Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:55
Static task
static1
Behavioral task
behavioral1
Sample
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe
Resource
win10v2004-20240226-en
General
-
Target
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe
-
Size
275KB
-
MD5
b8affe7ee3200536b86ef7ca42777779
-
SHA1
2a6131a362a0fd88093487a40415e9467cc3352f
-
SHA256
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c
-
SHA512
b74c3d7f28c6092312960f0857abe68af089f5d678d3a6ed2cb7d6c74a7b6c362dbf89961d745041405e0d73b66bd80e17b71184f205bb60d01507d9c7c5169c
-
SSDEEP
6144:RPSV1TCZg3UX5qkYJYwyaK/3NKGZ/q+yoy9MvC:M/SgEXApYwyaK1MF9Ma
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 412 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 1408 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 1972 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 4276 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 2316 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 1804 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 2176 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 2352 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 2552 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 5096 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 3524 4544 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3116 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3116 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.execmd.exedescription pid process target process PID 4544 wrote to memory of 1392 4544 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe cmd.exe PID 4544 wrote to memory of 1392 4544 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe cmd.exe PID 4544 wrote to memory of 1392 4544 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe cmd.exe PID 1392 wrote to memory of 3116 1392 cmd.exe taskkill.exe PID 1392 wrote to memory of 3116 1392 cmd.exe taskkill.exe PID 1392 wrote to memory of 3116 1392 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe"C:\Users\Admin\AppData\Local\Temp\624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 4442⤵
- Program crash
PID:412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 5002⤵
- Program crash
PID:1408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 7562⤵
- Program crash
PID:1972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 7602⤵
- Program crash
PID:4276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 7802⤵
- Program crash
PID:2316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 8442⤵
- Program crash
PID:1804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 9122⤵
- Program crash
PID:2176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 9202⤵
- Program crash
PID:2352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 10362⤵
- Program crash
PID:2552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 11922⤵
- Program crash
PID:5096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 13762⤵
- Program crash
PID:3524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4544 -ip 45441⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4544 -ip 45441⤵PID:2684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4544 -ip 45441⤵PID:3852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4544 -ip 45441⤵PID:3872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4544 -ip 45441⤵PID:2224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4544 -ip 45441⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4544 -ip 45441⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4544 -ip 45441⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4544 -ip 45441⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4544 -ip 45441⤵PID:884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4544 -ip 45441⤵PID:3684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4544-1-0x0000000002E40000-0x0000000002F40000-memory.dmpFilesize
1024KB
-
memory/4544-2-0x00000000049F0000-0x0000000004A2C000-memory.dmpFilesize
240KB
-
memory/4544-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4544-4-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB
-
memory/4544-9-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4544-8-0x00000000049F0000-0x0000000004A2C000-memory.dmpFilesize
240KB
-
memory/4544-7-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB