Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 19:14
Static task
static1
Behavioral task
behavioral1
Sample
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe
Resource
win10v2004-20240508-en
General
-
Target
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe
-
Size
319KB
-
MD5
45298f591b293c7f4f1758856a2f492c
-
SHA1
5e0ba92446537b72eed4aef522bfb22e2ba6fbf5
-
SHA256
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b
-
SHA512
a534b17db5c016c4414c41629ab3cd0d3478b5e154e8439d93dd3b57cf5d1250f1ce6fdf2a5937ac0a2b2f3ba311b649f66bd6febba6f78dc7f7ff55a8b5cffa
-
SSDEEP
6144:9xusY2c2YKiRVL+fP4aK0CW743OZ7LWT:6s82MRFRajCW7Eoa
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4912 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 424 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 4328 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 2888 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3236 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 1872 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 3220 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 932 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 4456 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe 836 3516 WerFault.exe e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1028 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1028 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.execmd.exedescription pid process target process PID 3516 wrote to memory of 1476 3516 e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe cmd.exe PID 3516 wrote to memory of 1476 3516 e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe cmd.exe PID 3516 wrote to memory of 1476 3516 e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe cmd.exe PID 1476 wrote to memory of 1028 1476 cmd.exe taskkill.exe PID 1476 wrote to memory of 1028 1476 cmd.exe taskkill.exe PID 1476 wrote to memory of 1028 1476 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe"C:\Users\Admin\AppData\Local\Temp\e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 4682⤵
- Program crash
PID:4912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 5202⤵
- Program crash
PID:424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 7802⤵
- Program crash
PID:4328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 8202⤵
- Program crash
PID:2888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 8602⤵
- Program crash
PID:3236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 8202⤵
- Program crash
PID:1872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 9842⤵
- Program crash
PID:3220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 10682⤵
- Program crash
PID:932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 14522⤵
- Program crash
PID:4456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e03c449fc1b2b996430377935b9f53381a1e71dab6c2d0f41bee0e398ac5806b.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 15122⤵
- Program crash
PID:836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 35161⤵PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3516 -ip 35161⤵PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3516 -ip 35161⤵PID:2872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3516 -ip 35161⤵PID:2016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3516 -ip 35161⤵PID:1976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3516 -ip 35161⤵PID:2832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3516 -ip 35161⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3516 -ip 35161⤵PID:4760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3516 -ip 35161⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3516 -ip 35161⤵PID:2456