Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 00:13
Static task
static1
Behavioral task
behavioral1
Sample
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe
Resource
win10v2004-20240508-en
General
-
Target
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe
-
Size
380KB
-
MD5
c98b465dcff9411ba3ca035ebc55bfd4
-
SHA1
f824b8eae510d7740a497f7e776a79e45c04b20b
-
SHA256
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8
-
SHA512
a7c6b9d5413fa3f61db9ccfa642de2655f0c01b5248525816847057fe7bd6ad8f285cd09a79f6e983472cb0f6fd09d3fbacf527f58b4533bc618d818e75fe156
-
SSDEEP
6144:OOCKlZmp+Uk4OWGdljNHigSpTegb1+fHB:VCKjjUXOFijfg
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4896 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 688 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 1276 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 3536 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 2956 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 4844 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 984 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 760 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe 4692 240 WerFault.exe 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5096 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 5096 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.execmd.exedescription pid process target process PID 240 wrote to memory of 4020 240 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe cmd.exe PID 240 wrote to memory of 4020 240 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe cmd.exe PID 240 wrote to memory of 4020 240 6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe cmd.exe PID 4020 wrote to memory of 5096 4020 cmd.exe taskkill.exe PID 4020 wrote to memory of 5096 4020 cmd.exe taskkill.exe PID 4020 wrote to memory of 5096 4020 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe"C:\Users\Admin\AppData\Local\Temp\6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 8922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 9922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 14602⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "6eecccb0f0a0b65fc520c137e2b4dd9d969e1fb41df341095750b0e3ebebaad8.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 15602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 240 -ip 2401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 240 -ip 2401⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-1-0x00000000025D0000-0x00000000026D0000-memory.dmpFilesize
1024KB
-
memory/240-2-0x00000000040B0000-0x00000000040EC000-memory.dmpFilesize
240KB
-
memory/240-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/240-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/240-7-0x00000000040B0000-0x00000000040EC000-memory.dmpFilesize
240KB
-
memory/240-6-0x0000000000400000-0x000000000237B000-memory.dmpFilesize
31.5MB