Analysis
-
max time kernel
90s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe
Resource
win10v2004-20240426-en
General
-
Target
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe
-
Size
268KB
-
MD5
d4b5defd49386b58a8eafe6560dc94d5
-
SHA1
c9492d819ce38cc74489b40cfd2fd4cd97a0b747
-
SHA256
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774
-
SHA512
7d8c8564524c278bf32c960080d40fa491ca0dddaecb06e1831c4723a4a84564b9f1165d2f5d03cc22e7a246c0b1559403c1f3b673998a7b3beebebdd38bc0a0
-
SSDEEP
3072:sn0oqvhLPtBUM952fX+D4BXVK48IA1xWJy95KbWUEc5RFcu2v:s0oEFBUw5Gc4BXYTQG0SU3F
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4520 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 1928 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 2880 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 5052 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 4820 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 1520 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 4908 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 2416 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe 1264 1468 WerFault.exe 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4420 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4420 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.execmd.exedescription pid process target process PID 1468 wrote to memory of 748 1468 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe cmd.exe PID 1468 wrote to memory of 748 1468 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe cmd.exe PID 1468 wrote to memory of 748 1468 4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe cmd.exe PID 748 wrote to memory of 4420 748 cmd.exe taskkill.exe PID 748 wrote to memory of 4420 748 cmd.exe taskkill.exe PID 748 wrote to memory of 4420 748 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe"C:\Users\Admin\AppData\Local\Temp\4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 4762⤵
- Program crash
PID:4520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 7962⤵
- Program crash
PID:1928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 8162⤵
- Program crash
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 8562⤵
- Program crash
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 9002⤵
- Program crash
PID:4820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 10002⤵
- Program crash
PID:1520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 11042⤵
- Program crash
PID:4908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 14482⤵
- Program crash
PID:2416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4b6c4c17e2a9200eb820f2bd7aa0b30d420299b0aa1599ae935e7409a0124774.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 5442⤵
- Program crash
PID:1264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1468 -ip 14681⤵PID:3132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1468 -ip 14681⤵PID:3512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1468 -ip 14681⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1468 -ip 14681⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1468 -ip 14681⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1468 -ip 14681⤵PID:1456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1468 -ip 14681⤵PID:2096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1468 -ip 14681⤵PID:4620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1468 -ip 14681⤵PID:4316