Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/09/2024, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607.exe
Resource
win10v2004-20240802-en
General
-
Target
9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607.exe
-
Size
315KB
-
MD5
a0ecb108a0fae0ff8f9dde53c110dec4
-
SHA1
71be364d36fc8213e19459fa0b16e92ccf49cdf8
-
SHA256
9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607
-
SHA512
5eb8784988d3bfee5023f81b951f9e65639ec75424c3bf277d98ec9a483808b9a42983ec3edf82f0ac9bbe9b612313ae71123ab855d15ec4b8b311df543f238d
-
SSDEEP
6144:H858bT1XYxQz0Knwk7O5j5xqFbXzlEiJqYuQTdJEZ:c5uT1oAznw8OUhlZPhdJEZ
Malware Config
Extracted
gcleaner
80.66.75.114
45.91.200.135
Signatures
-
Program crash 8 IoCs
pid pid_target Process procid_target 1524 3708 WerFault.exe 89 2200 3708 WerFault.exe 89 3676 3708 WerFault.exe 89 4976 3708 WerFault.exe 89 4184 3708 WerFault.exe 89 760 3708 WerFault.exe 89 2540 3708 WerFault.exe 89 4672 3708 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3708 9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607.exe"C:\Users\Admin\AppData\Local\Temp\9df1e0474c64fd9be1b0c5e976ed7944511b598118a8bb89cfbaf8ee7f8d9607.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 4562⤵
- Program crash
PID:1524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 7642⤵
- Program crash
PID:2200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 7842⤵
- Program crash
PID:3676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 8082⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 8362⤵
- Program crash
PID:4184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 9282⤵
- Program crash
PID:760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 9762⤵
- Program crash
PID:2540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 7682⤵
- Program crash
PID:4672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3708 -ip 37081⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3708 -ip 37081⤵PID:4372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3708 -ip 37081⤵PID:4036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=1016 /prefetch:81⤵PID:1860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3708 -ip 37081⤵PID:4416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3708 -ip 37081⤵PID:4264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3708 -ip 37081⤵PID:2928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3708 -ip 37081⤵PID:3840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3708 -ip 37081⤵PID:2816