Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 23:32
Static task
static1
Behavioral task
behavioral1
Sample
473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe
Resource
win10v2004-20240226-en
General
-
Target
473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe
-
Size
344KB
-
MD5
08545811862e0988ff75e2cefb7197ad
-
SHA1
44a94206f67ea6ba1a8eb7e670351fcd9b4cd9db
-
SHA256
473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb
-
SHA512
5909c910ca15b8cae493b8437a855542c95ae3b976dcba2dc1ff2b03b6aa7f623d7bc00aeec7c58d84442575245c384b0058e2b3f3ccf7c07d19602a83926680
-
SSDEEP
6144:d9DRCQ9xRyM8fyxJ+FFmlpEtEMQt9lIeUe:jDb/DJHZtn
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2856 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 3604 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 3180 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 3540 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 4056 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 548 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 2816 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 4564 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe 4176 4160 WerFault.exe 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3540 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3540 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.execmd.exedescription pid process target process PID 4160 wrote to memory of 2320 4160 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe cmd.exe PID 4160 wrote to memory of 2320 4160 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe cmd.exe PID 4160 wrote to memory of 2320 4160 473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe cmd.exe PID 2320 wrote to memory of 3540 2320 cmd.exe taskkill.exe PID 2320 wrote to memory of 3540 2320 cmd.exe taskkill.exe PID 2320 wrote to memory of 3540 2320 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe"C:\Users\Admin\AppData\Local\Temp\473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 8082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 15762⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "473de0cfd6a9b2d71ea3f9db86c0f4bc83003a7ea710dd6968bde614969609cb.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 16962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4160 -ip 41601⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3464 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\advdlc[1].htmFilesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
memory/4160-1-0x0000000002100000-0x0000000002200000-memory.dmpFilesize
1024KB
-
memory/4160-2-0x0000000002040000-0x000000000207C000-memory.dmpFilesize
240KB
-
memory/4160-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4160-4-0x0000000000400000-0x0000000001FA2000-memory.dmpFilesize
27.6MB
-
memory/4160-9-0x0000000010000000-0x000000001001C000-memory.dmpFilesize
112KB
-
memory/4160-13-0x0000000000400000-0x0000000001FA2000-memory.dmpFilesize
27.6MB
-
memory/4160-15-0x0000000002100000-0x0000000002200000-memory.dmpFilesize
1024KB
-
memory/4160-17-0x0000000002040000-0x000000000207C000-memory.dmpFilesize
240KB
-
memory/4160-19-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4160-37-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4160-36-0x0000000000400000-0x0000000001FA2000-memory.dmpFilesize
27.6MB