Analysis
-
max time kernel
133s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 11:04
Static task
static1
Behavioral task
behavioral1
Sample
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe
Resource
win10v2004-20240426-en
General
-
Target
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe
-
Size
293KB
-
MD5
ff42ed76197d373d3d99e7dd484e9102
-
SHA1
e03ae393c6b8caeb18d61b6d493d26b75a6a96f2
-
SHA256
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8
-
SHA512
e1984a1d6823779049a0478dda08306a0dead111a9fba37d40790a9628f18d3f593ad83a36535f9842356f10b35943692c72ba90a6e0f4dbc9ccc7a097033d64
-
SSDEEP
6144:qx6tjTwiPfN/TDVPMQryiamwFwoL+wg/S+u0Hd/9GYzFT:qx2Ei3N/fVPMCv2FVX29n
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1568 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 4552 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 3276 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 5020 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 3264 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 460 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 4516 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 1712 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 4928 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 4584 656 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3136 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3136 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.execmd.exedescription pid process target process PID 656 wrote to memory of 3124 656 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe cmd.exe PID 656 wrote to memory of 3124 656 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe cmd.exe PID 656 wrote to memory of 3124 656 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe cmd.exe PID 3124 wrote to memory of 3136 3124 cmd.exe taskkill.exe PID 3124 wrote to memory of 3136 3124 cmd.exe taskkill.exe PID 3124 wrote to memory of 3136 3124 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe"C:\Users\Admin\AppData\Local\Temp\0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 4522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 7882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 10082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 13562⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 12962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 656 -ip 6561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/656-2-0x0000000002E30000-0x0000000002E6C000-memory.dmpFilesize
240KB
-
memory/656-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/656-1-0x0000000002D30000-0x0000000002E30000-memory.dmpFilesize
1024KB
-
memory/656-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/656-6-0x0000000000400000-0x0000000002CA9000-memory.dmpFilesize
40.7MB