Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe
Resource
win10v2004-20240508-en
General
-
Target
807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe
-
Size
277KB
-
MD5
2e20ebbbccfe1fc2f110ca21bfee0738
-
SHA1
d78cff85b9fae3d2bc471a63b613ff43928f81a9
-
SHA256
807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b
-
SHA512
a996b4e65cd628e09a1f0303abcf5c4d127a254e7de414e4a7f898578f5805130b892bfdd476edd90260151a8c0459aaa6cc63442064a7406b0e21bbff6a0d8e
-
SSDEEP
6144:vL9Y+7mqLGuhtZHCmNn17mwCXz5rffBIBckv:vL9YmmqthHCQpmTx5
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2092 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 2904 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 2892 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 3396 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 3044 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 4988 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 4940 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 4112 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 3496 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 4880 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe 2108 3572 WerFault.exe 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3340 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3340 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.execmd.exedescription pid process target process PID 3572 wrote to memory of 584 3572 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe cmd.exe PID 3572 wrote to memory of 584 3572 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe cmd.exe PID 3572 wrote to memory of 584 3572 807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe cmd.exe PID 584 wrote to memory of 3340 584 cmd.exe taskkill.exe PID 584 wrote to memory of 3340 584 cmd.exe taskkill.exe PID 584 wrote to memory of 3340 584 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe"C:\Users\Admin\AppData\Local\Temp\807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 4802⤵
- Program crash
PID:2092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 5002⤵
- Program crash
PID:2904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 7802⤵
- Program crash
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 8002⤵
- Program crash
PID:3396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 8322⤵
- Program crash
PID:3044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 8762⤵
- Program crash
PID:4988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 9842⤵
- Program crash
PID:4940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 9922⤵
- Program crash
PID:4112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 9962⤵
- Program crash
PID:3496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 14442⤵
- Program crash
PID:4880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "807bcc2ed0b1eb1ae48c58dbb27b8ae95768a1139b8a0915053793603ce62c3b.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 15242⤵
- Program crash
PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3572 -ip 35721⤵PID:4936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3572 -ip 35721⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3572 -ip 35721⤵PID:3376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3572 -ip 35721⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3572 -ip 35721⤵PID:2184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3572 -ip 35721⤵PID:4844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3572 -ip 35721⤵PID:1044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3572 -ip 35721⤵PID:1616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3572 -ip 35721⤵PID:2936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3572 -ip 35721⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3572 -ip 35721⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3572-2-0x00000000049C0000-0x00000000049FC000-memory.dmpFilesize
240KB
-
memory/3572-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3572-1-0x0000000002D90000-0x0000000002E90000-memory.dmpFilesize
1024KB
-
memory/3572-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3572-6-0x0000000000400000-0x0000000002CA4000-memory.dmpFilesize
40.6MB