Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe
Resource
win10v2004-20240508-en
General
-
Target
645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe
-
Size
295KB
-
MD5
d221456c3724a8ae84d820c0d0afcbd0
-
SHA1
59b1473db91fbf6890ba64b512b73565fc51ea9e
-
SHA256
645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4
-
SHA512
4e73d8ab04ac84ad3e8890298958dc894bd7ce3ea3d11bd278bc4469b5be087922052aa046ca20e29c614e1675e490220318b0dc3689c7dd716aa1192cc5896e
-
SSDEEP
3072:Ei0lmjZc7WnYxroz6/waAAoJIXFoJncSIlQBAWJ2Y3xUvxcW9GNI+B75icT1jtd:j9ju75fVSIaafWzCvSW8G+1L
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
5.42.65.64
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 2964 3024 WerFault.exe 82 840 3024 WerFault.exe 82 780 3024 WerFault.exe 82 816 3024 WerFault.exe 82 2588 3024 WerFault.exe 82 3140 3024 WerFault.exe 82 1516 3024 WerFault.exe 82 4740 3024 WerFault.exe 82 232 3024 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
pid Process 2652 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2652 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3048 3024 645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe 112 PID 3024 wrote to memory of 3048 3024 645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe 112 PID 3024 wrote to memory of 3048 3024 645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe 112 PID 3048 wrote to memory of 2652 3048 cmd.exe 116 PID 3048 wrote to memory of 2652 3048 cmd.exe 116 PID 3048 wrote to memory of 2652 3048 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe"C:\Users\Admin\AppData\Local\Temp\645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 4522⤵
- Program crash
PID:2964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 7642⤵
- Program crash
PID:840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8042⤵
- Program crash
PID:780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8202⤵
- Program crash
PID:816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 8282⤵
- Program crash
PID:2588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9282⤵
- Program crash
PID:3140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9362⤵
- Program crash
PID:1516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 13562⤵
- Program crash
PID:4740
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "645ccca17804f453d92dca6394beadcd8c774f413cacf918c75a1a6517acc7c4.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 5042⤵
- Program crash
PID:232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3024 -ip 30241⤵PID:1496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3024 -ip 30241⤵PID:1104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3024 -ip 30241⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3024 -ip 30241⤵PID:4284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3024 -ip 30241⤵PID:2844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3024 -ip 30241⤵PID:2684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3024 -ip 30241⤵PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3024 -ip 30241⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3024 -ip 30241⤵PID:2516