Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 07:22
Static task
static1
Behavioral task
behavioral1
Sample
b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe
Resource
win7-20240419-en
General
-
Target
b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe
-
Size
262KB
-
MD5
dba3846a51c92775dac4fe38fe1565fc
-
SHA1
fde82884cf24699f55378ced90a106d0d370b033
-
SHA256
b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b
-
SHA512
b8b2f71d91e4a1c44b5f5c634e67bbca7e0424e78ede4607920fd87b0c81d71a41d21ca1a55e3ad6f000ee067f5dcd750ee341f8ec1238042fe1db30cac38bc0
-
SSDEEP
6144:/6xMSaDuUKG2sGGQmDJzx82WaD7sRuiae/Y:/6xraCvHGQoShakRha
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2240 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 2140 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 4188 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 2592 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 1144 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 640 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 3516 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 1572 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 908 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 4868 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe 3256 2684 WerFault.exe b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2688 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2688 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.execmd.exedescription pid process target process PID 2684 wrote to memory of 1732 2684 b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe cmd.exe PID 2684 wrote to memory of 1732 2684 b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe cmd.exe PID 2684 wrote to memory of 1732 2684 b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe cmd.exe PID 1732 wrote to memory of 2688 1732 cmd.exe taskkill.exe PID 1732 wrote to memory of 2688 1732 cmd.exe taskkill.exe PID 1732 wrote to memory of 2688 1732 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe"C:\Users\Admin\AppData\Local\Temp\b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 7682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 7602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 13562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 13722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2684 -ip 26841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2684 -ip 26841⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-1-0x0000000002DC0000-0x0000000002EC0000-memory.dmpFilesize
1024KB
-
memory/2684-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/2684-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2684-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2684-6-0x0000000000400000-0x0000000002C99000-memory.dmpFilesize
40.6MB