Analysis
-
max time kernel
90s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-05-2024 15:28
Static task
static1
Behavioral task
behavioral1
Sample
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe
Resource
win10v2004-20240226-en
General
-
Target
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe
-
Size
255KB
-
MD5
12068b3c709689a76e7432ded539ab7c
-
SHA1
579515827d3db8f7a6c7fda2a3d68274538d7179
-
SHA256
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a
-
SHA512
842b4b4adb51a8ba20748bd777cd413cb1f1254ae10f7f372b10374b6afe360e8e1eebf4ffccc524ba5b3d15280d2b408d6bb36f9b6a617c194784ac248697db
-
SSDEEP
6144:aehwWf8SYTepVWgv2YwRh9SDXgcj36+iMZ40:fhwWf8ApURVhiXgcb6Mq0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3400 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 872 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 4900 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 2692 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 244 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 1192 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 3696 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe 2964 1776 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4792 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4792 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.execmd.exedescription pid process target process PID 1776 wrote to memory of 1288 1776 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe cmd.exe PID 1776 wrote to memory of 1288 1776 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe cmd.exe PID 1776 wrote to memory of 1288 1776 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe cmd.exe PID 1288 wrote to memory of 4792 1288 cmd.exe taskkill.exe PID 1288 wrote to memory of 4792 1288 cmd.exe taskkill.exe PID 1288 wrote to memory of 4792 1288 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe"C:\Users\Admin\AppData\Local\Temp\3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 8442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 9762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 9802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 14362⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 14642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1776 -ip 17761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1776-1-0x0000000000710000-0x0000000000810000-memory.dmpFilesize
1024KB
-
memory/1776-2-0x00000000021B0000-0x00000000021DD000-memory.dmpFilesize
180KB
-
memory/1776-3-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1776-5-0x0000000000400000-0x0000000000489000-memory.dmpFilesize
548KB
-
memory/1776-7-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1776-6-0x00000000021B0000-0x00000000021DD000-memory.dmpFilesize
180KB