |
| FR | 68.232.34.200:80 | download.visualstudio.microsoft.com | tcp |
| US | 8.8.8.8:53 | 200.34.232.68.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.110.86.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.66.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.73.42.20.in-addr.arpa | udp |
Files
memory/3700-2-0x0000000000DB0000-0x0000000000DEC000-memory.dmp
memory/3700-1-0x0000000000E00000-0x0000000000F00000-memory.dmp
memory/3700-3-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/3700-5-0x0000000000E00000-0x0000000000F00000-memory.dmp
memory/3700-7-0x0000000000DB0000-0x0000000000DEC000-memory.dmp
memory/3700-11-0x0000000000400000-0x0000000000B04000-memory.dmp