Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe
Resource
win10v2004-20240426-en
General
-
Target
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe
-
Size
360KB
-
MD5
b725adf3244f06223c69c991617546a5
-
SHA1
50baac6054c0dd4ecdfc52953555116c2d1a19fe
-
SHA256
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd
-
SHA512
c687aa509224bc68835c066dc1f627f15b090d8a35d3f0872d97148cb5d793a2ec127778167254058883e4c9854500d362a94229276f26fd49802f7e7e818d4a
-
SSDEEP
3072:+1sIm5FmI9FtoEueykAS5H4vukzXBsS6KHi1ynwNwjcFAk02wE5YS6p7HBy:Ks/5RFOGAvrm+iEwNwjcFAk0jlB
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1556 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 4856 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 1544 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 3400 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 2476 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 1044 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 4764 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 2316 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 1572 4876 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1568 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1568 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.execmd.exedescription pid process target process PID 4876 wrote to memory of 2160 4876 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe cmd.exe PID 4876 wrote to memory of 2160 4876 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe cmd.exe PID 4876 wrote to memory of 2160 4876 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe cmd.exe PID 2160 wrote to memory of 1568 2160 cmd.exe taskkill.exe PID 2160 wrote to memory of 1568 2160 cmd.exe taskkill.exe PID 2160 wrote to memory of 1568 2160 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe"C:\Users\Admin\AppData\Local\Temp\7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 8362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 9322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 13322⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 4922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4876 -ip 48761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4876-1-0x00000000024E0000-0x00000000025E0000-memory.dmpFilesize
1024KB
-
memory/4876-2-0x0000000003FC0000-0x0000000003FFC000-memory.dmpFilesize
240KB
-
memory/4876-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4876-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4876-6-0x0000000000400000-0x0000000002376000-memory.dmpFilesize
31.5MB