Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 23:39
Static task
static1
Behavioral task
behavioral1
Sample
d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe
Resource
win10v2004-20240226-en
General
-
Target
d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe
-
Size
262KB
-
MD5
8b9353cb3b64da37174d34c3c43eb6dc
-
SHA1
4b1cda570950f562c49a84e052037dfe7cae9d92
-
SHA256
d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8
-
SHA512
4ec2607cbaed9e28bdb579627cc2a6ca295039d8226cec21221c22e6513b3d3a7cbb962b996b2fe6c0afd18b5237bbdd266a7b399c9649de055b7e6611ebb56f
-
SSDEEP
6144:pptiwAsTI5qszTtKBli++fUJdf67yZDHY:pptiwAiI591++MJp6m
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3844 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 4036 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 2760 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 3360 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 532 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 2664 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 3348 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 3756 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 1548 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe 3044 4188 WerFault.exe d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2308 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2308 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.execmd.exedescription pid process target process PID 4188 wrote to memory of 3416 4188 d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe cmd.exe PID 4188 wrote to memory of 3416 4188 d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe cmd.exe PID 4188 wrote to memory of 3416 4188 d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe cmd.exe PID 3416 wrote to memory of 2308 3416 cmd.exe taskkill.exe PID 3416 wrote to memory of 2308 3416 cmd.exe taskkill.exe PID 3416 wrote to memory of 2308 3416 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe"C:\Users\Admin\AppData\Local\Temp\d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 13562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "d573c52d123b2108172188f04d5deb983b6a8c73be5e5b660e567da1f91e96a8.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 13042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4188 -ip 41881⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4188-1-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB
-
memory/4188-2-0x0000000002090000-0x00000000020CC000-memory.dmpFilesize
240KB
-
memory/4188-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4188-5-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4188-9-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4188-8-0x0000000002090000-0x00000000020CC000-memory.dmpFilesize
240KB
-
memory/4188-7-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB