Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe
Resource
win10v2004-20240508-en
General
-
Target
ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe
-
Size
388KB
-
MD5
6c41fca21045431e33fca1d5107beae6
-
SHA1
6e20891c5fbe1148f8d85e2b6ea2be31dee36bf5
-
SHA256
ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9
-
SHA512
794258cbafddafc04be75be6d304ef2ae9dd56b70761d2b96fddf0550a2d0dccde3243d5c8db4448ec40ef46a89761fd2c72c3e7f97c606665173513ad29083c
-
SSDEEP
6144:djr9eltSqItUozTxEIknA6nqA6raILBSNWG6RXndF:1r9eltDITK4AR2S4ln
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 3240 1204 WerFault.exe 81 4048 1204 WerFault.exe 81 1872 1204 WerFault.exe 81 464 1204 WerFault.exe 81 528 1204 WerFault.exe 81 2388 1204 WerFault.exe 81 4264 1204 WerFault.exe 81 412 1204 WerFault.exe 81 -
Kills process with taskkill 1 IoCs
pid Process 3612 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3612 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1204 wrote to memory of 4076 1204 ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe 113 PID 1204 wrote to memory of 4076 1204 ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe 113 PID 1204 wrote to memory of 4076 1204 ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe 113 PID 4076 wrote to memory of 3612 4076 cmd.exe 115 PID 4076 wrote to memory of 3612 4076 cmd.exe 115 PID 4076 wrote to memory of 3612 4076 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe"C:\Users\Admin\AppData\Local\Temp\ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 4602⤵
- Program crash
PID:3240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 7642⤵
- Program crash
PID:4048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 8042⤵
- Program crash
PID:1872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 8042⤵
- Program crash
PID:464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 7642⤵
- Program crash
PID:528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 9282⤵
- Program crash
PID:2388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 9322⤵
- Program crash
PID:4264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 15802⤵
- Program crash
PID:412
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ebf175f3cb1e37fe3740e183a34d7ea3dc4bf834fbd19115e6db1a7bf6e404d9.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1204 -ip 12041⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1204 -ip 12041⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1204 -ip 12041⤵PID:1828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1204 -ip 12041⤵PID:2028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1204 -ip 12041⤵PID:1824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1204 -ip 12041⤵PID:532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1204 -ip 12041⤵PID:1904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1204 -ip 12041⤵PID:2996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99