Analysis
-
max time kernel
93s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe
Resource
win7-20240221-en
General
-
Target
1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe
-
Size
284KB
-
MD5
eeeda33b6561043c0e331eadc2fae28c
-
SHA1
1e41aef8f31573cf174f12d923d451988ac88dd5
-
SHA256
1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037
-
SHA512
40ee9f046a905f6ed5e57febbd0d39eae68a14c786dc0a28b25cc782b0517f650d81c3c995663912c5edc2045847c6a580b32a8d47d1f9b19d99a8fd0c321244
-
SSDEEP
6144:3zWZwVZqDrqxUG8Vqtj0W5akevzLZ83e:DWuHqDuSjVMj02/S/O3e
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.115
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 2172 2052 WerFault.exe 85 2648 2052 WerFault.exe 85 1460 2052 WerFault.exe 85 2148 2052 WerFault.exe 85 5036 2052 WerFault.exe 85 5096 2052 WerFault.exe 85 3960 2052 WerFault.exe 85 3624 2052 WerFault.exe 85 3404 2052 WerFault.exe 85 -
Kills process with taskkill 1 IoCs
pid Process 1056 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1056 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2052 wrote to memory of 4432 2052 1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe 106 PID 2052 wrote to memory of 4432 2052 1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe 106 PID 2052 wrote to memory of 4432 2052 1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe 106 PID 4432 wrote to memory of 1056 4432 cmd.exe 110 PID 4432 wrote to memory of 1056 4432 cmd.exe 110 PID 4432 wrote to memory of 1056 4432 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe"C:\Users\Admin\AppData\Local\Temp\1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 7402⤵
- Program crash
PID:2172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 7762⤵
- Program crash
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 7722⤵
- Program crash
PID:1460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 8362⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 9082⤵
- Program crash
PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 9122⤵
- Program crash
PID:5096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 9922⤵
- Program crash
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 13042⤵
- Program crash
PID:3624
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 13682⤵
- Program crash
PID:3404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2052 -ip 20521⤵PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2052 -ip 20521⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2052 -ip 20521⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2052 -ip 20521⤵PID:2868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2052 -ip 20521⤵PID:412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2052 -ip 20521⤵PID:5040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2052 -ip 20521⤵PID:3988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2052 -ip 20521⤵PID:3524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2052 -ip 20521⤵PID:4856