Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 20:03
Static task
static1
Behavioral task
behavioral1
Sample
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe
Resource
win10v2004-20240426-en
General
-
Target
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe
-
Size
270KB
-
MD5
0d7bc4f75ec2bf635a8b0ce7f3b4e009
-
SHA1
b40e2d30a51a267374cdb2dc9dcc8a962ee5b9c4
-
SHA256
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c
-
SHA512
59b1b16baef14b08be2811040e62a6b706edebcee188576fe9df9c65e9bd5e98a78eaf0a8d6aef887ed0682a07ebfdb92980dc07993c527b3fbd9c95e441442d
-
SSDEEP
6144:ToqoKiWrGhDQf8VtT5c0/w5qcGCnyzJneVNGbBCZI:TNhiWr2DHVtT5hY36JeVuBH
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1840 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 2492 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 4968 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 2404 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 3932 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 2540 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 1464 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 4696 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 2988 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe 3920 3704 WerFault.exe 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4300 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4300 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.execmd.exedescription pid process target process PID 3704 wrote to memory of 2896 3704 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe cmd.exe PID 3704 wrote to memory of 2896 3704 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe cmd.exe PID 3704 wrote to memory of 2896 3704 33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe cmd.exe PID 2896 wrote to memory of 4300 2896 cmd.exe taskkill.exe PID 2896 wrote to memory of 4300 2896 cmd.exe taskkill.exe PID 2896 wrote to memory of 4300 2896 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe"C:\Users\Admin\AppData\Local\Temp\33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 14562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "33cfc7424055a4bdb59e403f9cd5f00f86766a1f385f8d44b405fcbae75da48c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 14482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3704 -ip 37041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3704-1-0x0000000002EA0000-0x0000000002FA0000-memory.dmpFilesize
1024KB
-
memory/3704-2-0x00000000049C0000-0x00000000049FC000-memory.dmpFilesize
240KB
-
memory/3704-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3704-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3704-6-0x0000000000400000-0x0000000002CA2000-memory.dmpFilesize
40.6MB