Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
submitted
18/01/2024, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Evo-gen.18337.728.exe
Resource
win7-20231215-en
General
-
Target
SecuriteInfo.com.Win32.Evo-gen.18337.728.exe
-
Size
296KB
-
MD5
9b9947b2b0b117705b6d6f3cad057917
-
SHA1
7d2a7a0101dd0ab93170c2d541fb2cba9feedf38
-
SHA256
485019b5e07aea65dc682c4b5e723dfb945270d5fae4478c2a138de672058fc9
-
SHA512
38b2552d1a6a433bf0e3e53e615e268487bd9469eb7b9a42b933b0fca5b7e3b7f569b70f5de101a804dedaa193d4d0a9ce9957cff34f05b3d870dc54668d937d
-
SSDEEP
6144:JVvKInZEFOs7w8/IBbGM0ye8H0d7hkYNbJfQf2:JNKInZEJw8gBDAJ9kYzfQu
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.85
Signatures
-
Gcleaner family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.Evo-gen.18337.728.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 404 2632 WerFault.exe 13 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecuriteInfo.com.Win32.Evo-gen.18337.728.exe -
Kills process with taskkill 1 IoCs
pid Process 1448 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1448 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2848 2632 SecuriteInfo.com.Win32.Evo-gen.18337.728.exe 63 PID 2632 wrote to memory of 2848 2632 SecuriteInfo.com.Win32.Evo-gen.18337.728.exe 63 PID 2632 wrote to memory of 2848 2632 SecuriteInfo.com.Win32.Evo-gen.18337.728.exe 63 PID 2848 wrote to memory of 1448 2848 cmd.exe 69 PID 2848 wrote to memory of 1448 2848 cmd.exe 69 PID 2848 wrote to memory of 1448 2848 cmd.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.18337.728.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.18337.728.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "SecuriteInfo.com.Win32.Evo-gen.18337.728.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.18337.728.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "SecuriteInfo.com.Win32.Evo-gen.18337.728.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 13242⤵
- Program crash
PID:404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2632 -ip 26321⤵PID:448