Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/04/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe
Resource
win10v2004-20240412-en
General
-
Target
ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe
-
Size
336KB
-
MD5
4d73dce22d36105014e589a7cdd5ad04
-
SHA1
cb930cdce8251fb84ab6f6b88792dfe01f84e7c4
-
SHA256
ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0
-
SHA512
e68f109245eeb50a3e3052b13ccc005905b99f25fb08b06d6c8011019e46a075dead58ec4903cb40e78d6c5697f97dab0d7ebcb241b1ba064f168baa4ef4a8f1
-
SSDEEP
3072:Odk4+c0ObwJPNLHn0rQnSt2+ePTx35RKd9lVOuSj1prrqxHzFYqy7sMaC1rv6+El:hPPtH0kSt2A3Sxu9FYiC1rvvEN3O
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 3584 4832 WerFault.exe 79 1036 4832 WerFault.exe 79 1044 4832 WerFault.exe 79 2564 4832 WerFault.exe 79 3880 4832 WerFault.exe 79 4152 4832 WerFault.exe 79 1172 4832 WerFault.exe 79 2024 4832 WerFault.exe 79 1496 4832 WerFault.exe 79 -
Kills process with taskkill 1 IoCs
pid Process 5020 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5020 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4832 wrote to memory of 2148 4832 ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe 98 PID 4832 wrote to memory of 2148 4832 ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe 98 PID 4832 wrote to memory of 2148 4832 ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe 98 PID 2148 wrote to memory of 5020 2148 cmd.exe 102 PID 2148 wrote to memory of 5020 2148 cmd.exe 102 PID 2148 wrote to memory of 5020 2148 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe"C:\Users\Admin\AppData\Local\Temp\ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 7802⤵
- Program crash
PID:3584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 7882⤵
- Program crash
PID:1036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 7882⤵
- Program crash
PID:1044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 8762⤵
- Program crash
PID:2564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 9642⤵
- Program crash
PID:3880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 10882⤵
- Program crash
PID:4152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 12042⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 14322⤵
- Program crash
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ad1a55297078632470302dcc6e350965122c44bcbedeaadbaf87f992a5836ee0.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 13922⤵
- Program crash
PID:1496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4832 -ip 48321⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4832 -ip 48321⤵PID:1948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4832 -ip 48321⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4832 -ip 48321⤵PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4832 -ip 48321⤵PID:4272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4832 -ip 48321⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4832 -ip 48321⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4832 -ip 48321⤵PID:1128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4832 -ip 48321⤵PID:4976