Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 23:48
Static task
static1
Behavioral task
behavioral1
Sample
7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe
Resource
win7-20231129-en
General
-
Target
7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe
-
Size
283KB
-
MD5
062be021b0337e2f22ca9d8d489b36c9
-
SHA1
c6fc350e0cc212a820e53a5edfa27293c533d2ad
-
SHA256
7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9
-
SHA512
b31eaa451f247ba65a7ac59bd5fc86e1b6eda36a32b06a46ddf4c5738f382fd773829889a34e46de751bd8d2281dd45b348ddad38eb337d6aed68ff2e3c1fb6b
-
SSDEEP
3072:WZen08ICS6qlZk2CcoyZ/bwsvJD4TswKYOlPFPwc4Mg8lhtG5jgdKOnc:30BkNc7/Uud4TJalP1bgg0gdK
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 1528 4344 WerFault.exe 82 2340 4344 WerFault.exe 82 4184 4344 WerFault.exe 82 1752 4344 WerFault.exe 82 1904 4344 WerFault.exe 82 4564 4344 WerFault.exe 82 4948 4344 WerFault.exe 82 3964 4344 WerFault.exe 82 4428 4344 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 860 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 860 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4344 wrote to memory of 1756 4344 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 113 PID 4344 wrote to memory of 1756 4344 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 113 PID 4344 wrote to memory of 1756 4344 7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe 113 PID 1756 wrote to memory of 860 1756 cmd.exe 117 PID 1756 wrote to memory of 860 1756 cmd.exe 117 PID 1756 wrote to memory of 860 1756 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe"C:\Users\Admin\AppData\Local\Temp\7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 7402⤵
- Program crash
PID:1528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 7802⤵
- Program crash
PID:2340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 7402⤵
- Program crash
PID:4184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 8322⤵
- Program crash
PID:1752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 9042⤵
- Program crash
PID:1904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 9802⤵
- Program crash
PID:4564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 10162⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 13402⤵
- Program crash
PID:3964
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7e2184182ec32918ec7ca20fa529bf7f935a9a5cb3f785886fb5aef485bbd2f9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 13722⤵
- Program crash
PID:4428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4344 -ip 43441⤵PID:2644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4344 -ip 43441⤵PID:2612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4344 -ip 43441⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4344 -ip 43441⤵PID:944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4344 -ip 43441⤵PID:3584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4344 -ip 43441⤵PID:1576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4344 -ip 43441⤵PID:4080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4344 -ip 43441⤵PID:2772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4344 -ip 43441⤵PID:2184