Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 22:44
Static task
static1
Behavioral task
behavioral1
Sample
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe
Resource
win10v2004-20240426-en
General
-
Target
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe
-
Size
275KB
-
MD5
3021048d6200956eed8425f8d13ed458
-
SHA1
eb5a332a726af47e67c641e7526082c553f71c03
-
SHA256
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a
-
SHA512
1f73cc7fea66ea131b267532a3b84ea46c34715910f12d6539434381935ad346cc625f25af0bc1cb0df65e26f08a98aa5af724b48dd661d6d38464525690bb0c
-
SSDEEP
6144:hfT+vt6FqlKk4VnP+1wAsieXkqOoRuJRqK40g:550z4VnP4sLX9tRb0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1136 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 844 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 2388 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 2004 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 580 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 1236 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 3004 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 4400 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 4340 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe 952 128 WerFault.exe 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2480 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2480 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.execmd.exedescription pid process target process PID 128 wrote to memory of 5000 128 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe cmd.exe PID 128 wrote to memory of 5000 128 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe cmd.exe PID 128 wrote to memory of 5000 128 2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe cmd.exe PID 5000 wrote to memory of 2480 5000 cmd.exe taskkill.exe PID 5000 wrote to memory of 2480 5000 cmd.exe taskkill.exe PID 5000 wrote to memory of 2480 5000 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe"C:\Users\Admin\AppData\Local\Temp\2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 4762⤵
- Program crash
PID:1136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 5002⤵
- Program crash
PID:844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 7802⤵
- Program crash
PID:2388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 8002⤵
- Program crash
PID:2004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 8402⤵
- Program crash
PID:580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 7802⤵
- Program crash
PID:1236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 9602⤵
- Program crash
PID:3004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 10682⤵
- Program crash
PID:4400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 14282⤵
- Program crash
PID:4340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2279263815df6659e59e028a5f1db6285dfe38291241d695538578ef634b497a.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 128 -s 13882⤵
- Program crash
PID:952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 128 -ip 1281⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 128 -ip 1281⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 128 -ip 1281⤵PID:3428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 128 -ip 1281⤵PID:904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 128 -ip 1281⤵PID:3316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 128 -ip 1281⤵PID:3584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 128 -ip 1281⤵PID:2620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 128 -ip 1281⤵PID:4688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 128 -ip 1281⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 128 -ip 1281⤵PID:468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/128-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/128-2-0x00000000049E0000-0x0000000004A1C000-memory.dmpFilesize
240KB
-
memory/128-1-0x0000000003040000-0x0000000003140000-memory.dmpFilesize
1024KB
-
memory/128-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/128-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB