Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 22:57
Static task
static1
Behavioral task
behavioral1
Sample
4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe
Resource
win10v2004-20240426-en
General
-
Target
4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe
-
Size
365KB
-
MD5
f13c27543b565d65856bc971891c807b
-
SHA1
3cc17ab47f4eafe2e47ee662a01befb258af4cf2
-
SHA256
4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0
-
SHA512
e6e33b0d0579d2e33e3bc4e29c44c86cfceeebdb2bc2090f77200e07c8d6fece295487db73209f3d6bf300a44a37e8ef1fd4343a9b47e7530806f929c1d85111
-
SSDEEP
6144:rzYDyFpYOaTbuTwYQ+O6KENu5jQ+YmXPIZB:/YwpYOaXrz+LK6u5z/cB
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1800 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 4144 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 3184 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 4680 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 5108 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 3736 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 2348 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 2132 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 4708 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe 4400 4076 WerFault.exe 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1256 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1256 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.execmd.exedescription pid process target process PID 4076 wrote to memory of 3944 4076 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe cmd.exe PID 4076 wrote to memory of 3944 4076 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe cmd.exe PID 4076 wrote to memory of 3944 4076 4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe cmd.exe PID 3944 wrote to memory of 1256 3944 cmd.exe taskkill.exe PID 3944 wrote to memory of 1256 3944 cmd.exe taskkill.exe PID 3944 wrote to memory of 1256 3944 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe"C:\Users\Admin\AppData\Local\Temp\4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 4522⤵
- Program crash
PID:1800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 7642⤵
- Program crash
PID:4144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 7842⤵
- Program crash
PID:3184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 7842⤵
- Program crash
PID:4680 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 8562⤵
- Program crash
PID:5108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 8642⤵
- Program crash
PID:3736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 8642⤵
- Program crash
PID:2348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 10562⤵
- Program crash
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 13802⤵
- Program crash
PID:4708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4245154ebc2f80bc83c4c040b24da0642f07aa650d75406a6638dc09b02758a0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 5122⤵
- Program crash
PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4076 -ip 40761⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4076 -ip 40761⤵PID:1844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4076 -ip 40761⤵PID:3252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4076 -ip 40761⤵PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4076 -ip 40761⤵PID:4168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4076 -ip 40761⤵PID:3380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4076 -ip 40761⤵PID:3492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4076 -ip 40761⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4076 -ip 40761⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4076 -ip 40761⤵PID:4044