Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
12/09/2024, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
inte.exe
Resource
win7-20240704-en
General
-
Target
inte.exe
-
Size
309KB
-
MD5
7843ceaa0b4ea7bd6b37d453ffe0f72c
-
SHA1
45be48fad4296f903c7ff9cd8d604f7900248d86
-
SHA256
f151ea6249959fa93e3e3f1eb3c83c259bc23f93e052b132c5f45d180ee41840
-
SHA512
501ab1a157d6339231d4e36c3a323e1a00df92ee8556487ead97913d120576d645a9d0034c755c9c29a400b320a05029b42e927f8b7e2919e049fcd3c44271dd
-
SSDEEP
6144:TuicZcyHMdzLVy0D7/28SQg1Yw1w+Yso4aEW:TuiYcUMdvfgLwsV
Malware Config
Extracted
gcleaner
80.66.75.114
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inte.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 4320 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4320 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4528 4816 inte.exe 70 PID 4816 wrote to memory of 4528 4816 inte.exe 70 PID 4816 wrote to memory of 4528 4816 inte.exe 70 PID 4528 wrote to memory of 4320 4528 cmd.exe 72 PID 4528 wrote to memory of 4320 4528 cmd.exe 72 PID 4528 wrote to memory of 4320 4528 cmd.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\inte.exe"C:\Users\Admin\AppData\Local\Temp\inte.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\inte.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "inte.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99