Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 21:36
Static task
static1
Behavioral task
behavioral1
Sample
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe
Resource
win10v2004-20240508-en
General
-
Target
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe
-
Size
318KB
-
MD5
33f6a5e47a1eacb2b1a25b258a0a7207
-
SHA1
48dc24b4f9745dc7a6a71871569b02b972d4dd24
-
SHA256
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0
-
SHA512
331e401987a85c01ab60976a30f4a54166c968b65e245eca32c7a4f2921b31b855bd7c6e860194e50e3801b4fba9c77ce7dcf0776cdf1390f947afe75b87df39
-
SSDEEP
6144:TxnxMQQs5PAI//dNUuuQrPDqTUrXXxgf497LWT:Jxys5P+uBPDqTqHta
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2392 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 1180 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 4508 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 4740 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 1888 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 4008 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 5092 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 1252 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 3704 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe 1996 3272 WerFault.exe b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3736 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3736 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.execmd.exedescription pid process target process PID 3272 wrote to memory of 2572 3272 b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe cmd.exe PID 3272 wrote to memory of 2572 3272 b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe cmd.exe PID 3272 wrote to memory of 2572 3272 b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe cmd.exe PID 2572 wrote to memory of 3736 2572 cmd.exe taskkill.exe PID 2572 wrote to memory of 3736 2572 cmd.exe taskkill.exe PID 2572 wrote to memory of 3736 2572 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe"C:\Users\Admin\AppData\Local\Temp\b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 8002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 8322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 8642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 10682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 14442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b78bd30ade81b7b09db93b23417d2c4bc826b8c79a185c6b721f3bc287a653c0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 13482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3272 -ip 32721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3272 -ip 32721⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3272-1-0x0000000002FD0000-0x00000000030D0000-memory.dmpFilesize
1024KB
-
memory/3272-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3272-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/3272-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3272-6-0x0000000000400000-0x0000000002CAD000-memory.dmpFilesize
40.7MB