Analysis
-
max time kernel
133s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 18:34
Static task
static1
Behavioral task
behavioral1
Sample
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
Resource
win7-20240508-en
General
-
Target
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe
-
Size
291KB
-
MD5
626ea419b77ac93450f54c5214bca2d9
-
SHA1
b2b29599042ef12d15fff5b9f64c2a3511bdee8d
-
SHA256
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97
-
SHA512
dfc0ac10237b11e11f3bbfe1f45730e3cb5e20d3a473d3aaf098ea19650cfdade305177eb8fd5a4005d1e375d40c028b058abf8900209ebbc320445aaf8963c8
-
SSDEEP
6144:jdZ7DxHFJcxg2uBN/ctTIoAneoFKgmuzTYnT:ZxxXcxTuD/cye0KgpU
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1476 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 2204 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 3152 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4544 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1964 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4492 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 1952 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4788 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 3512 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 4044 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe 5080 3436 WerFault.exe 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1664 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1664 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.execmd.exedescription pid process target process PID 3436 wrote to memory of 2128 3436 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 3436 wrote to memory of 2128 3436 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 3436 wrote to memory of 2128 3436 0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe cmd.exe PID 2128 wrote to memory of 1664 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1664 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1664 2128 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 4802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 7482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 8442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 9002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 13722⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0c0466079a6fe0f7f5e07b68da7e47269eab4f48f406241b660c8ea26ac92c97.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 13842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3436 -ip 34361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3436 -ip 34361⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3436-1-0x0000000002D00000-0x0000000002E00000-memory.dmpFilesize
1024KB
-
memory/3436-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3436-2-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/3436-7-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3436-6-0x0000000000400000-0x0000000002CA7000-memory.dmpFilesize
40.7MB