Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 08:27
Static task
static1
Behavioral task
behavioral1
Sample
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe
Resource
win10v2004-20240426-en
General
-
Target
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe
-
Size
292KB
-
MD5
583d46cf0de48deb8edbebb0f8ca9f2c
-
SHA1
805772046eb1bdfb6de597d54ae7c1a87d727b8e
-
SHA256
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd
-
SHA512
c2432c73196030af0332c09c688e23da9664dbcf788f17a2defd08bd731591ce2adfb1f1c652b87a003be77ee951851ecd9a8d660b8c1adc905eb4f999089e05
-
SSDEEP
6144:zKUFfHXsi/uG6/yAAkZVNsGhtLew2DD6JYiNYzcT:zKOPcip6/yAJVO0r2DDUH
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4340 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 3792 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 2272 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 2964 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 1804 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 1576 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 2092 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 3992 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 1552 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe 5108 904 WerFault.exe b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4496 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4496 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.execmd.exedescription pid process target process PID 904 wrote to memory of 2148 904 b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe cmd.exe PID 904 wrote to memory of 2148 904 b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe cmd.exe PID 904 wrote to memory of 2148 904 b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe cmd.exe PID 2148 wrote to memory of 4496 2148 cmd.exe taskkill.exe PID 2148 wrote to memory of 4496 2148 cmd.exe taskkill.exe PID 2148 wrote to memory of 4496 2148 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe"C:\Users\Admin\AppData\Local\Temp\b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 5322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 8282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 8282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 8802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 9842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 9922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 14442⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b136aa92ce09fd40d8df8e1482b60653f1aa181b82c613bbab68785d6d7de7dd.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 15162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 904 -ip 9041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-1-0x0000000002E80000-0x0000000002F80000-memory.dmpFilesize
1024KB
-
memory/904-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/904-2-0x00000000049B0000-0x00000000049EC000-memory.dmpFilesize
240KB
-
memory/904-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/904-6-0x0000000000400000-0x0000000002CA8000-memory.dmpFilesize
40.7MB