Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe
Resource
win7-20240319-en
General
-
Target
151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe
-
Size
311KB
-
MD5
9544821ed3db4db3c54f0d795bbc1ab6
-
SHA1
3dd2d16955d4e6db85051e9f368407a9d9b6870e
-
SHA256
151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a
-
SHA512
949cdade7a42a649f9daa2fd2940bf01c5bb4670e1bb3e7773fa76872da0ea1858009d6ee0f479638e8f3ee178d86d61b4750f61f768fdc0914f0994e68f6304
-
SSDEEP
6144:7f4ZKa9IPz9hmiXK8+JjdYX+VpU/UB9Xi:r4gKIPz7mid+Jj6X+YcL
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.115
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4524 2124 WerFault.exe 83 1224 2124 WerFault.exe 83 4396 2124 WerFault.exe 83 4804 2124 WerFault.exe 83 4916 2124 WerFault.exe 83 1000 2124 WerFault.exe 83 4680 2124 WerFault.exe 83 2376 2124 WerFault.exe 83 -
Kills process with taskkill 1 IoCs
pid Process 3276 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3276 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3764 2124 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe 105 PID 2124 wrote to memory of 3764 2124 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe 105 PID 2124 wrote to memory of 3764 2124 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe 105 PID 3764 wrote to memory of 3276 3764 cmd.exe 109 PID 3764 wrote to memory of 3276 3764 cmd.exe 109 PID 3764 wrote to memory of 3276 3764 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe"C:\Users\Admin\AppData\Local\Temp\151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 7402⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 7802⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 8162⤵
- Program crash
PID:4396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 8802⤵
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 9922⤵
- Program crash
PID:4916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 9922⤵
- Program crash
PID:1000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 11442⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 13202⤵
- Program crash
PID:2376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2124 -ip 21241⤵PID:3648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2124 -ip 21241⤵PID:1040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2124 -ip 21241⤵PID:2004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2124 -ip 21241⤵PID:1632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2124 -ip 21241⤵PID:1948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2124 -ip 21241⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2124 -ip 21241⤵PID:3340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2124 -ip 21241⤵PID:752