Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/09/2024, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
d1b22013a322d2d3f3a050b900c3270466bb519da68e27f6f6afaa9bdc3383c7.exe
Resource
win10v2004-20240802-en
General
-
Target
d1b22013a322d2d3f3a050b900c3270466bb519da68e27f6f6afaa9bdc3383c7.exe
-
Size
433KB
-
MD5
9cc935239389f22692847a3d233c2878
-
SHA1
8ea6d552fcec446433ee3b1970ffd8fb7e22db1c
-
SHA256
d1b22013a322d2d3f3a050b900c3270466bb519da68e27f6f6afaa9bdc3383c7
-
SHA512
08e484f13d7990f2174d0157496de1f6a4b66fce1620eda42cbc9c09bbd9896ecd0ae36fcbda19f8d3186bc5eb165d03b09ca9b911f2c0c6bf6964f18305300e
-
SSDEEP
6144:3tDlEnMXd+d0AxFKDunWAgKEt7HecOEwlJkT7g0+HP6B:hlYMXY62KqBgvV+J/h0+Hi
Malware Config
Extracted
gcleaner
80.66.75.114
45.91.200.135
Signatures
-
Program crash 9 IoCs
pid pid_target Process procid_target 1012 1528 WerFault.exe 77 548 1528 WerFault.exe 77 4500 1528 WerFault.exe 77 3124 1528 WerFault.exe 77 1396 1528 WerFault.exe 77 2116 1528 WerFault.exe 77 2880 1528 WerFault.exe 77 4924 1528 WerFault.exe 77 1760 1528 WerFault.exe 77 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1b22013a322d2d3f3a050b900c3270466bb519da68e27f6f6afaa9bdc3383c7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b22013a322d2d3f3a050b900c3270466bb519da68e27f6f6afaa9bdc3383c7.exe"C:\Users\Admin\AppData\Local\Temp\d1b22013a322d2d3f3a050b900c3270466bb519da68e27f6f6afaa9bdc3383c7.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 4762⤵
- Program crash
PID:1012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 5402⤵
- Program crash
PID:548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 7802⤵
- Program crash
PID:4500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 8002⤵
- Program crash
PID:3124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 8002⤵
- Program crash
PID:1396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 8722⤵
- Program crash
PID:2116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 9602⤵
- Program crash
PID:2880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 10722⤵
- Program crash
PID:4924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 7842⤵
- Program crash
PID:1760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 15281⤵PID:5628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1528 -ip 15281⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1528 -ip 15281⤵PID:3364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1528 -ip 15281⤵PID:3140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1528 -ip 15281⤵PID:2212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1528 -ip 15281⤵PID:1888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1528 -ip 15281⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1528 -ip 15281⤵PID:2908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 15281⤵PID:1032