Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 15:46
Static task
static1
Behavioral task
behavioral1
Sample
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe
Resource
win10v2004-20240412-en
General
-
Target
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe
-
Size
343KB
-
MD5
35415dfe27e4c5fb17b3593825e5f591
-
SHA1
ffc035f1e3f14112d270fa8fd0eb4a2cb2a7faa8
-
SHA256
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941
-
SHA512
49a50c22debd23da6af67a0e47e5b54786783a57b1afcb4fed98d95647c3a6d4d480439b9211f9c7565c13851df5ea0064da1004271a0ff2e6722f1fc4ef0edf
-
SSDEEP
6144:CkVEqfUaqAXThotiCkcGhUUz/KbQhYEac:CkVEq8a5XThDRcG2K/b3
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1892 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 4724 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 1028 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 4944 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 4680 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 4708 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 792 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 4900 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 464 2748 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4384 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4384 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.execmd.exedescription pid process target process PID 2748 wrote to memory of 208 2748 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe cmd.exe PID 2748 wrote to memory of 208 2748 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe cmd.exe PID 2748 wrote to memory of 208 2748 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe cmd.exe PID 208 wrote to memory of 4384 208 cmd.exe taskkill.exe PID 208 wrote to memory of 4384 208 cmd.exe taskkill.exe PID 208 wrote to memory of 4384 208 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe"C:\Users\Admin\AppData\Local\Temp\0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 7522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 10162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 13642⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 13842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2748 -ip 27481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2748 -ip 27481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2748-1-0x0000000004360000-0x0000000004460000-memory.dmpFilesize
1024KB
-
memory/2748-2-0x0000000004300000-0x000000000432D000-memory.dmpFilesize
180KB
-
memory/2748-4-0x0000000000400000-0x0000000004049000-memory.dmpFilesize
60.3MB
-
memory/2748-5-0x0000000004300000-0x000000000432D000-memory.dmpFilesize
180KB