Analysis
-
max time kernel
90s -
max time network
101s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe
Resource
win10v2004-20240426-en
General
-
Target
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe
-
Size
360KB
-
MD5
b725adf3244f06223c69c991617546a5
-
SHA1
50baac6054c0dd4ecdfc52953555116c2d1a19fe
-
SHA256
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd
-
SHA512
c687aa509224bc68835c066dc1f627f15b090d8a35d3f0872d97148cb5d793a2ec127778167254058883e4c9854500d362a94229276f26fd49802f7e7e818d4a
-
SSDEEP
3072:+1sIm5FmI9FtoEueykAS5H4vukzXBsS6KHi1ynwNwjcFAk02wE5YS6p7HBy:Ks/5RFOGAvrm+iEwNwjcFAk0jlB
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4588 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 3332 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 1240 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 3320 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 744 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 1028 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 4800 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 996 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe 3124 5032 WerFault.exe 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1436 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1436 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.execmd.exedescription pid process target process PID 5032 wrote to memory of 2204 5032 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe cmd.exe PID 5032 wrote to memory of 2204 5032 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe cmd.exe PID 5032 wrote to memory of 2204 5032 7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe cmd.exe PID 2204 wrote to memory of 1436 2204 cmd.exe taskkill.exe PID 2204 wrote to memory of 1436 2204 cmd.exe taskkill.exe PID 2204 wrote to memory of 1436 2204 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe"C:\Users\Admin\AppData\Local\Temp\7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 8482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 15002⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7d16d748b50b96af9463f72ffb4646dad6d0b399b150e42bdd2542e2cc014dbd.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 14042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5032 -ip 50321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5032-1-0x0000000002490000-0x0000000002590000-memory.dmpFilesize
1024KB
-
memory/5032-2-0x0000000004080000-0x00000000040BC000-memory.dmpFilesize
240KB
-
memory/5032-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5032-7-0x0000000004080000-0x00000000040BC000-memory.dmpFilesize
240KB
-
memory/5032-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5032-6-0x0000000000400000-0x0000000002376000-memory.dmpFilesize
31.5MB