Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/03/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe
Resource
win10v2004-20240226-en
General
-
Target
f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe
-
Size
282KB
-
MD5
d369af1128722a21e63b54767b27df9b
-
SHA1
a134ed2b5d493e6c35e275d663b21ab8420e3cab
-
SHA256
f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d
-
SHA512
3e9665342b8f0b9817f023fdd0dc63b2ed51b4a3c2b529b8d92afc75426dd3f169b6592ac78899f25346259cd236cbf6626e445547acf431c0da2b940e1be36c
-
SSDEEP
6144:0tnPIXREcJMcUsuKpoqoLhcIboriKVkk:0lPIXREyFUUp56horvVk
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.115
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 3708 208 WerFault.exe 96 4472 208 WerFault.exe 96 4080 208 WerFault.exe 96 4380 208 WerFault.exe 96 4484 208 WerFault.exe 96 640 208 WerFault.exe 96 3884 208 WerFault.exe 96 3772 208 WerFault.exe 96 -
Kills process with taskkill 1 IoCs
pid Process 968 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 968 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 208 wrote to memory of 1860 208 f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe 116 PID 208 wrote to memory of 1860 208 f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe 116 PID 208 wrote to memory of 1860 208 f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe 116 PID 1860 wrote to memory of 968 1860 cmd.exe 120 PID 1860 wrote to memory of 968 1860 cmd.exe 120 PID 1860 wrote to memory of 968 1860 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe"C:\Users\Admin\AppData\Local\Temp\f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7402⤵
- Program crash
PID:3708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7802⤵
- Program crash
PID:4472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7722⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 8162⤵
- Program crash
PID:4380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9042⤵
- Program crash
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 10002⤵
- Program crash
PID:640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 13442⤵
- Program crash
PID:3884
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 13002⤵
- Program crash
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 208 -ip 2081⤵PID:3836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 208 -ip 2081⤵PID:2352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 208 -ip 2081⤵PID:4760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 208 -ip 2081⤵PID:5040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 208 -ip 2081⤵PID:3768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 208 -ip 2081⤵PID:1164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 208 -ip 2081⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 208 -ip 2081⤵PID:1616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3492 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:1624