Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:03
Static task
static1
Behavioral task
behavioral1
Sample
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe
Resource
win10v2004-20240426-en
General
-
Target
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe
-
Size
270KB
-
MD5
0d7bc4f75ec2bf635a8b0ce7f3b4e009
-
SHA1
b40e2d30a51a267374cdb2dc9dcc8a962ee5b9c4
-
SHA256
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c
-
SHA512
59b1b16baef14b08be2811040e62a6b706edebcee188576fe9df9c65e9bd5e98a78eaf0a8d6aef887ed0682a07ebfdb92980dc07993c527b3fbd9c95e441442d
-
SSDEEP
6144:ToqoKiWrGhDQf8VtT5c0/w5qcGCnyzJneVNGbBCZI:TNhiWr2DHVtT5hY36JeVuBH
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3068 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 3940 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 528 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 1968 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 4616 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 936 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 1648 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 3980 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 432 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 4520 2736 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3548 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3548 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.execmd.exedescription pid process target process PID 2736 wrote to memory of 3236 2736 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe cmd.exe PID 2736 wrote to memory of 3236 2736 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe cmd.exe PID 2736 wrote to memory of 3236 2736 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe cmd.exe PID 3236 wrote to memory of 3548 3236 cmd.exe taskkill.exe PID 3236 wrote to memory of 3548 3236 cmd.exe taskkill.exe PID 3236 wrote to memory of 3548 3236 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe"C:\Users\Admin\AppData\Local\Temp\33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 4562⤵
- Program crash
PID:3068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 4802⤵
- Program crash
PID:3940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 7482⤵
- Program crash
PID:528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 7682⤵
- Program crash
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 7882⤵
- Program crash
PID:4616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 7482⤵
- Program crash
PID:936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 9122⤵
- Program crash
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 9882⤵
- Program crash
PID:3980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 13522⤵
- Program crash
PID:432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 13002⤵
- Program crash
PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2736 -ip 27361⤵PID:1044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2736 -ip 27361⤵PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2736 -ip 27361⤵PID:4932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2736 -ip 27361⤵PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2736 -ip 27361⤵PID:1980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2736 -ip 27361⤵PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2736 -ip 27361⤵PID:1460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2736 -ip 27361⤵PID:816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2736 -ip 27361⤵PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2736 -ip 27361⤵PID:4844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2736-1-0x0000000002F10000-0x0000000003010000-memory.dmpFilesize
1024KB
-
memory/2736-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2736-2-0x0000000002E00000-0x0000000002E3C000-memory.dmpFilesize
240KB
-
memory/2736-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2736-6-0x0000000000400000-0x0000000002CA2000-memory.dmpFilesize
40.6MB