Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/09/2024, 16:01

General

  • Target

    file.exe

  • Size

    4KB

  • MD5

    ddc9229a87f36e9d555ddae1c8d4ac09

  • SHA1

    e902d5ab723fa81913dd73999da9778781647c28

  • SHA256

    efec912465df5c55b4764e0277aa4c4c549e612b4f3c5abf77aaec647729f78a

  • SHA512

    08b5ad94168bf90bae2f2917fde1b2a36650845fdcb23881d76ddddae73359fbd774c92083ba03a84083c48d4922afb339c637d49dfa67fbf9eb95b3bf86baa6

  • SSDEEP

    48:66sn7l2zMdoHSe0rHNMMb9Y7VxCioXsTfxZsFtow/ljhFvCFipfbNtm:PYqX9VxCJ8U/3F5zNt

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

45.91.200.135

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\tmp80D8.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp80D8.tmp.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 452
        3⤵
        • Program crash
        PID:3564
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 764
        3⤵
        • Program crash
        PID:1252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 804
        3⤵
        • Program crash
        PID:4632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 824
        3⤵
        • Program crash
        PID:2332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 868
        3⤵
        • Program crash
        PID:3332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 928
        3⤵
        • Program crash
        PID:2296
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 932
        3⤵
        • Program crash
        PID:3624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1044
        3⤵
        • Program crash
        PID:3736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1624
        3⤵
        • Program crash
        PID:448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c taskkill /im "tmp80D8.tmp.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\tmp80D8.tmp.exe" & exit
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /im "tmp80D8.tmp.exe" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 492
        3⤵
        • Program crash
        PID:1228
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1768 -ip 1768
    1⤵
      PID:4380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1768 -ip 1768
      1⤵
        PID:1864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1768 -ip 1768
        1⤵
          PID:1288
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1768 -ip 1768
          1⤵
            PID:4140
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1768 -ip 1768
            1⤵
              PID:1656
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1768 -ip 1768
              1⤵
                PID:2692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1768 -ip 1768
                1⤵
                  PID:4224
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1768 -ip 1768
                  1⤵
                    PID:2108
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1768 -ip 1768
                    1⤵
                      PID:5104
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1768 -ip 1768
                      1⤵
                        PID:4524

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLXU5DI6\download[1].htm

                        Filesize

                        1B

                        MD5

                        cfcd208495d565ef66e7dff9f98764da

                        SHA1

                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                        SHA256

                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                        SHA512

                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      • C:\Users\Admin\AppData\Local\Temp\tmp80D8.tmp.exe

                        Filesize

                        334KB

                        MD5

                        bdf38f58675cd77401c679df69c4a3e8

                        SHA1

                        298dac0330058235adec1bd5dd80c59f99c688af

                        SHA256

                        08dc5b0fb0c2646f546f0af389c3c9934995f1cf6819a05c171db3eca242554d

                        SHA512

                        fa056f5784c76252db3edff2f0ba060b2ac42fbb2c73fedaa076ba735b2f19c14b7feff69f6794f0108c98fe91764e4d45110459e87df68a072a78f212a363c1

                      • memory/1180-0-0x00007FFD1F223000-0x00007FFD1F225000-memory.dmp

                        Filesize

                        8KB

                      • memory/1180-1-0x0000000000A70000-0x0000000000A78000-memory.dmp

                        Filesize

                        32KB

                      • memory/1180-2-0x00007FFD1F220000-0x00007FFD1FCE1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/1180-12-0x00007FFD1F220000-0x00007FFD1FCE1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/1768-21-0x0000000010000000-0x000000001001C000-memory.dmp

                        Filesize

                        112KB

                      • memory/1768-16-0x0000000000400000-0x000000000043F000-memory.dmp

                        Filesize

                        252KB

                      • memory/1768-15-0x0000000002300000-0x000000000233B000-memory.dmp

                        Filesize

                        236KB

                      • memory/1768-25-0x0000000000700000-0x0000000000800000-memory.dmp

                        Filesize

                        1024KB

                      • memory/1768-27-0x0000000000400000-0x0000000000550000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/1768-28-0x0000000002300000-0x000000000233B000-memory.dmp

                        Filesize

                        236KB

                      • memory/1768-30-0x0000000000400000-0x000000000043F000-memory.dmp

                        Filesize

                        252KB

                      • memory/1768-14-0x0000000000700000-0x0000000000800000-memory.dmp

                        Filesize

                        1024KB

                      • memory/1768-40-0x0000000000400000-0x0000000000550000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/1768-48-0x0000000000400000-0x0000000000550000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/1768-49-0x0000000000400000-0x000000000043F000-memory.dmp

                        Filesize

                        252KB