Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe
Resource
win7-20240221-en
General
-
Target
3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe
-
Size
294KB
-
MD5
54935c8ce5efca8a4589caa0d3e9258f
-
SHA1
b0eb42a85371e15ef92020c37406f59e786a503d
-
SHA256
3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9
-
SHA512
3fb388b769a5cae21a035ae999e5d190d941c4a146cf77e5481a5ea8337b8e1a0259a206ad04d1a902842412584825db5d2fbd7c9425fcc855581e294b7d26bc
-
SSDEEP
3072:CX8L3hvoXS+bakYZXhJ1KcRvPHiiKXU57jdPWfd9Drt67JUPFk+Hc/vyK1nhlXWl:CsvYSo6r1xIiKkLixP+qIyK1nfXy5IB
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2184 2276 WerFault.exe 84 972 2276 WerFault.exe 84 2624 2276 WerFault.exe 84 384 2276 WerFault.exe 84 3112 2276 WerFault.exe 84 4532 2276 WerFault.exe 84 4508 2276 WerFault.exe 84 3508 2276 WerFault.exe 84 -
Kills process with taskkill 1 IoCs
pid Process 60 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 60 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2276 wrote to memory of 3560 2276 3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe 111 PID 2276 wrote to memory of 3560 2276 3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe 111 PID 2276 wrote to memory of 3560 2276 3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe 111 PID 3560 wrote to memory of 60 3560 cmd.exe 115 PID 3560 wrote to memory of 60 3560 cmd.exe 115 PID 3560 wrote to memory of 60 3560 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe"C:\Users\Admin\AppData\Local\Temp\3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 7522⤵
- Program crash
PID:2184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 7722⤵
- Program crash
PID:972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 7722⤵
- Program crash
PID:2624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 7962⤵
- Program crash
PID:384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 9082⤵
- Program crash
PID:3112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 9882⤵
- Program crash
PID:4532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 12842⤵
- Program crash
PID:4508
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3c187ba3a074078ac5edd0382992f66e784eb26faff2fbd55b97b1d0b0740ae9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 13722⤵
- Program crash
PID:3508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2276 -ip 22761⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2276 -ip 22761⤵PID:5044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2276 -ip 22761⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2276 -ip 22761⤵PID:4876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2276 -ip 22761⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2276 -ip 22761⤵PID:2060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2276 -ip 22761⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2276 -ip 22761⤵PID:1948