Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
258s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
07/07/2023, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe
Resource
win7-20230705-en
General
-
Target
589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe
-
Size
304KB
-
MD5
b59c8093621b9d5b5ad1905fab5aee00
-
SHA1
e36627f6faaee192a2ab8f4d6e7ccad03409e306
-
SHA256
589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e
-
SHA512
8e6ded0e24a587bd10c91ca62dd52e0f0418207484a32c407ce625c6e3af7d0963dc728caeec153c79a94e6be07d4bd4edd8c3bb4e4e6ed20fab5d4a84e8bc72
-
SSDEEP
6144:i083LPjsNIaUNNsEdX/k5+qgRxx4xwdmJLaTZoA:N837js+bjX4SD4i0KKA
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 4836 3532 WerFault.exe 69 4268 3532 WerFault.exe 69 828 3532 WerFault.exe 69 4116 3532 WerFault.exe 69 432 3532 WerFault.exe 69 724 3532 WerFault.exe 69 4756 3532 WerFault.exe 69 2272 3532 WerFault.exe 69 4720 3532 WerFault.exe 69 -
Kills process with taskkill 1 IoCs
pid Process 3444 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3444 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3532 wrote to memory of 3576 3532 589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe 80 PID 3532 wrote to memory of 3576 3532 589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe 80 PID 3532 wrote to memory of 3576 3532 589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe 80 PID 3576 wrote to memory of 3444 3576 cmd.exe 82 PID 3576 wrote to memory of 3444 3576 cmd.exe 82 PID 3576 wrote to memory of 3444 3576 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe"C:\Users\Admin\AppData\Local\Temp\589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 5242⤵
- Program crash
PID:4836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 7762⤵
- Program crash
PID:4268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 8042⤵
- Program crash
PID:828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 8722⤵
- Program crash
PID:4116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 10002⤵
- Program crash
PID:432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 9682⤵
- Program crash
PID:724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 11442⤵
- Program crash
PID:4756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 11562⤵
- Program crash
PID:2272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 13242⤵
- Program crash
PID:4720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "589f9841822ba66abe4cf94fc3f104307d13014de6d3ed4bc507873fe0653e2e.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
-