Analysis
-
max time kernel
90s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-05-2024 23:13
Static task
static1
Behavioral task
behavioral1
Sample
d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe
Resource
win10v2004-20240426-en
General
-
Target
d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe
-
Size
283KB
-
MD5
1c77ac518b998b4649c9db9115819bf5
-
SHA1
fcb2b5998bbf741a76df612be91da2959b14f4cd
-
SHA256
d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273
-
SHA512
6cfc6447084fbd9b6877eb3e90f68664a4268dcde6eb68251e7174ea5ad5301f30b7b504d12936f4b818ba334494a901506c4fb7245ec3abadbcfc84eea3a079
-
SSDEEP
6144:j2O8YDWkNz7jMq7OjoUCMCw6SmWKIeeo61LbPeT3Y:j2OVDWmzUq7OqmFKIIq
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3344 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 4016 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 4700 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 1852 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 3952 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 2064 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 2540 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 3992 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 688 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe 5016 2400 WerFault.exe d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3440 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3440 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.execmd.exedescription pid process target process PID 2400 wrote to memory of 2944 2400 d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe cmd.exe PID 2400 wrote to memory of 2944 2400 d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe cmd.exe PID 2400 wrote to memory of 2944 2400 d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe cmd.exe PID 2944 wrote to memory of 3440 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 3440 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 3440 2944 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe"C:\Users\Admin\AppData\Local\Temp\d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 5322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 14522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "d9caf6972a0f22528686354f7e994b3853f86661c11c2b804733b967ccca4273.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 15442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2400 -ip 24001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2400 -ip 24001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2400-1-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/2400-2-0x00000000020A0000-0x00000000020DC000-memory.dmpFilesize
240KB
-
memory/2400-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-6-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2400-7-0x00000000020A0000-0x00000000020DC000-memory.dmpFilesize
240KB
-
memory/2400-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB