Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 22:55
Static task
static1
Behavioral task
behavioral1
Sample
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe
Resource
win10v2004-20240226-en
General
-
Target
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe
-
Size
275KB
-
MD5
b8affe7ee3200536b86ef7ca42777779
-
SHA1
2a6131a362a0fd88093487a40415e9467cc3352f
-
SHA256
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c
-
SHA512
b74c3d7f28c6092312960f0857abe68af089f5d678d3a6ed2cb7d6c74a7b6c362dbf89961d745041405e0d73b66bd80e17b71184f205bb60d01507d9c7c5169c
-
SSDEEP
6144:RPSV1TCZg3UX5qkYJYwyaK/3NKGZ/q+yoy9MvC:M/SgEXApYwyaK1MF9Ma
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3312 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 3872 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 4744 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 4740 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 3624 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 968 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 4412 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 4440 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 1948 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe 3008 2624 WerFault.exe 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1288 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1288 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.execmd.exedescription pid process target process PID 2624 wrote to memory of 2256 2624 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe cmd.exe PID 2624 wrote to memory of 2256 2624 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe cmd.exe PID 2624 wrote to memory of 2256 2624 624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe cmd.exe PID 2256 wrote to memory of 1288 2256 cmd.exe taskkill.exe PID 2256 wrote to memory of 1288 2256 cmd.exe taskkill.exe PID 2256 wrote to memory of 1288 2256 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe"C:\Users\Admin\AppData\Local\Temp\624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 9602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 14602⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "624d909e07e22de49fbab256ed70dd82892f38aea3f62d80783a4a0d6bda2a6c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 15202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2624 -ip 26241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2624-1-0x0000000002E90000-0x0000000002F90000-memory.dmpFilesize
1024KB
-
memory/2624-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/2624-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2624-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2624-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB