Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-05-2024 15:31
Static task
static1
Behavioral task
behavioral1
Sample
29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe
Resource
win10v2004-20240426-en
General
-
Target
29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe
-
Size
300KB
-
MD5
d180fd1f59df9817e5abba03edd52549
-
SHA1
f62c62d94192bbdbd805532d08c403e3b70da73b
-
SHA256
29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327
-
SHA512
f900c1194f848a0974ca54d9ff04f599fd95e80912cd376ee49427cee592febe57c0c048e0e09d8201a62be627b90cf01b273437f2d7e0deebe68fe03dc86661
-
SSDEEP
3072:r/FQYRCokaTyFQUZvVrBI+BGQhSB3favGMYtl4E7mvX1y4rtlYB36H47bHwymJKP:RhStrWPGOaeMm4F1y4rct64bHw006a
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 3888 2604 WerFault.exe 78 1044 2604 WerFault.exe 78 3296 2604 WerFault.exe 78 3940 2604 WerFault.exe 78 4596 2604 WerFault.exe 78 3200 2604 WerFault.exe 78 3820 2604 WerFault.exe 78 2444 2604 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 4312 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4312 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4780 2604 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe 95 PID 2604 wrote to memory of 4780 2604 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe 95 PID 2604 wrote to memory of 4780 2604 29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe 95 PID 4780 wrote to memory of 4312 4780 cmd.exe 99 PID 4780 wrote to memory of 4312 4780 cmd.exe 99 PID 4780 wrote to memory of 4312 4780 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe"C:\Users\Admin\AppData\Local\Temp\29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 7722⤵
- Program crash
PID:3888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 8122⤵
- Program crash
PID:1044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 7722⤵
- Program crash
PID:3296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 8442⤵
- Program crash
PID:3940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 9762⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 9842⤵
- Program crash
PID:3200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 14562⤵
- Program crash
PID:3820
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "29604da2f38e73e1e55a37fd66941d8a4514fa6f2ee8b26222cffa55b80cb327.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 15082⤵
- Program crash
PID:2444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2604 -ip 26041⤵PID:1560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2604 -ip 26041⤵PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2604 -ip 26041⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2604 -ip 26041⤵PID:2848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2604 -ip 26041⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2604 -ip 26041⤵PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2604 -ip 26041⤵PID:1412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2604 -ip 26041⤵PID:1836