Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 16:11
Static task
static1
Behavioral task
behavioral1
Sample
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
Resource
win10v2004-20240508-en
General
-
Target
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
-
Size
291KB
-
MD5
626ea419b77ac93450f54c5214bca2d9
-
SHA1
b2b29599042ef12d15fff5b9f64c2a3511bdee8d
-
SHA256
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97
-
SHA512
dfc0ac10237b11e11f3bbfe1f45730e3cb5e20d3a473d3aaf098ea19650cfdade305177eb8fd5a4005d1e375d40c028b058abf8900209ebbc320445aaf8963c8
-
SSDEEP
6144:jdZ7DxHFJcxg2uBN/ctTIoAneoFKgmuzTYnT:ZxxXcxTuD/cye0KgpU
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4016 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1704 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2560 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4636 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1920 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2356 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4548 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2056 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4764 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1480 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 644 4768 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4816 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4816 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.execmd.exedescription pid process target process PID 4768 wrote to memory of 2292 4768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 4768 wrote to memory of 2292 4768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 4768 wrote to memory of 2292 4768 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 2292 wrote to memory of 4816 2292 cmd.exe taskkill.exe PID 2292 wrote to memory of 4816 2292 cmd.exe taskkill.exe PID 2292 wrote to memory of 4816 2292 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 5362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 8282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 9682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 14562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4768 -ip 47681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4768 -ip 47681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4768-1-0x0000000002FD0000-0x00000000030D0000-memory.dmpFilesize
1024KB
-
memory/4768-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/4768-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4768-7-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/4768-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4768-6-0x0000000000400000-0x0000000002CA7000-memory.dmpFilesize
40.7MB