Analysis
-
max time kernel
92s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 23:17
Static task
static1
Behavioral task
behavioral1
Sample
2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe
Resource
win10v2004-20240426-en
General
-
Target
2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe
-
Size
366KB
-
MD5
aa7e933ee48e373d14e549c9fef4f674
-
SHA1
34836b695a53627366f750fff61670b4e4cfbb5b
-
SHA256
2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00
-
SHA512
25dd3ac08fa8f02d2527e2a6e89f92fc79a3d27310231078acd32a0406d7db87fc91c689abf3615fc698c37b8ee7a5a1951a84297e6bfacaf1c6ba5281f473a0
-
SSDEEP
6144:cZuEzkdQmLMa5a7s8+JWGxBU6J0eo+5PEVR2NQaHB:guEzkdQmR5a7sFJW4b08R6Rkd
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1832 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 4236 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 2948 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 1988 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 3152 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 2624 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 4744 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 848 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe 3684 4648 WerFault.exe 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3732 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3732 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.execmd.exedescription pid process target process PID 4648 wrote to memory of 4532 4648 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe cmd.exe PID 4648 wrote to memory of 4532 4648 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe cmd.exe PID 4648 wrote to memory of 4532 4648 2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe cmd.exe PID 4532 wrote to memory of 3732 4532 cmd.exe taskkill.exe PID 4532 wrote to memory of 3732 4532 cmd.exe taskkill.exe PID 4532 wrote to memory of 3732 4532 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe"C:\Users\Admin\AppData\Local\Temp\2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 11082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 14522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2289b76b13faa5b931d69651fdc9fd3e3e489116e6943198ed91976a14be8f00.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 15562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4648 -ip 46481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4648 -ip 46481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4648-2-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4648-1-0x0000000002730000-0x0000000002830000-memory.dmpFilesize
1024KB
-
memory/4648-3-0x0000000000400000-0x0000000002378000-memory.dmpFilesize
31.5MB
-
memory/4648-6-0x0000000000400000-0x0000000002378000-memory.dmpFilesize
31.5MB
-
memory/4648-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB