Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe
Resource
win10v2004-20240419-en
General
-
Target
c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe
-
Size
283KB
-
MD5
c12f4ab87416d22ac2989a1ff929e168
-
SHA1
ec58965c77662664fdacd884cfee7655d4c5fa0e
-
SHA256
c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb
-
SHA512
efb6a0b669ab553cf2fd125c64886c1e0bdb1ce1c595c99f1ff809419dc54b2b6d943948bdfbf50d3e04d9174dfaf973ab35d47d8b8f3bff36fcbd9455b09bcd
-
SSDEEP
3072:wZk30AnvvcJQ4Vo8Crr599hT/UeSO6L9Lm5jHKOnc:30qvE5Voh9fT/UlO6LWHK
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 1268 3704 WerFault.exe 82 2112 3704 WerFault.exe 82 4092 3704 WerFault.exe 82 2856 3704 WerFault.exe 82 3384 3704 WerFault.exe 82 4376 3704 WerFault.exe 82 3972 3704 WerFault.exe 82 3196 3704 WerFault.exe 82 4356 3704 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 2156 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2156 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3704 wrote to memory of 2928 3704 c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe 114 PID 3704 wrote to memory of 2928 3704 c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe 114 PID 3704 wrote to memory of 2928 3704 c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe 114 PID 2928 wrote to memory of 2156 2928 cmd.exe 118 PID 2928 wrote to memory of 2156 2928 cmd.exe 118 PID 2928 wrote to memory of 2156 2928 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe"C:\Users\Admin\AppData\Local\Temp\c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7402⤵
- Program crash
PID:1268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7602⤵
- Program crash
PID:2112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7922⤵
- Program crash
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 8322⤵
- Program crash
PID:2856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 9042⤵
- Program crash
PID:3384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 9762⤵
- Program crash
PID:4376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 10722⤵
- Program crash
PID:3972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 13522⤵
- Program crash
PID:3196
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "c1030484a297cc8cbcb1d2d72a945390b5d5014c4f30089bd35ee6a0191d1cdb.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 12682⤵
- Program crash
PID:4356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 37041⤵PID:1704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3704 -ip 37041⤵PID:2028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3704 -ip 37041⤵PID:944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3704 -ip 37041⤵PID:1744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3704 -ip 37041⤵PID:1564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3704 -ip 37041⤵PID:3292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3704 -ip 37041⤵PID:864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3704 -ip 37041⤵PID:760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3704 -ip 37041⤵PID:1448