Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
f4d018bed6bd4e093b03501f4588d3a0N.exe
Resource
win7-20240903-en
General
-
Target
f4d018bed6bd4e093b03501f4588d3a0N.exe
-
Size
324KB
-
MD5
f4d018bed6bd4e093b03501f4588d3a0
-
SHA1
99ec2abf0d0e06c82942c5c66feb3734d409769c
-
SHA256
a60e84798f50c0f059277deb575211cf6bb281a370839cd3712cadb50e5b5ba7
-
SHA512
fec16d23693bd008c32517a5551414dae45a6fd06c2e4b845853fdbdc05e28b236b85771131c6d7c905519f47f0462049db3b4f4c4e908aaca1a209a2f4d3d45
-
SSDEEP
6144:KeDq3hGbgMrFhKL5FBqUY1K0nzZquQC+XJPyC/MPj0Vdh1tQ:K2qgUMrFhKnNpmzg2+X5yuVdz
Malware Config
Extracted
gcleaner
80.66.75.114
45.91.200.135
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation f4d018bed6bd4e093b03501f4588d3a0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
pid pid_target Process procid_target 3616 1712 WerFault.exe 82 4452 1712 WerFault.exe 82 1744 1712 WerFault.exe 82 1328 1712 WerFault.exe 82 4868 1712 WerFault.exe 82 1316 1712 WerFault.exe 82 456 1712 WerFault.exe 82 212 1712 WerFault.exe 82 968 1712 WerFault.exe 82 1928 1712 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4d018bed6bd4e093b03501f4588d3a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 2264 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2264 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1156 1712 f4d018bed6bd4e093b03501f4588d3a0N.exe 115 PID 1712 wrote to memory of 1156 1712 f4d018bed6bd4e093b03501f4588d3a0N.exe 115 PID 1712 wrote to memory of 1156 1712 f4d018bed6bd4e093b03501f4588d3a0N.exe 115 PID 1156 wrote to memory of 2264 1156 cmd.exe 118 PID 1156 wrote to memory of 2264 1156 cmd.exe 118 PID 1156 wrote to memory of 2264 1156 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4d018bed6bd4e093b03501f4588d3a0N.exe"C:\Users\Admin\AppData\Local\Temp\f4d018bed6bd4e093b03501f4588d3a0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 4402⤵
- Program crash
PID:3616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 5042⤵
- Program crash
PID:4452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 7482⤵
- Program crash
PID:1744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 7882⤵
- Program crash
PID:1328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 7882⤵
- Program crash
PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 8522⤵
- Program crash
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 9122⤵
- Program crash
PID:456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 9842⤵
- Program crash
PID:212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 16522⤵
- Program crash
PID:968
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f4d018bed6bd4e093b03501f4588d3a0N.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f4d018bed6bd4e093b03501f4588d3a0N.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f4d018bed6bd4e093b03501f4588d3a0N.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 10122⤵
- Program crash
PID:1928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1712 -ip 17121⤵PID:1240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1712 -ip 17121⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1712 -ip 17121⤵PID:4852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1712 -ip 17121⤵PID:1044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1712 -ip 17121⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1712 -ip 17121⤵PID:952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1712 -ip 17121⤵PID:3332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1712 -ip 17121⤵PID:4528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1712 -ip 17121⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1712 -ip 17121⤵PID:3968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99