Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/09/2024, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe
Resource
win10v2004-20240802-en
General
-
Target
eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe
-
Size
431KB
-
MD5
bb228b1ce76ee8fc38f2085e37f28236
-
SHA1
d3b5540cbdb18215178b4bf1042d5f5d41af1ee1
-
SHA256
eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad
-
SHA512
d444b4f95f54ad549aa739f11b7a4e8eca8663db573a6e5304c60f223fe70bad2b61cc6964351a53e7373548c1ff5b4ed10dec1d705fef3a4d8f70a152ebeb20
-
SSDEEP
6144:XNXYiQbRBVW4qzPUgwwkKPvetP+ZsRBFufhPklb80PfAOK+l8O:RY1bZqzRwwkKOhUpKb8Ktb
Malware Config
Extracted
gcleaner
80.66.75.114
45.91.200.135
Signatures
-
Downloads MZ/PE file
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
pid pid_target Process procid_target 1004 4728 WerFault.exe 77 5096 4728 WerFault.exe 77 3772 4728 WerFault.exe 77 2996 4728 WerFault.exe 77 1776 4728 WerFault.exe 77 4200 4728 WerFault.exe 77 4732 4728 WerFault.exe 77 228 4728 WerFault.exe 77 1388 4728 WerFault.exe 77 1556 4728 WerFault.exe 77 3164 4728 WerFault.exe 77 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 1316 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1316 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4728 wrote to memory of 1068 4728 eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe 99 PID 4728 wrote to memory of 1068 4728 eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe 99 PID 4728 wrote to memory of 1068 4728 eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe 99 PID 1068 wrote to memory of 1316 1068 cmd.exe 102 PID 1068 wrote to memory of 1316 1068 cmd.exe 102 PID 1068 wrote to memory of 1316 1068 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe"C:\Users\Admin\AppData\Local\Temp\eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 4762⤵
- Program crash
PID:1004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 5002⤵
- Program crash
PID:5096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 7882⤵
- Program crash
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 8002⤵
- Program crash
PID:2996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 7882⤵
- Program crash
PID:1776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 8722⤵
- Program crash
PID:4200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 9602⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 9642⤵
- Program crash
PID:228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 13122⤵
- Program crash
PID:1388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 16482⤵
- Program crash
PID:1556
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "eb973f49b1db6de54471ee34d668e4f1fb079b856a311284abe41d115e2c85ad.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 17202⤵
- Program crash
PID:3164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4728 -ip 47281⤵PID:2376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4728 -ip 47281⤵PID:2840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4728 -ip 47281⤵PID:4848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4728 -ip 47281⤵PID:4080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4728 -ip 47281⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4728 -ip 47281⤵PID:4128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4728 -ip 47281⤵PID:4688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4728 -ip 47281⤵PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4728 -ip 47281⤵PID:3616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4728 -ip 47281⤵PID:4976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4728 -ip 47281⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99