Analysis
-
max time kernel
133s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:49
Static task
static1
Behavioral task
behavioral1
Sample
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe
Resource
win7-20240220-en
General
-
Target
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe
-
Size
276KB
-
MD5
80acdc4d806fef203351f575f9eb4aef
-
SHA1
1f3238a7c1f6c0b9ba56e412524ffae4e5bc654e
-
SHA256
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9
-
SHA512
edd7f3d1ce29b12683176bd19b51abdc801f4948addfd7c6e8edd79885598f60787847eeefa8fb88204c970d1df809310ffc9541f36d29a674b49bd31db3828b
-
SSDEEP
6144:FnMA6ZC03GtLo8GNBkQVozODm0Fth045oS:eAAC03GpXslozOKC7Bv
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 848 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2928 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 4500 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2256 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 1076 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2640 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2308 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 2356 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 1288 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 3032 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe 1932 4688 WerFault.exe 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1528 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1528 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.execmd.exedescription pid process target process PID 4688 wrote to memory of 3212 4688 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe cmd.exe PID 4688 wrote to memory of 3212 4688 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe cmd.exe PID 4688 wrote to memory of 3212 4688 083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe cmd.exe PID 3212 wrote to memory of 1528 3212 cmd.exe taskkill.exe PID 3212 wrote to memory of 1528 3212 cmd.exe taskkill.exe PID 3212 wrote to memory of 1528 3212 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe"C:\Users\Admin\AppData\Local\Temp\083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 4442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 4722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 7682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 8322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 8962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 11002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 13562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "083fff395834e2dbf57b83325317c78670b87480c778c1b895b0df41cc9b04b9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 14722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4688 -ip 46881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4688-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4688-2-0x00000000048E0000-0x000000000491C000-memory.dmpFilesize
240KB
-
memory/4688-1-0x0000000002E40000-0x0000000002F40000-memory.dmpFilesize
1024KB
-
memory/4688-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4688-6-0x0000000000400000-0x0000000002CA3000-memory.dmpFilesize
40.6MB