Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe
Resource
win7-20240221-en
General
-
Target
151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe
-
Size
311KB
-
MD5
9544821ed3db4db3c54f0d795bbc1ab6
-
SHA1
3dd2d16955d4e6db85051e9f368407a9d9b6870e
-
SHA256
151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a
-
SHA512
949cdade7a42a649f9daa2fd2940bf01c5bb4670e1bb3e7773fa76872da0ea1858009d6ee0f479638e8f3ee178d86d61b4750f61f768fdc0914f0994e68f6304
-
SSDEEP
6144:7f4ZKa9IPz9hmiXK8+JjdYX+VpU/UB9Xi:r4gKIPz7mid+Jj6X+YcL
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.115
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 2664 208 WerFault.exe 84 3628 208 WerFault.exe 84 3608 208 WerFault.exe 84 3044 208 WerFault.exe 84 1572 208 WerFault.exe 84 3328 208 WerFault.exe 84 4028 208 WerFault.exe 84 1796 208 WerFault.exe 84 4528 208 WerFault.exe 84 -
Kills process with taskkill 1 IoCs
pid Process 2568 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2568 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 208 wrote to memory of 1272 208 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe 106 PID 208 wrote to memory of 1272 208 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe 106 PID 208 wrote to memory of 1272 208 151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe 106 PID 1272 wrote to memory of 2568 1272 cmd.exe 110 PID 1272 wrote to memory of 2568 1272 cmd.exe 110 PID 1272 wrote to memory of 2568 1272 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe"C:\Users\Admin\AppData\Local\Temp\151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7402⤵
- Program crash
PID:2664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7842⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7722⤵
- Program crash
PID:3608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 8322⤵
- Program crash
PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9042⤵
- Program crash
PID:1572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9082⤵
- Program crash
PID:3328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9162⤵
- Program crash
PID:4028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 13402⤵
- Program crash
PID:1796
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 12962⤵
- Program crash
PID:4528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 208 -ip 2081⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 208 -ip 2081⤵PID:1428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 2081⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 208 -ip 2081⤵PID:3284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 2081⤵PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 208 -ip 2081⤵PID:1348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 208 -ip 2081⤵PID:4120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 2081⤵PID:2808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 208 -ip 2081⤵PID:4900