Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-05-2024 15:27
Static task
static1
Behavioral task
behavioral1
Sample
bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe
Resource
win10v2004-20240426-en
General
-
Target
bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe
-
Size
330KB
-
MD5
760cbf94025c1c7848255de5ab21c63d
-
SHA1
0aeb8077897e1b58ce3c1f77c1ddf0514ec2e90a
-
SHA256
bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2
-
SHA512
1fa23d3dcd1f14f9f2f3ea5e71fc1cb4d47f36a0029f8d9c2f1fe0232c2a588a8bfb317630c6ca97a9413063aa4a97a539c0fb195179aaf95bc018a582e88014
-
SSDEEP
6144:r0AuHAfVNhpcqpvVKVINYDKYYvuwwFLM/:47KqYVKpDKCww
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4720 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 4964 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 4820 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 2748 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 1620 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 4436 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 1972 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 2880 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 3704 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe 2456 5076 WerFault.exe bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1588 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1588 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.execmd.exedescription pid process target process PID 5076 wrote to memory of 3932 5076 bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe cmd.exe PID 5076 wrote to memory of 3932 5076 bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe cmd.exe PID 5076 wrote to memory of 3932 5076 bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe cmd.exe PID 3932 wrote to memory of 1588 3932 cmd.exe taskkill.exe PID 3932 wrote to memory of 1588 3932 cmd.exe taskkill.exe PID 3932 wrote to memory of 1588 3932 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe"C:\Users\Admin\AppData\Local\Temp\bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 8482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 8882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 11042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 13802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 16722⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "bfb37883e483db441614dc6c32c467eec631829df71b5422557dd4b18e38e4a2.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 17762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 340 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5076 -ip 50761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5076 -ip 50761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CKNXESCB\advdlc[1].htmFilesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
memory/5076-2-0x0000000003CF0000-0x0000000003D2C000-memory.dmpFilesize
240KB
-
memory/5076-1-0x0000000002180000-0x0000000002280000-memory.dmpFilesize
1024KB
-
memory/5076-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5076-9-0x0000000010000000-0x000000001001C000-memory.dmpFilesize
112KB
-
memory/5076-15-0x0000000000400000-0x0000000001F9E000-memory.dmpFilesize
27.6MB
-
memory/5076-19-0x0000000002180000-0x0000000002280000-memory.dmpFilesize
1024KB
-
memory/5076-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5076-34-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/5076-33-0x0000000000400000-0x0000000001F9E000-memory.dmpFilesize
27.6MB