Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 22:26
Static task
static1
Behavioral task
behavioral1
Sample
81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe
Resource
win10v2004-20240226-en
General
-
Target
81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe
-
Size
317KB
-
MD5
300ac88cb620c7f146cd5f8304512f8e
-
SHA1
443e0dc509a77c933fa066fc3d490800416c035c
-
SHA256
81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4
-
SHA512
8dd90d5a7161cdae6414b8eda964228711d65d3fd45abbf3226ffeed8bfcfaa74b63d0281f8970606d0770e7c5dac66a90f0f838185a6cdcef262b1148ce9911
-
SSDEEP
6144:dxTINo/Suhyu3XRAgLhXVfR5ODBFKB11IOet7LWT:nIOSuhyuaehX6F81ya
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3040 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 4060 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 3144 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 1688 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 4920 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 4848 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 2016 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 4064 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 892 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 1656 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe 2208 1580 WerFault.exe 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 904 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 904 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.execmd.exedescription pid process target process PID 1580 wrote to memory of 5024 1580 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe cmd.exe PID 1580 wrote to memory of 5024 1580 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe cmd.exe PID 1580 wrote to memory of 5024 1580 81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe cmd.exe PID 5024 wrote to memory of 904 5024 cmd.exe taskkill.exe PID 5024 wrote to memory of 904 5024 cmd.exe taskkill.exe PID 5024 wrote to memory of 904 5024 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe"C:\Users\Admin\AppData\Local\Temp\81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 4802⤵
- Program crash
PID:3040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 4842⤵
- Program crash
PID:4060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 7802⤵
- Program crash
PID:3144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 8002⤵
- Program crash
PID:1688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 8362⤵
- Program crash
PID:4920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 8642⤵
- Program crash
PID:4848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 9842⤵
- Program crash
PID:2016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 9922⤵
- Program crash
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 14282⤵
- Program crash
PID:892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 16722⤵
- Program crash
PID:1656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "81e3dea24b09a6ac3a24620402dc6bbcbf23d01faa45e05443ce4c47a05e60c4.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 15842⤵
- Program crash
PID:2208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1580 -ip 15801⤵PID:4164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1580 -ip 15801⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1580 -ip 15801⤵PID:3488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1580 -ip 15801⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1580 -ip 15801⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1580 -ip 15801⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1580 -ip 15801⤵PID:4812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1580 -ip 15801⤵PID:2376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1580 -ip 15801⤵PID:2728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1580 -ip 15801⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1580 -ip 15801⤵PID:784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99