Analysis Overview
SHA256
b88583aca7ee660a9ed97b3d8f6f9e2348206c4a7bfd5ab03f6822dc49c325bf
Threat Level: Known bad
The file 4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.zip was found to be: Known bad.
Malicious Activity Summary
GCleaner
Downloads MZ/PE file
Program crash
Unsigned PE
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-02 13:34
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-02 13:34
Reported
2024-04-02 13:37
Platform
win7-20240319-en
Max time kernel
118s
Max time network
122s
Command Line
Signatures
GCleaner
Downloads MZ/PE file
Processes
C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe
"C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | download.visualstudio.microsoft.com | udp |
| FR | 68.232.34.200:80 | download.visualstudio.microsoft.com | tcp |
Files
memory/1068-1-0x00000000002D0000-0x00000000003D0000-memory.dmp
memory/1068-2-0x00000000001B0000-0x00000000001EC000-memory.dmp
memory/1068-3-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/1068-4-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/1068-7-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/1068-8-0x00000000002D0000-0x00000000003D0000-memory.dmp
memory/1068-9-0x00000000001B0000-0x00000000001EC000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-02 13:34
Reported
2024-04-02 13:37
Platform
win10v2004-20240226-en
Max time kernel
148s
Max time network
154s
Command Line
Signatures
GCleaner
Downloads MZ/PE file
Program crash
Processes
C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe
"C:\Users\Admin\AppData\Local\Temp\4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 740
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 760
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 788
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 812
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 904
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 908
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2492 -ip 2492
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1308
Network
| Country | Destination | Domain | Proto |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | download.visualstudio.microsoft.com | udp |
| FR | 68.232.34.200:80 | download.visualstudio.microsoft.com | tcp |
| US | 8.8.8.8:53 | 200.34.232.68.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.162.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.173.189.20.in-addr.arpa | udp |
Files
memory/2492-2-0x0000000002850000-0x000000000288C000-memory.dmp
memory/2492-1-0x0000000000B30000-0x0000000000C30000-memory.dmp
memory/2492-3-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/2492-7-0x0000000000400000-0x0000000000B04000-memory.dmp
memory/2492-8-0x0000000002850000-0x000000000288C000-memory.dmp