Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 06:46
Static task
static1
Behavioral task
behavioral1
Sample
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe
Resource
win10v2004-20240426-en
General
-
Target
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe
-
Size
292KB
-
MD5
833015bd47fd3060d76975e158938b89
-
SHA1
9ca3f4dbb53be92a039504de28b57e990214ccf6
-
SHA256
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855
-
SHA512
f496d119a6b12adfd9432a1de89b95ce7c1a356b3a730967259d626e0a435b16cf5eb695a71d07818d15b165e2d562e6beddc1f2a6a286a7ff4bba738f0db8f2
-
SSDEEP
6144:bvsuT8+2J/VBz7FpAhfMzdJwkyfMUNIAWmjTFT:bvsW8+2TB3FUfMZly00jN1
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4720 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 1532 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4624 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4068 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 3188 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4376 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 3672 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 3460 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 4008 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe 2628 3716 WerFault.exe 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4544 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4544 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.execmd.exedescription pid process target process PID 3716 wrote to memory of 2800 3716 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe cmd.exe PID 3716 wrote to memory of 2800 3716 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe cmd.exe PID 3716 wrote to memory of 2800 3716 579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe cmd.exe PID 2800 wrote to memory of 4544 2800 cmd.exe taskkill.exe PID 2800 wrote to memory of 4544 2800 cmd.exe taskkill.exe PID 2800 wrote to memory of 4544 2800 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe"C:\Users\Admin\AppData\Local\Temp\579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 5202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 8442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 14442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "579fa51e50f384f37687b0d4a6b456f33b7e5bdc4170f026db691e3adb8d8855.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 14602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3716 -ip 37161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3716-2-0x00000000049D0000-0x0000000004A0C000-memory.dmpFilesize
240KB
-
memory/3716-1-0x0000000002F30000-0x0000000003030000-memory.dmpFilesize
1024KB
-
memory/3716-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3716-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3716-7-0x00000000049D0000-0x0000000004A0C000-memory.dmpFilesize
240KB
-
memory/3716-6-0x0000000000400000-0x0000000002CA8000-memory.dmpFilesize
40.7MB