Analysis
-
max time kernel
92s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe
Resource
win10v2004-20240426-en
General
-
Target
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe
-
Size
290KB
-
MD5
127b9dedf0a978839deff3307314c996
-
SHA1
68ea574617a497c1a13145c05db055be694a915b
-
SHA256
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d
-
SHA512
7c3a83708309bcde01e53a5faeed39e310854a6ddaa5859a5e531b5c6baed801f37b34a960ec73906d3c619c3e46f2b1ef6664092b263f02add30430868dd5e4
-
SSDEEP
6144:RpgLdxBq9JnFp41VH3Lmb2ixf3UFSfBBUy6JFvT:yroJF21N3qb2il3UFa6yK
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4080 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 412 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 3040 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 912 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 4948 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 4844 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 1544 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 2064 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 576 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe 2012 1884 WerFault.exe f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4264 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4264 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.execmd.exedescription pid process target process PID 1884 wrote to memory of 1980 1884 f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe cmd.exe PID 1884 wrote to memory of 1980 1884 f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe cmd.exe PID 1884 wrote to memory of 1980 1884 f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe cmd.exe PID 1980 wrote to memory of 4264 1980 cmd.exe taskkill.exe PID 1980 wrote to memory of 4264 1980 cmd.exe taskkill.exe PID 1980 wrote to memory of 4264 1980 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe"C:\Users\Admin\AppData\Local\Temp\f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 8122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 8762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 10762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 14082⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f061dce9b1a5f681bad8220c9e4e67d068193f19929cab86d7925c2d9d06110d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 15442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1884 -ip 18841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1884 -ip 18841⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-1-0x0000000002D50000-0x0000000002E50000-memory.dmpFilesize
1024KB
-
memory/1884-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1884-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/1884-8-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/1884-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1884-6-0x0000000000400000-0x0000000002CA7000-memory.dmpFilesize
40.7MB