Analysis
-
max time kernel
90s -
max time network
92s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-05-2024 00:29
Static task
static1
Behavioral task
behavioral1
Sample
625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe
Resource
win10v2004-20240426-en
General
-
Target
625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe
-
Size
271KB
-
MD5
29a578e9ca5f23457a46957565033ed1
-
SHA1
045244ff6ab7488196eefbb98e80d7e3d08bcfab
-
SHA256
625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d
-
SHA512
8e4c1770383af78e41b44a1ae6e0821b74c27697d52115a7da07b110da48ea7d7689fdec3ca44fcfd236942d6b38e0873efab4f27bba717264ae99d0de666bb3
-
SSDEEP
3072:qszvEp6yhByoQ2g2Z6+ls2w4NVRQEQBB/p5VPcLJT/am0Az13luQrhRT8UeaFXOu:V3QYo89GgjxTUVr0Az11uARTFeaFhP7
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1096 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 3504 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 4860 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 1104 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 4884 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 1432 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 2552 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 4276 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 4416 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe 2956 1000 WerFault.exe 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 816 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 816 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.execmd.exedescription pid process target process PID 1000 wrote to memory of 2916 1000 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe cmd.exe PID 1000 wrote to memory of 2916 1000 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe cmd.exe PID 1000 wrote to memory of 2916 1000 625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe cmd.exe PID 2916 wrote to memory of 816 2916 cmd.exe taskkill.exe PID 2916 wrote to memory of 816 2916 cmd.exe taskkill.exe PID 2916 wrote to memory of 816 2916 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe"C:\Users\Admin\AppData\Local\Temp\625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 4722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 8122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 8522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 10722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 14562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "625f6d25ec7575ecdeba86082b63f829d149349fe460bfe39fa3c02b288a057d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 12642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1000 -ip 10001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1000 -ip 10001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/1000-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1000-1-0x0000000002D40000-0x0000000002E40000-memory.dmpFilesize
1024KB
-
memory/1000-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1000-6-0x0000000000400000-0x0000000002CA2000-memory.dmpFilesize
40.6MB