Analysis
-
max time kernel
90s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 19:27
Static task
static1
Behavioral task
behavioral1
Sample
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe
Resource
win10v2004-20240508-en
General
-
Target
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe
-
Size
276KB
-
MD5
80acdc4d806fef203351f575f9eb4aef
-
SHA1
1f3238a7c1f6c0b9ba56e412524ffae4e5bc654e
-
SHA256
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9
-
SHA512
edd7f3d1ce29b12683176bd19b51abdc801f4948addfd7c6e8edd79885598f60787847eeefa8fb88204c970d1df809310ffc9541f36d29a674b49bd31db3828b
-
SSDEEP
6144:FnMA6ZC03GtLo8GNBkQVozODm0Fth045oS:eAAC03GpXslozOKC7Bv
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3104 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2924 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 4392 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 5052 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 4716 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 836 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 1540 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2932 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2204 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2340 4980 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 488 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 488 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.execmd.exedescription pid process target process PID 4980 wrote to memory of 3420 4980 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe cmd.exe PID 4980 wrote to memory of 3420 4980 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe cmd.exe PID 4980 wrote to memory of 3420 4980 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe cmd.exe PID 3420 wrote to memory of 488 3420 cmd.exe taskkill.exe PID 3420 wrote to memory of 488 3420 cmd.exe taskkill.exe PID 3420 wrote to memory of 488 3420 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe"C:\Users\Admin\AppData\Local\Temp\083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 4762⤵
- Program crash
PID:3104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 5202⤵
- Program crash
PID:2924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 7802⤵
- Program crash
PID:4392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 8002⤵
- Program crash
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 8362⤵
- Program crash
PID:4716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 8442⤵
- Program crash
PID:836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 9842⤵
- Program crash
PID:1540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 10682⤵
- Program crash
PID:2932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 14362⤵
- Program crash
PID:2204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 14802⤵
- Program crash
PID:2340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 49801⤵PID:2336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4980 -ip 49801⤵PID:4016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4980 -ip 49801⤵PID:3544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4980 -ip 49801⤵PID:2420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4980 -ip 49801⤵PID:1028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4980 -ip 49801⤵PID:708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4980 -ip 49801⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4980 -ip 49801⤵PID:2380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4980 -ip 49801⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4980 -ip 49801⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4980-1-0x0000000002DF0000-0x0000000002EF0000-memory.dmpFilesize
1024KB
-
memory/4980-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/4980-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4980-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4980-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB