Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-04-2024 15:46
Static task
static1
Behavioral task
behavioral1
Sample
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe
Resource
win10v2004-20240412-en
General
-
Target
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe
-
Size
343KB
-
MD5
35415dfe27e4c5fb17b3593825e5f591
-
SHA1
ffc035f1e3f14112d270fa8fd0eb4a2cb2a7faa8
-
SHA256
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941
-
SHA512
49a50c22debd23da6af67a0e47e5b54786783a57b1afcb4fed98d95647c3a6d4d480439b9211f9c7565c13851df5ea0064da1004271a0ff2e6722f1fc4ef0edf
-
SSDEEP
6144:CkVEqfUaqAXThotiCkcGhUUz/KbQhYEac:CkVEq8a5XThDRcG2K/b3
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4120 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 4844 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 5040 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 1652 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 3972 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 1536 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 2364 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe 2840 652 WerFault.exe 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2272 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2272 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.execmd.exedescription pid process target process PID 652 wrote to memory of 1524 652 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe cmd.exe PID 652 wrote to memory of 1524 652 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe cmd.exe PID 652 wrote to memory of 1524 652 0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe cmd.exe PID 1524 wrote to memory of 2272 1524 cmd.exe taskkill.exe PID 1524 wrote to memory of 2272 1524 cmd.exe taskkill.exe PID 1524 wrote to memory of 2272 1524 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe"C:\Users\Admin\AppData\Local\Temp\0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 7762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 9522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 9562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 14482⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0872c8d11892c95f425def00328fd6eeacfd308d6799cd69aad50ca0b4137941.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 15122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 652 -ip 6521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 652 -ip 6521⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/652-1-0x0000000004350000-0x0000000004450000-memory.dmpFilesize
1024KB
-
memory/652-2-0x0000000004310000-0x000000000433D000-memory.dmpFilesize
180KB
-
memory/652-4-0x0000000000400000-0x0000000004049000-memory.dmpFilesize
60.3MB
-
memory/652-5-0x0000000004310000-0x000000000433D000-memory.dmpFilesize
180KB