Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-05-2024 15:39
Static task
static1
Behavioral task
behavioral1
Sample
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe
Resource
win10v2004-20240508-en
General
-
Target
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe
-
Size
357KB
-
MD5
a07fb89e0682ebe5081b234c07c26bf2
-
SHA1
25bddc09e76a4df0a28df2caba22a5a87ca4f0ed
-
SHA256
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293
-
SHA512
7e9964f5a6371dadc14d2aeca1d3ed2d19c2938eecf3f0f56fc009b95a70ed069ed12e3a9c546c758a12a36f360980b6d4b8b81c4eede0d05406bc121fd1557d
-
SSDEEP
3072:e90unpUrdGeRge6a858FrZdUhlMTtYFtHsOWcluJdOjCnXeyQvlN5O2+/xuU9:equpaGeRr6HCFNQqoHwcluzOmnu3Ot
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2060 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 4904 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2696 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 4460 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 2672 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 1280 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 4812 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 5068 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe 768 4272 WerFault.exe 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3220 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3220 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.execmd.exedescription pid process target process PID 4272 wrote to memory of 2432 4272 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe cmd.exe PID 4272 wrote to memory of 2432 4272 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe cmd.exe PID 4272 wrote to memory of 2432 4272 78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe cmd.exe PID 2432 wrote to memory of 3220 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 3220 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 3220 2432 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe"C:\Users\Admin\AppData\Local\Temp\78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 8882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 11042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 14522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "78a63438d461feb4bc08815780426f4426776407c09aada3622033d1f6d3c293.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 5242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4272 -ip 42721⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4272-2-0x0000000003D10000-0x0000000003D4C000-memory.dmpFilesize
240KB
-
memory/4272-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4272-1-0x0000000002270000-0x0000000002370000-memory.dmpFilesize
1024KB
-
memory/4272-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4272-6-0x0000000000400000-0x0000000001FA5000-memory.dmpFilesize
27.6MB