Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 12:41
Static task
static1
Behavioral task
behavioral1
Sample
a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe
Resource
win10v2004-20240426-en
General
-
Target
a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe
-
Size
287KB
-
MD5
07fb5ea5634bac4b19ea838e43710647
-
SHA1
51b00e580933da1666c6a7e37a3100bc7981f287
-
SHA256
a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356
-
SHA512
f558c16fc40d0e8de949115aa19fd587b3b566ed67a0345de43862c61d0631bafb9d7f77a1a295898a654db6aec9ee1c1570d10522f9b3e69142a52eb80b2f8c
-
SSDEEP
6144:XxXHmOJ840xUW10pEMmhpOj48UGdPZ40:BXHmOOUtiMQSZjq0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3412 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 3376 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 232 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 2940 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 4468 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 4216 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 388 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 4856 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 1624 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe 4696 3240 WerFault.exe a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3676 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3676 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.execmd.exedescription pid process target process PID 3240 wrote to memory of 2336 3240 a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe cmd.exe PID 3240 wrote to memory of 2336 3240 a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe cmd.exe PID 3240 wrote to memory of 2336 3240 a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe cmd.exe PID 2336 wrote to memory of 3676 2336 cmd.exe taskkill.exe PID 2336 wrote to memory of 3676 2336 cmd.exe taskkill.exe PID 2336 wrote to memory of 3676 2336 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe"C:\Users\Admin\AppData\Local\Temp\a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 7682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 7602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 13482⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "a687c9797742a530c9ceb0749a408fa7d1248ca9bc8d44f49c30bbdf98841356.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 13802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3240 -ip 32401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3240 -ip 32401⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3240-1-0x00000000005D0000-0x00000000006D0000-memory.dmpFilesize
1024KB
-
memory/3240-2-0x0000000000560000-0x000000000059C000-memory.dmpFilesize
240KB
-
memory/3240-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3240-6-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/3240-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3240-7-0x0000000000560000-0x000000000059C000-memory.dmpFilesize
240KB