Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 15:39
Static task
static1
Behavioral task
behavioral1
Sample
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe
Resource
win10v2004-20240508-en
General
-
Target
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe
-
Size
357KB
-
MD5
a07fb89e0682ebe5081b234c07c26bf2
-
SHA1
25bddc09e76a4df0a28df2caba22a5a87ca4f0ed
-
SHA256
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293
-
SHA512
7e9964f5a6371dadc14d2aeca1d3ed2d19c2938eecf3f0f56fc009b95a70ed069ed12e3a9c546c758a12a36f360980b6d4b8b81c4eede0d05406bc121fd1557d
-
SSDEEP
3072:e90unpUrdGeRge6a858FrZdUhlMTtYFtHsOWcluJdOjCnXeyQvlN5O2+/xuU9:equpaGeRr6HCFNQqoHwcluzOmnu3Ot
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1568 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2428 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2808 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 4952 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2024 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 1780 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 3256 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2820 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2228 5032 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 384 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 384 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.execmd.exedescription pid process target process PID 5032 wrote to memory of 4036 5032 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe cmd.exe PID 5032 wrote to memory of 4036 5032 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe cmd.exe PID 5032 wrote to memory of 4036 5032 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe cmd.exe PID 4036 wrote to memory of 384 4036 cmd.exe taskkill.exe PID 4036 wrote to memory of 384 4036 cmd.exe taskkill.exe PID 4036 wrote to memory of 384 4036 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe"C:\Users\Admin\AppData\Local\Temp\78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 4482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 8602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 9322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 13722⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 4922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5032 -ip 50321⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5032 -ip 50321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5032-2-0x0000000002110000-0x000000000214C000-memory.dmpFilesize
240KB
-
memory/5032-1-0x0000000002150000-0x0000000002250000-memory.dmpFilesize
1024KB
-
memory/5032-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5032-7-0x0000000002110000-0x000000000214C000-memory.dmpFilesize
240KB
-
memory/5032-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5032-6-0x0000000000400000-0x0000000001FA5000-memory.dmpFilesize
27.6MB