Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 16:19
Static task
static1
Behavioral task
behavioral1
Sample
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe
Resource
win10v2004-20240426-en
General
-
Target
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe
-
Size
270KB
-
MD5
2dd4c7105c13ef07fba4aa155e081840
-
SHA1
e8d328c9e163490b0d22f781bc6fbaa481b97ad7
-
SHA256
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92
-
SHA512
53998bc7f2b227a63a559db41e2587d3e318667e1c9abeed937a10e0661bdfba1d34e70ca543ef45aa8d7311f56047cf483f61b0ed7221bca5245b578090f833
-
SSDEEP
3072:Es2Fhz52XsaRmJ+w+JkAu/heWp0gaWOsGI7b8nrvD3UD7hLSe8140QYtJqUAsZ/3:WccymjqBW65YGIsnrAX14tOMF
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4496 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 464 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 4844 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 2312 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 4868 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 1452 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 3616 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 3876 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 2856 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe 1940 4560 WerFault.exe 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2152 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2152 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.execmd.exedescription pid process target process PID 4560 wrote to memory of 1644 4560 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe cmd.exe PID 4560 wrote to memory of 1644 4560 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe cmd.exe PID 4560 wrote to memory of 1644 4560 441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe cmd.exe PID 1644 wrote to memory of 2152 1644 cmd.exe taskkill.exe PID 1644 wrote to memory of 2152 1644 cmd.exe taskkill.exe PID 1644 wrote to memory of 2152 1644 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe"C:\Users\Admin\AppData\Local\Temp\441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 9602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 14362⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 14762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4560 -ip 45601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4560-1-0x0000000002E70000-0x0000000002F70000-memory.dmpFilesize
1024KB
-
memory/4560-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4560-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/4560-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4560-6-0x0000000000400000-0x0000000002CA2000-memory.dmpFilesize
40.6MB