Analysis
-
max time kernel
136s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 12:43
Static task
static1
Behavioral task
behavioral1
Sample
0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe
Resource
win10v2004-20240426-en
General
-
Target
0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe
-
Size
256KB
-
MD5
1e29e4708cbb005b646eafa383e6f42c
-
SHA1
54c70263d8730ac6cf9f010b4b5536722116e9b7
-
SHA256
0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524
-
SHA512
ef845ffa4a5ba8777045cb4823457aff324b034c2182a737c0ba614606db6cfc1764145a2358ef04501830a5dfee2c3daa84c27372faaa75381dca2313d49e45
-
SSDEEP
3072:25tM3GMNpMRuuuHKOJTZnSqrXss/Glmc41n5h5cz:cu3ZNMp6JTV2MpX+z
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 2348 1212 WerFault.exe 81 4616 1212 WerFault.exe 81 2564 1212 WerFault.exe 81 880 1212 WerFault.exe 81 2888 1212 WerFault.exe 81 1780 1212 WerFault.exe 81 3844 1212 WerFault.exe 81 3668 1212 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 1964 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1964 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1212 wrote to memory of 1204 1212 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe 106 PID 1212 wrote to memory of 1204 1212 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe 106 PID 1212 wrote to memory of 1204 1212 0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe 106 PID 1204 wrote to memory of 1964 1204 cmd.exe 110 PID 1204 wrote to memory of 1964 1204 cmd.exe 110 PID 1204 wrote to memory of 1964 1204 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe"C:\Users\Admin\AppData\Local\Temp\0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 7402⤵
- Program crash
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 7602⤵
- Program crash
PID:4616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 7402⤵
- Program crash
PID:2564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 8322⤵
- Program crash
PID:880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 9042⤵
- Program crash
PID:2888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 9922⤵
- Program crash
PID:1780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 13442⤵
- Program crash
PID:3844
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0f6279c2e5546c577b3209c66dc2b0e742cc04372ad8c8cdbc2f1b6d2d842524.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 14562⤵
- Program crash
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1212 -ip 12121⤵PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1212 -ip 12121⤵PID:4456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1212 -ip 12121⤵PID:4860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1212 -ip 12121⤵PID:1912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1212 -ip 12121⤵PID:1220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1212 -ip 12121⤵PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1212 -ip 12121⤵PID:4396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1212 -ip 12121⤵PID:2028