Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 10:06
Static task
static1
Behavioral task
behavioral1
Sample
77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe
Resource
win10v2004-20240508-en
General
-
Target
77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe
-
Size
277KB
-
MD5
9bad4b2e33b5f46cd55e649f44f27e90
-
SHA1
6cfe6ef810f28a4e562e9e36e53fe1dec1dde4e3
-
SHA256
77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388
-
SHA512
251c75fa82aff8902bf52581164a16cb9b9efaf2902eecca7a5b81b7d8d21560594b6e2c0bc272ef72d4a0b4b1bda069fb463dd1d7eaabd5704fa005d4682c89
-
SSDEEP
6144:xDh9q1Lk0EIqdME2iDpDNSbIEzHyd3hYPOw:xDh92Lk0t1ZQ0JbYw
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4932 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 2604 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 5028 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 1548 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 2092 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 1972 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 5036 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 388 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 1500 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe 1328 4948 WerFault.exe 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3564 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3564 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.execmd.exedescription pid process target process PID 4948 wrote to memory of 860 4948 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe cmd.exe PID 4948 wrote to memory of 860 4948 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe cmd.exe PID 4948 wrote to memory of 860 4948 77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe cmd.exe PID 860 wrote to memory of 3564 860 cmd.exe taskkill.exe PID 860 wrote to memory of 3564 860 cmd.exe taskkill.exe PID 860 wrote to memory of 3564 860 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe"C:\Users\Admin\AppData\Local\Temp\77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 4762⤵
- Program crash
PID:4932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 5002⤵
- Program crash
PID:2604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 7802⤵
- Program crash
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 8122⤵
- Program crash
PID:1548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 8322⤵
- Program crash
PID:2092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 8722⤵
- Program crash
PID:1972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 9842⤵
- Program crash
PID:5036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 10682⤵
- Program crash
PID:388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 14362⤵
- Program crash
PID:1500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "77f5514a159e816442793a82897ef2e64a6fc4199fc8cc4d535494c1b9cad388.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 12162⤵
- Program crash
PID:1328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4948 -ip 49481⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4948 -ip 49481⤵PID:652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4948 -ip 49481⤵PID:3236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4948 -ip 49481⤵PID:2284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4948 -ip 49481⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4948 -ip 49481⤵PID:2172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4948 -ip 49481⤵PID:2612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4948 -ip 49481⤵PID:3100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4948 -ip 49481⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4948 -ip 49481⤵PID:3552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4948-1-0x0000000003000000-0x0000000003100000-memory.dmpFilesize
1024KB
-
memory/4948-2-0x00000000049E0000-0x0000000004A1C000-memory.dmpFilesize
240KB
-
memory/4948-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4948-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4948-6-0x0000000000400000-0x0000000002CA4000-memory.dmpFilesize
40.6MB