Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 11:04
Static task
static1
Behavioral task
behavioral1
Sample
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe
Resource
win10v2004-20240426-en
General
-
Target
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe
-
Size
293KB
-
MD5
ff42ed76197d373d3d99e7dd484e9102
-
SHA1
e03ae393c6b8caeb18d61b6d493d26b75a6a96f2
-
SHA256
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8
-
SHA512
e1984a1d6823779049a0478dda08306a0dead111a9fba37d40790a9628f18d3f593ad83a36535f9842356f10b35943692c72ba90a6e0f4dbc9ccc7a097033d64
-
SSDEEP
6144:qx6tjTwiPfN/TDVPMQryiamwFwoL+wg/S+u0Hd/9GYzFT:qx2Ei3N/fVPMCv2FVX29n
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 900 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 1880 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 4764 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 3976 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 3736 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 1700 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 4480 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 2548 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 1016 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe 1392 3552 WerFault.exe 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3556 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3556 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.execmd.exedescription pid process target process PID 3552 wrote to memory of 2080 3552 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe cmd.exe PID 3552 wrote to memory of 2080 3552 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe cmd.exe PID 3552 wrote to memory of 2080 3552 0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe cmd.exe PID 2080 wrote to memory of 3556 2080 cmd.exe taskkill.exe PID 2080 wrote to memory of 3556 2080 cmd.exe taskkill.exe PID 2080 wrote to memory of 3556 2080 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe"C:\Users\Admin\AppData\Local\Temp\0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 4762⤵
- Program crash
PID:900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 5362⤵
- Program crash
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 7802⤵
- Program crash
PID:4764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 8202⤵
- Program crash
PID:3976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 7962⤵
- Program crash
PID:3736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 8042⤵
- Program crash
PID:1700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 9842⤵
- Program crash
PID:4480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 10722⤵
- Program crash
PID:2548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 14562⤵
- Program crash
PID:1016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0cfb18954dfe403c91e0723700c8e5fa1e9d8c01ef977d6886a83e2c7546aad8.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 15202⤵
- Program crash
PID:1392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 35521⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3552 -ip 35521⤵PID:4452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3552 -ip 35521⤵PID:2096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3552 -ip 35521⤵PID:5044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3552 -ip 35521⤵PID:1620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3552 -ip 35521⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3552 -ip 35521⤵PID:1724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3552 -ip 35521⤵PID:4568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3552 -ip 35521⤵PID:2104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3552 -ip 35521⤵PID:3520