Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe
Resource
win10v2004-20240508-en
General
-
Target
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe
-
Size
319KB
-
MD5
d030c03304a6bc22676fd347a1136608
-
SHA1
3d5c292674729a0d379b9be91f46f7169225f54c
-
SHA256
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e
-
SHA512
13110ce8c8e54b093d9598b12362184a946abe9ef1f8405a6ee89537ad426bde0a57c6d3a0fbd46f89f2fb4e36f78bd71966fb9c867f3c1701b250700e33e307
-
SSDEEP
6144:8xO8CtmKkcVXG5vqNjNe2swUwCn2KIbk7LWT:x8Ckcc5iNP7oa
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4216 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 4904 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 3572 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 3936 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 3436 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 2964 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 1164 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 3352 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 4808 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe 2036 3624 WerFault.exe b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 472 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 472 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.execmd.exedescription pid process target process PID 3624 wrote to memory of 4960 3624 b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe cmd.exe PID 3624 wrote to memory of 4960 3624 b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe cmd.exe PID 3624 wrote to memory of 4960 3624 b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe cmd.exe PID 4960 wrote to memory of 472 4960 cmd.exe taskkill.exe PID 4960 wrote to memory of 472 4960 cmd.exe taskkill.exe PID 4960 wrote to memory of 472 4960 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe"C:\Users\Admin\AppData\Local\Temp\b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 4882⤵
- Program crash
PID:4216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 5322⤵
- Program crash
PID:4904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 7802⤵
- Program crash
PID:3572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 8002⤵
- Program crash
PID:3936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 8002⤵
- Program crash
PID:3436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 8522⤵
- Program crash
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 9842⤵
- Program crash
PID:1164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 10722⤵
- Program crash
PID:3352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 14442⤵
- Program crash
PID:4808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b48df173fd8874b9355216c970640c84fde976f8caefee23824135aff29e734e.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 13482⤵
- Program crash
PID:2036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3624 -ip 36241⤵PID:4092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3624 -ip 36241⤵PID:4060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3624 -ip 36241⤵PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3624 -ip 36241⤵PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3624 -ip 36241⤵PID:952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3624 -ip 36241⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3624 -ip 36241⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3624 -ip 36241⤵PID:4844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3624 -ip 36241⤵PID:3736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3624 -ip 36241⤵PID:1856