Analysis
-
max time kernel
91s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 08:31
Static task
static1
Behavioral task
behavioral1
Sample
0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe
Resource
win10v2004-20240426-en
General
-
Target
0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe
-
Size
277KB
-
MD5
3d9ef58f05865e16523d602fff554150
-
SHA1
b91bf9a4431244f58b0330948d2b1e20d9d48fcc
-
SHA256
0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f
-
SHA512
e83b079f04e26b2bf472d4ec60c91fe79d88c1cb6b3917d00ac637da4166f1f873d9c756af06091f8763126c725aff0381bf32cded963b2708e6a3e17eeef273
-
SSDEEP
6144:FfR4IMSWntJKlIxeZVaP8V046bbQBaLUaneanr:FfKINWntAlIxoX0QBaLdP
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1964 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 4232 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 1052 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 4584 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 3952 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 1728 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 4604 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 2460 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 2056 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe 2856 4624 WerFault.exe 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5076 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 5076 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.execmd.exedescription pid process target process PID 4624 wrote to memory of 4052 4624 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe cmd.exe PID 4624 wrote to memory of 4052 4624 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe cmd.exe PID 4624 wrote to memory of 4052 4624 0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe cmd.exe PID 4052 wrote to memory of 5076 4052 cmd.exe taskkill.exe PID 4052 wrote to memory of 5076 4052 cmd.exe taskkill.exe PID 4052 wrote to memory of 5076 4052 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe"C:\Users\Admin\AppData\Local\Temp\0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 10922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 14442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0e5abe6cdcce822b50207acec0b5b1e30f30c82e3b7d3d63589900a5a95e5c0f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 13682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4624 -ip 46241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4624-1-0x0000000003070000-0x0000000003170000-memory.dmpFilesize
1024KB
-
memory/4624-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4624-2-0x0000000003010000-0x000000000304C000-memory.dmpFilesize
240KB
-
memory/4624-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4624-6-0x0000000000400000-0x0000000002CA4000-memory.dmpFilesize
40.6MB