Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 10:27
Static task
static1
Behavioral task
behavioral1
Sample
40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe
Resource
win10v2004-20240419-en
General
-
Target
40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe
-
Size
301KB
-
MD5
328e6d14f53fe92b9b92f3c33b7bfa31
-
SHA1
abaad61372698dc98ecddfa219504593390599fe
-
SHA256
40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d
-
SHA512
c0e2266af63526685578201c7185f38cad05aac47da657115b0efe09c55174101b26a239b782f66cf64c06fe3a378ea8ddd392e514b74c5cfa9f1804fe80af8c
-
SSDEEP
3072:kL167ZZ4LpixjK7iJtW+EGQhSWSJyPlJzNAWFe5NoU3PlwoP4ikuKPyQ3+EaaiRt:kL5f4tWiGuuzNXyPq7yK13zaebDsW6a
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4780 1596 WerFault.exe 79 4836 1596 WerFault.exe 79 4940 1596 WerFault.exe 79 1572 1596 WerFault.exe 79 3884 1596 WerFault.exe 79 3236 1596 WerFault.exe 79 3464 1596 WerFault.exe 79 1452 1596 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 4972 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4972 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2804 1596 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe 97 PID 1596 wrote to memory of 2804 1596 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe 97 PID 1596 wrote to memory of 2804 1596 40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe 97 PID 2804 wrote to memory of 4972 2804 cmd.exe 100 PID 2804 wrote to memory of 4972 2804 cmd.exe 100 PID 2804 wrote to memory of 4972 2804 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe"C:\Users\Admin\AppData\Local\Temp\40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 7802⤵
- Program crash
PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 7882⤵
- Program crash
PID:4836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 7882⤵
- Program crash
PID:4940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 8042⤵
- Program crash
PID:1572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 9762⤵
- Program crash
PID:3884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 9842⤵
- Program crash
PID:3236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 14402⤵
- Program crash
PID:3464
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "40bf8658504479ccc0400eddf69a2bf173143520753304cef9776c94f206e66d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 13442⤵
- Program crash
PID:1452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 15961⤵PID:1800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1596 -ip 15961⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1596 -ip 15961⤵PID:4340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1596 -ip 15961⤵PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1596 -ip 15961⤵PID:2668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1596 -ip 15961⤵PID:3392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1596 -ip 15961⤵PID:1232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1596 -ip 15961⤵PID:4448