Analysis
-
max time kernel
133s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 04:53
Static task
static1
Behavioral task
behavioral1
Sample
fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe
Resource
win10v2004-20240508-en
General
-
Target
fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe
-
Size
356KB
-
MD5
f09c488bfeff422f0acc8db51c7b590d
-
SHA1
657e239e1f833936621e9dfd825cb31137112fc6
-
SHA256
fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f
-
SHA512
b3bb99e399f6a5b293d955a2237cf9ffdc7d2ab02754813cce3b6478e6620968330319b4c531cc4325e01d1696950406473ca7178d8116e749d8ac6fcd1e62fa
-
SSDEEP
6144:TrT21hhM/SHN+L9nDUJ9VVsiG+N3GoA2Hbv+C:TrKZSQTPsz+N
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2856 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 2156 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 2284 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 1620 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 384 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 4700 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 3956 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 5056 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 1864 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe 4436 2960 WerFault.exe fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3724 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3724 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.execmd.exedescription pid process target process PID 2960 wrote to memory of 1916 2960 fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe cmd.exe PID 2960 wrote to memory of 1916 2960 fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe cmd.exe PID 2960 wrote to memory of 1916 2960 fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe cmd.exe PID 1916 wrote to memory of 3724 1916 cmd.exe taskkill.exe PID 1916 wrote to memory of 3724 1916 cmd.exe taskkill.exe PID 1916 wrote to memory of 3724 1916 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe"C:\Users\Admin\AppData\Local\Temp\fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 4482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 9322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 10202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 10522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 10442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "fc3bfda544affa06f4dcb553fd2cd4f54d359b57cfdfd7ddeccd30a9757b896f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 13882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2960 -ip 29601⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3468,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2960-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2960-2-0x0000000002100000-0x000000000213C000-memory.dmpFilesize
240KB
-
memory/2960-1-0x00000000022B0000-0x00000000023B0000-memory.dmpFilesize
1024KB
-
memory/2960-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2960-6-0x0000000000400000-0x0000000001FA4000-memory.dmpFilesize
27.6MB