Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
141s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/03/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe
Resource
win10v2004-20240226-en
General
-
Target
f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe
-
Size
282KB
-
MD5
d369af1128722a21e63b54767b27df9b
-
SHA1
a134ed2b5d493e6c35e275d663b21ab8420e3cab
-
SHA256
f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d
-
SHA512
3e9665342b8f0b9817f023fdd0dc63b2ed51b4a3c2b529b8d92afc75426dd3f169b6592ac78899f25346259cd236cbf6626e445547acf431c0da2b940e1be36c
-
SSDEEP
6144:0tnPIXREcJMcUsuKpoqoLhcIboriKVkk:0lPIXREyFUUp56horvVk
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.115
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 3568 1708 WerFault.exe 79 4860 1708 WerFault.exe 79 4712 1708 WerFault.exe 79 2408 1708 WerFault.exe 79 240 1708 WerFault.exe 79 1976 1708 WerFault.exe 79 3308 1708 WerFault.exe 79 1684 1708 WerFault.exe 79 4272 1708 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 1656 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1656 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4428 1708 f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe 99 PID 1708 wrote to memory of 4428 1708 f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe 99 PID 1708 wrote to memory of 4428 1708 f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe 99 PID 4428 wrote to memory of 1656 4428 cmd.exe 102 PID 4428 wrote to memory of 1656 4428 cmd.exe 102 PID 4428 wrote to memory of 1656 4428 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe"C:\Users\Admin\AppData\Local\Temp\f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 7802⤵
- Program crash
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 7962⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 8322⤵
- Program crash
PID:4712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 8082⤵
- Program crash
PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 9522⤵
- Program crash
PID:240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 10762⤵
- Program crash
PID:1976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 10722⤵
- Program crash
PID:3308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 14442⤵
- Program crash
PID:1684
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f6657feeb739e084356de73ea5076668476bde7a06cdc3f867526ca27c68fb2d.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 13562⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1708 -ip 17081⤵PID:3016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1708 -ip 17081⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1708 -ip 17081⤵PID:1696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1708 -ip 17081⤵PID:3144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1708 -ip 17081⤵PID:4976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1708 -ip 17081⤵PID:4904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1708 -ip 17081⤵PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1708 -ip 17081⤵PID:3480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1708 -ip 17081⤵PID:2868