Analysis
-
max time kernel
90s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 09:15
Static task
static1
Behavioral task
behavioral1
Sample
f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe
Resource
win10v2004-20240508-en
General
-
Target
f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe
-
Size
248KB
-
MD5
8f06bde9da3b1d959c39a6a5de808583
-
SHA1
d1cb7e1363ec4047c000d9483bd720bf1f7fa4eb
-
SHA256
f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660
-
SHA512
6c924b66a3eca2dd540e91d6e3f8a8322772e9e8146b155d69697028b3d5ec85fa3819d234c45ed15a0f1634dc99189a6aae36075ba61894738bbffde7ae2d72
-
SSDEEP
3072:ikLBAsY+IEkN7prykneGsjFvoIlv1kreKpiyJB7g2TfDqBV/36e5g:iK2sYbDr9TMv3lereKRJ9bHqXiJ
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4480 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 3944 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 1072 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 2116 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 4804 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 788 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 4580 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 4000 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 3936 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe 2348 3416 WerFault.exe f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4472 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4472 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.execmd.exedescription pid process target process PID 3416 wrote to memory of 1448 3416 f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe cmd.exe PID 3416 wrote to memory of 1448 3416 f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe cmd.exe PID 3416 wrote to memory of 1448 3416 f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe cmd.exe PID 1448 wrote to memory of 4472 1448 cmd.exe taskkill.exe PID 1448 wrote to memory of 4472 1448 cmd.exe taskkill.exe PID 1448 wrote to memory of 4472 1448 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe"C:\Users\Admin\AppData\Local\Temp\f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 4762⤵
- Program crash
PID:4480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 7962⤵
- Program crash
PID:3944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 8362⤵
- Program crash
PID:1072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 8362⤵
- Program crash
PID:2116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 8482⤵
- Program crash
PID:4804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 10002⤵
- Program crash
PID:788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 10082⤵
- Program crash
PID:4580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 10842⤵
- Program crash
PID:4000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 14762⤵
- Program crash
PID:3936 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f3c0ac94b6d7d1300dae5c5de17e2298d2238bf81cfa07d63c62d21a2587c660.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 15602⤵
- Program crash
PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3416 -ip 34161⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3416 -ip 34161⤵PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3416 -ip 34161⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3416 -ip 34161⤵PID:1440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3416 -ip 34161⤵PID:692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3416 -ip 34161⤵PID:1792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3416 -ip 34161⤵PID:3280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3416 -ip 34161⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3416 -ip 34161⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3416 -ip 34161⤵PID:3992