Analysis
-
max time kernel
92s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 21:36
Static task
static1
Behavioral task
behavioral1
Sample
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe
Resource
win10v2004-20240508-en
General
-
Target
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe
-
Size
318KB
-
MD5
33f6a5e47a1eacb2b1a25b258a0a7207
-
SHA1
48dc24b4f9745dc7a6a71871569b02b972d4dd24
-
SHA256
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0
-
SHA512
331e401987a85c01ab60976a30f4a54166c968b65e245eca32c7a4f2921b31b855bd7c6e860194e50e3801b4fba9c77ce7dcf0776cdf1390f947afe75b87df39
-
SSDEEP
6144:TxnxMQQs5PAI//dNUuuQrPDqTUrXXxgf497LWT:Jxys5P+uBPDqTqHta
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4672 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 4128 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 4820 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 1904 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 1900 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 3040 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 2848 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 492 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 3168 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 2060 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 4368 1304 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1468 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1468 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.execmd.exedescription pid process target process PID 1304 wrote to memory of 4524 1304 b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe cmd.exe PID 1304 wrote to memory of 4524 1304 b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe cmd.exe PID 1304 wrote to memory of 4524 1304 b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe cmd.exe PID 4524 wrote to memory of 1468 4524 cmd.exe taskkill.exe PID 4524 wrote to memory of 1468 4524 cmd.exe taskkill.exe PID 4524 wrote to memory of 1468 4524 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe"C:\Users\Admin\AppData\Local\Temp\b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 4962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 4642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 4642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 7762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 11242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 13442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 13722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1304 -ip 13041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-1-0x0000000002CE0000-0x0000000002DE0000-memory.dmpFilesize
1024KB
-
memory/1304-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/1304-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1304-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1304-6-0x0000000000400000-0x0000000002CAD000-memory.dmpFilesize
40.7MB