Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 15:34
Static task
static1
Behavioral task
behavioral1
Sample
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe
Resource
win10v2004-20240508-en
General
-
Target
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe
-
Size
275KB
-
MD5
384651495c8919b75a6c25482f1ea43f
-
SHA1
d9cdebb9ceb4ed73c14f4cfba4f2e034f351fd2e
-
SHA256
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04
-
SHA512
ffe0e414b3cca1d35405f9aa7bfe50e0145a1d5b490aba39d18f602b2bc063be160b2927325c486a7c2e031c4875561a69cc6f12e4b899afc63fe0eb66468d43
-
SSDEEP
6144:oJzN04wtrYIvpPomtCNb0U61tjzcLPVjM2wtlz:EN07trYmHUx56PjzcLd42wz
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5104 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 3536 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 1340 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 3240 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 3952 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 4036 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 2608 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 2188 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 4856 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe 3568 4664 WerFault.exe e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3452 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3452 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.execmd.exedescription pid process target process PID 4664 wrote to memory of 2300 4664 e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe cmd.exe PID 4664 wrote to memory of 2300 4664 e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe cmd.exe PID 4664 wrote to memory of 2300 4664 e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe cmd.exe PID 2300 wrote to memory of 3452 2300 cmd.exe taskkill.exe PID 2300 wrote to memory of 3452 2300 cmd.exe taskkill.exe PID 2300 wrote to memory of 3452 2300 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe"C:\Users\Admin\AppData\Local\Temp\e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 4882⤵
- Program crash
PID:5104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 3682⤵
- Program crash
PID:3536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 7802⤵
- Program crash
PID:1340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 8002⤵
- Program crash
PID:3240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 8002⤵
- Program crash
PID:3952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 7802⤵
- Program crash
PID:4036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 9842⤵
- Program crash
PID:2608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 10882⤵
- Program crash
PID:2188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 14362⤵
- Program crash
PID:4856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e2bc38359ff9556921e3d8be0c073eee5bd1fc26d326e860c038f15f5a53dc04.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 14442⤵
- Program crash
PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4664 -ip 46641⤵PID:3876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4664 -ip 46641⤵PID:2972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4664 -ip 46641⤵PID:1088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4664 -ip 46641⤵PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4664 -ip 46641⤵PID:2560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4664 -ip 46641⤵PID:1420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4664 -ip 46641⤵PID:1160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4664 -ip 46641⤵PID:3164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4664 -ip 46641⤵PID:4964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4664 -ip 46641⤵PID:1220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4664-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4664-1-0x0000000002FE0000-0x00000000030E0000-memory.dmpFilesize
1024KB
-
memory/4664-2-0x00000000049C0000-0x00000000049FC000-memory.dmpFilesize
240KB
-
memory/4664-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4664-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB