Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 05:13
Static task
static1
Behavioral task
behavioral1
Sample
08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe
Resource
win10v2004-20240226-en
General
-
Target
08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe
-
Size
277KB
-
MD5
39c9ac76013c43e4d824f46780853fef
-
SHA1
254741f6975cb20e98e212bb9c7b4c8c70bb9241
-
SHA256
08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098
-
SHA512
ff3ab1f1c693aa1f11f6732292225bf00a5dacf89c73d58ba44c164d7443bf106a077ca74bc3816504a3896e343097194e9bdf65b367854e8d1a3b8d99fcb852
-
SSDEEP
3072:FuzgfDO5OQCAoDeJbB+OEll5+t5an/RJarFiBmqCx6lIylW0TTudOJ/vNU4O7ufO:jfD6CbqJlAz/Ragkhx6l44aIRNxvf
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4540 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 3276 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 2280 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 2488 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 4800 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 2168 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 2904 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 1008 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 3016 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 2088 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe 3780 3116 WerFault.exe 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3456 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3456 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.execmd.exedescription pid process target process PID 3116 wrote to memory of 228 3116 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe cmd.exe PID 3116 wrote to memory of 228 3116 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe cmd.exe PID 3116 wrote to memory of 228 3116 08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe cmd.exe PID 228 wrote to memory of 3456 228 cmd.exe taskkill.exe PID 228 wrote to memory of 3456 228 cmd.exe taskkill.exe PID 228 wrote to memory of 3456 228 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe"C:\Users\Admin\AppData\Local\Temp\08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 8842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 10642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 14522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "08685f1c124422454dc52cad0d42b68109bd1c4d9c4f56ce67ed1959b4358098.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 14322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3116 -ip 31161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3116 -ip 31161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3116-2-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3116-1-0x0000000003060000-0x0000000003160000-memory.dmpFilesize
1024KB
-
memory/3116-3-0x0000000000400000-0x0000000002CA4000-memory.dmpFilesize
40.6MB
-
memory/3116-7-0x0000000000400000-0x0000000002CA4000-memory.dmpFilesize
40.6MB
-
memory/3116-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB