Analysis
-
max time kernel
139s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe
Resource
win10v2004-20240419-en
General
-
Target
7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe
-
Size
273KB
-
MD5
f89a5436701b9dc5e4da6bdf2269e421
-
SHA1
ffa25e07c087e1c92e749fcb35a0add474daaa26
-
SHA256
7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001
-
SHA512
8af203f2535dc4691e5da664ae94db13035cc7a69172f9b5514c0e5ca3e0c770c55c6986857a0c4963da06ef81479ecc8354e969fe3465c1d86ef80b5bdeaa92
-
SSDEEP
3072:n6q+A5xbCdZhDiGleQKiFNqfjKAqVL7RT+nMu5RYBie5Wlz6BQbn:n6q+A5xCheGleQProsh7wMMCBiNZqQD
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation 7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 3168 2316 WerFault.exe 82 2928 2316 WerFault.exe 82 3188 2316 WerFault.exe 82 1904 2316 WerFault.exe 82 4828 2316 WerFault.exe 82 4080 2316 WerFault.exe 82 1040 2316 WerFault.exe 82 3028 2316 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 4428 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4428 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2316 wrote to memory of 4412 2316 7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe 110 PID 2316 wrote to memory of 4412 2316 7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe 110 PID 2316 wrote to memory of 4412 2316 7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe 110 PID 4412 wrote to memory of 4428 4412 cmd.exe 114 PID 4412 wrote to memory of 4428 4412 cmd.exe 114 PID 4412 wrote to memory of 4428 4412 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe"C:\Users\Admin\AppData\Local\Temp\7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 7402⤵
- Program crash
PID:3168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 7602⤵
- Program crash
PID:2928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 7962⤵
- Program crash
PID:3188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 8442⤵
- Program crash
PID:1904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 9042⤵
- Program crash
PID:4828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 9842⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 13282⤵
- Program crash
PID:1040
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7f2adb49175b395189f62369371725fcc4505ed5ea4bc869b18e8266a5048001.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 13722⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2316 -ip 23161⤵PID:1560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2316 -ip 23161⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2316 -ip 23161⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2316 -ip 23161⤵PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2316 -ip 23161⤵PID:1472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2316 -ip 23161⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2316 -ip 23161⤵PID:3672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2316 -ip 23161⤵PID:3628