Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 16:11
Static task
static1
Behavioral task
behavioral1
Sample
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
Resource
win10v2004-20240508-en
General
-
Target
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
-
Size
291KB
-
MD5
626ea419b77ac93450f54c5214bca2d9
-
SHA1
b2b29599042ef12d15fff5b9f64c2a3511bdee8d
-
SHA256
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97
-
SHA512
dfc0ac10237b11e11f3bbfe1f45730e3cb5e20d3a473d3aaf098ea19650cfdade305177eb8fd5a4005d1e375d40c028b058abf8900209ebbc320445aaf8963c8
-
SSDEEP
6144:jdZ7DxHFJcxg2uBN/ctTIoAneoFKgmuzTYnT:ZxxXcxTuD/cye0KgpU
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1836 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1088 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4812 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2460 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1072 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2092 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 388 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1716 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 908 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2224 4360 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3148 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3148 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.execmd.exedescription pid process target process PID 4360 wrote to memory of 3984 4360 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 4360 wrote to memory of 3984 4360 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 4360 wrote to memory of 3984 4360 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 3984 wrote to memory of 3148 3984 cmd.exe taskkill.exe PID 3984 wrote to memory of 3148 3984 cmd.exe taskkill.exe PID 3984 wrote to memory of 3148 3984 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 4442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 9002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 9642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 13522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 12162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4360 -ip 43601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4360 -ip 43601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4360-1-0x0000000002EF0000-0x0000000002FF0000-memory.dmpFilesize
1024KB
-
memory/4360-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/4360-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4360-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4360-6-0x0000000000400000-0x0000000002CA7000-memory.dmpFilesize
40.7MB