Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe
Resource
win10v2004-20240412-en
General
-
Target
ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe
-
Size
336KB
-
MD5
4d73dce22d36105014e589a7cdd5ad04
-
SHA1
cb930cdce8251fb84ab6f6b88792dfe01f84e7c4
-
SHA256
ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0
-
SHA512
e68f109245eeb50a3e3052b13ccc005905b99f25fb08b06d6c8011019e46a075dead58ec4903cb40e78d6c5697f97dab0d7ebcb241b1ba064f168baa4ef4a8f1
-
SSDEEP
3072:Odk4+c0ObwJPNLHn0rQnSt2+ePTx35RKd9lVOuSj1prrqxHzFYqy7sMaC1rv6+El:hPPtH0kSt2A3Sxu9FYiC1rvvEN3O
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4008 3620 WerFault.exe 86 1132 3620 WerFault.exe 86 3760 3620 WerFault.exe 86 2660 3620 WerFault.exe 86 2688 3620 WerFault.exe 86 3960 3620 WerFault.exe 86 436 3620 WerFault.exe 86 4588 3620 WerFault.exe 86 -
Kills process with taskkill 1 IoCs
pid Process 4900 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4900 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3620 wrote to memory of 3108 3620 ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe 108 PID 3620 wrote to memory of 3108 3620 ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe 108 PID 3620 wrote to memory of 3108 3620 ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe 108 PID 3108 wrote to memory of 4900 3108 cmd.exe 110 PID 3108 wrote to memory of 4900 3108 cmd.exe 110 PID 3108 wrote to memory of 4900 3108 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe"C:\Users\Admin\AppData\Local\Temp\ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 7482⤵
- Program crash
PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 7562⤵
- Program crash
PID:1132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 7562⤵
- Program crash
PID:3760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 7802⤵
- Program crash
PID:2660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 9082⤵
- Program crash
PID:2688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 10042⤵
- Program crash
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 10922⤵
- Program crash
PID:436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 13362⤵
- Program crash
PID:4588
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3620 -ip 36201⤵PID:4688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3620 -ip 36201⤵PID:1180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3620 -ip 36201⤵PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3620 -ip 36201⤵PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3620 -ip 36201⤵PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3620 -ip 36201⤵PID:3048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3620 -ip 36201⤵PID:2736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3620 -ip 36201⤵PID:3920