Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 15:33
Static task
static1
Behavioral task
behavioral1
Sample
0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe
Resource
win10v2004-20240508-en
General
-
Target
0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe
-
Size
270KB
-
MD5
18347695f260995a2c6f706e300809a8
-
SHA1
44b677a1916fae0a48a514a7747c605e6ac75506
-
SHA256
0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914
-
SHA512
894428cb810d2665f0a9a57712996a8c2a76c11cdd8778aacb897c28cf63ff2ace8eb791bb647ff435511acd6c604de57e6971fdc669383f4f80e72561f42d94
-
SSDEEP
6144:SH+nU6qNhXWOs8A7yOwMPY76axlD0f4TpKbetQkAdbm:SH+U6qzWUOwcYlD0aYbeJAg
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1800 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 4992 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 728 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 3304 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 4612 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 3320 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 4408 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 2360 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 404 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 4268 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe 2200 376 WerFault.exe 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3012 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3012 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.execmd.exedescription pid process target process PID 376 wrote to memory of 1020 376 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe cmd.exe PID 376 wrote to memory of 1020 376 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe cmd.exe PID 376 wrote to memory of 1020 376 0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe cmd.exe PID 1020 wrote to memory of 3012 1020 cmd.exe taskkill.exe PID 1020 wrote to memory of 3012 1020 cmd.exe taskkill.exe PID 1020 wrote to memory of 3012 1020 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe"C:\Users\Admin\AppData\Local\Temp\0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 4522⤵
- Program crash
PID:1800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 4562⤵
- Program crash
PID:4992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 7482⤵
- Program crash
PID:728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 7842⤵
- Program crash
PID:3304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 7842⤵
- Program crash
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 8202⤵
- Program crash
PID:3320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 9122⤵
- Program crash
PID:4408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 9882⤵
- Program crash
PID:2360 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 10522⤵
- Program crash
PID:404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 13562⤵
- Program crash
PID:4268 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0fcd363a94473dfdb467c47887a54787f2a56d1c2ccfd7644ef49714dea55914.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 12842⤵
- Program crash
PID:2200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 376 -ip 3761⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 376 -ip 3761⤵PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 376 -ip 3761⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 376 -ip 3761⤵PID:632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 376 -ip 3761⤵PID:2508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 376 -ip 3761⤵PID:3552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 376 -ip 3761⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 376 -ip 3761⤵PID:1812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 376 -ip 3761⤵PID:4856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3764,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:81⤵PID:3412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 376 -ip 3761⤵PID:372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 376 -ip 3761⤵PID:1048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/376-1-0x0000000002D80000-0x0000000002E80000-memory.dmpFilesize
1024KB
-
memory/376-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/376-2-0x0000000004930000-0x000000000496C000-memory.dmpFilesize
240KB
-
memory/376-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/376-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB