Analysis
-
max time kernel
106s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-05-2024 20:55
Static task
static1
Behavioral task
behavioral1
Sample
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe
Resource
win10v2004-20240426-en
General
-
Target
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe
-
Size
293KB
-
MD5
574c0c09bd0a413ef51886f38bbc3db1
-
SHA1
fdd54adac7fa66850c788e8f9ca02efd51a5cacc
-
SHA256
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa
-
SHA512
b044bf640d02e5b17780a47b87f034319ba03dd4bd9ead8168c723118d42ae3fe239bcf23dd83d4ed6a992984159dd6eff03ffb1240712d4512db306fb66bb08
-
SSDEEP
6144:hyLAwGwTuG0EeIvqNM2pzFvieLavTPK4TOAnW5gRyQzT:0LAwdTf0Eeyqa2p5ibv7K47Qgnn
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3132 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 4228 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3220 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3376 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3492 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3540 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3572 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 4004 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 1920 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe 3548 3044 WerFault.exe 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2144 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2144 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.execmd.exedescription pid process target process PID 3044 wrote to memory of 864 3044 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe cmd.exe PID 3044 wrote to memory of 864 3044 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe cmd.exe PID 3044 wrote to memory of 864 3044 9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe cmd.exe PID 864 wrote to memory of 2144 864 cmd.exe taskkill.exe PID 864 wrote to memory of 2144 864 cmd.exe taskkill.exe PID 864 wrote to memory of 2144 864 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe"C:\Users\Admin\AppData\Local\Temp\9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 5242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 8762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 14362⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "9dcb7e4d8f8a3a231b5887066805a346ed4c88aba545cb6ed0f2136ec900eafa.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 15362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 30441⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3044-2-0x00000000049D0000-0x0000000004A0C000-memory.dmpFilesize
240KB
-
memory/3044-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3044-1-0x0000000002F30000-0x0000000003030000-memory.dmpFilesize
1024KB
-
memory/3044-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3044-6-0x0000000000400000-0x0000000002CA8000-memory.dmpFilesize
40.7MB