Analysis
-
max time kernel
291s -
max time network
203s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
23-05-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe
Resource
win7-20231129-en
General
-
Target
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe
-
Size
259KB
-
MD5
c1664a27283f43a4f91dde80f52adc9e
-
SHA1
618fd68f461522db5ff1157f1b8c4da72056274b
-
SHA256
1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9
-
SHA512
5a669a261d2c8c0a2051dd462726f2f43f207f32e29812268b55f074bb7c9c22da2b53581803df212913daea3f85287512b76ceb17dc134266f7e2f28fd8d4fd
-
SSDEEP
3072:OIAQeTJjrld/qVXC3qNlXrOoLj5t0dMkU9vfI2zuhw358X/v4QgEPB45:OIeTeXoqNBCoLj/03SvfI2q+3ePvSQ
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 436 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 1196 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 3232 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 3204 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 1328 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 1164 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 4660 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 4520 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 3612 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe 1552 4920 WerFault.exe 1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe"C:\Users\Admin\AppData\Local\Temp\1c10d5c503c678bd7ecc7209853f5ea8ef36bd38532b5a76093bd8d149c32eb9.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 5242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 7922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 10042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 9802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 11442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 11562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 12962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 13122⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4920-1-0x00000000021D0000-0x00000000022D0000-memory.dmpFilesize
1024KB
-
memory/4920-2-0x0000000002110000-0x000000000214C000-memory.dmpFilesize
240KB
-
memory/4920-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4920-6-0x0000000000400000-0x0000000001F8C000-memory.dmpFilesize
27.5MB
-
memory/4920-7-0x00000000021D0000-0x00000000022D0000-memory.dmpFilesize
1024KB
-
memory/4920-9-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB