Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:44
Static task
static1
Behavioral task
behavioral1
Sample
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe
Resource
win10v2004-20240426-en
General
-
Target
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe
-
Size
275KB
-
MD5
3021048d6200956eed8425f8d13ed458
-
SHA1
eb5a332a726af47e67c641e7526082c553f71c03
-
SHA256
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a
-
SHA512
1f73cc7fea66ea131b267532a3b84ea46c34715910f12d6539434381935ad346cc625f25af0bc1cb0df65e26f08a98aa5af724b48dd661d6d38464525690bb0c
-
SSDEEP
6144:hfT+vt6FqlKk4VnP+1wAsieXkqOoRuJRqK40g:550z4VnP4sLX9tRb0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3416 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 2240 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 316 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 3464 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 2184 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 432 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 1428 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 4008 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 632 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 968 2504 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4016 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4016 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.execmd.exedescription pid process target process PID 2504 wrote to memory of 4596 2504 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe cmd.exe PID 2504 wrote to memory of 4596 2504 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe cmd.exe PID 2504 wrote to memory of 4596 2504 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe cmd.exe PID 4596 wrote to memory of 4016 4596 cmd.exe taskkill.exe PID 4596 wrote to memory of 4016 4596 cmd.exe taskkill.exe PID 4596 wrote to memory of 4016 4596 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe"C:\Users\Admin\AppData\Local\Temp\2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 4442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 13402⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 13522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2504 -ip 25041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2504-1-0x0000000002E80000-0x0000000002F80000-memory.dmpFilesize
1024KB
-
memory/2504-2-0x0000000002E10000-0x0000000002E4C000-memory.dmpFilesize
240KB
-
memory/2504-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2504-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2504-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB