Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 19:11
Static task
static1
Behavioral task
behavioral1
Sample
d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe
Resource
win10v2004-20240508-en
General
-
Target
d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe
-
Size
283KB
-
MD5
5b5ab97aee6adbebf8723ba2c8db59f5
-
SHA1
51d29bbf1aad66cfaba05e54c632cdc7f1e4c69c
-
SHA256
d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669
-
SHA512
52d756e62a8de9d312398e6fa2a7477b0097d3e5a5a976501ac6b828ed599ca2268d119df42b36469e4b8ae6ebadd039041339209fd288d9fd804044b8346f4c
-
SSDEEP
6144:A04BumjwNK22qDyOMsi5qL3/hRsUtPHWu2XaGtZT3Y:A04BumjauqGr8L7sUQrN
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2936 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 3564 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 2216 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 4984 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 1560 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 5024 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 2648 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 2004 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 2164 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe 3512 1164 WerFault.exe d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3504 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3504 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.execmd.exedescription pid process target process PID 1164 wrote to memory of 364 1164 d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe cmd.exe PID 1164 wrote to memory of 364 1164 d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe cmd.exe PID 1164 wrote to memory of 364 1164 d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe cmd.exe PID 364 wrote to memory of 3504 364 cmd.exe taskkill.exe PID 364 wrote to memory of 3504 364 cmd.exe taskkill.exe PID 364 wrote to memory of 3504 364 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe"C:\Users\Admin\AppData\Local\Temp\d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 5042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 7522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 8442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 13442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "d22863dd9482836326de751c5a39a1d45f5237de7ccd1091a309c31edfb65669.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 14682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1164 -ip 11641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1164 -ip 11641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-1-0x0000000000600000-0x0000000000700000-memory.dmpFilesize
1024KB
-
memory/1164-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1164-2-0x00000000020A0000-0x00000000020DC000-memory.dmpFilesize
240KB
-
memory/1164-6-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1164-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB