Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:54
Static task
static1
Behavioral task
behavioral1
Sample
996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe
Resource
win10v2004-20240508-en
General
-
Target
996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe
-
Size
277KB
-
MD5
bbe847ee6b9f10a8535e96e7379c0652
-
SHA1
38792a4763b1c67204dce0e60765ab67be255a77
-
SHA256
996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63
-
SHA512
509354f785e58c0d431975ad9f5ce33e6713e41b82b7cd2b86ad3623815dc04d0ceb749ee274a8144ef83189839ec52508780f4fcc70f5f75a53854941c02bc0
-
SSDEEP
6144:fL9Y+7mqLUplHPn4m5h+HJ/Exb82WwwKEo2VH:fL9YmmqIpxPnB5hMuXWwh1
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4100 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 364 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 4548 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 4544 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 5004 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 3492 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 692 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 436 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 3936 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 4224 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe 1752 3032 WerFault.exe 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4596 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4596 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.execmd.exedescription pid process target process PID 3032 wrote to memory of 3144 3032 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe cmd.exe PID 3032 wrote to memory of 3144 3032 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe cmd.exe PID 3032 wrote to memory of 3144 3032 996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe cmd.exe PID 3144 wrote to memory of 4596 3144 cmd.exe taskkill.exe PID 3144 wrote to memory of 4596 3144 cmd.exe taskkill.exe PID 3144 wrote to memory of 4596 3144 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe"C:\Users\Admin\AppData\Local\Temp\996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 4522⤵
- Program crash
PID:4100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 4802⤵
- Program crash
PID:364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7482⤵
- Program crash
PID:4548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7682⤵
- Program crash
PID:4544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7682⤵
- Program crash
PID:5004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 8402⤵
- Program crash
PID:3492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9162⤵
- Program crash
PID:692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10082⤵
- Program crash
PID:436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10322⤵
- Program crash
PID:3936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 13562⤵
- Program crash
PID:4224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "996bf8bc73580103633f30ffd261ad1ecd711977982879a62be614f362e7ea63.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 12922⤵
- Program crash
PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3032 -ip 30321⤵PID:5036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3032 -ip 30321⤵PID:2912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3032 -ip 30321⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3032 -ip 30321⤵PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3032 -ip 30321⤵PID:1172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3032 -ip 30321⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3032 -ip 30321⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3032 -ip 30321⤵PID:4532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3032 -ip 30321⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3032 -ip 30321⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3032 -ip 30321⤵PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3032-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3032-2-0x0000000002E00000-0x0000000002E3C000-memory.dmpFilesize
240KB
-
memory/3032-1-0x0000000002F90000-0x0000000003090000-memory.dmpFilesize
1024KB
-
memory/3032-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3032-6-0x0000000000400000-0x0000000002CA4000-memory.dmpFilesize
40.6MB