Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 02:17 UTC

General

  • Target

    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe

  • Size

    1.8MB

  • MD5

    872445f439140f8b8db73ec546971cc9

  • SHA1

    86ca54d31ba843a883c352f387a623dd35c09c8c

  • SHA256

    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab

  • SHA512

    eb28f12e13fabfc1d2ebf768548cafded96006de1c8647f7cdfe37f050d6a16a6cbe2a0e4131dc4a1c7027285bb5d7af544b4168627a793884f1fa169f6aa50c

  • SSDEEP

    24576:UB06NnSMYTaEX4H3VXTzQmmVSXmx7ILXocFLwFkue/e0rShVM6vH663KRqRi8QHf:X6NSHX4XVsmmVIm6b7FLwFFET3gKIc

Malware Config

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe
    "C:\Users\Admin\AppData\Local\Temp\20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2084

Network

  • flag-nl
    GET
    http://92.63.197.221/add?substr=mixtwo&s=three&sub=
    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe
    Remote address:
    92.63.197.221:80
    Request
    GET /add?substr=mixtwo&s=three&sub= HTTP/1.1
    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
    User-Agent: 1
    Host: 92.63.197.221
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.0 500 Internal Server Error
    Date: Fri, 06 Dec 2024 02:18:01 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Content-Length: 0
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    GET
    http://92.63.197.221/add?substr=mixtwo&s=three&sub=
    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe
    Remote address:
    92.63.197.221:80
    Request
    GET /add?substr=mixtwo&s=three&sub= HTTP/1.1
    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
    User-Agent: 1
    Host: 92.63.197.221
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Fri, 06 Dec 2024 02:20:20 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Content-Length: 1
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-nl
    GET
    http://92.63.197.221/dll/key
    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe
    Remote address:
    92.63.197.221:80
    Request
    GET /dll/key HTTP/1.1
    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
    User-Agent: 1
    Host: 92.63.197.221
    Connection: Keep-Alive
    Cache-Control: no-cache
  • 92.63.197.221:80
    http://92.63.197.221/add?substr=mixtwo&s=three&sub=
    http
    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe
    641 B
    397 B
    5
    5

    HTTP Request

    GET http://92.63.197.221/add?substr=mixtwo&s=three&sub=

    HTTP Response

    500
  • 92.63.197.221:80
    http://92.63.197.221/dll/key
    http
    20aa6407587318875a98f4cc567752a4caffcd46104d7f42c427ad8b10317eab.exe
    977 B
    376 B
    4
    4

    HTTP Request

    GET http://92.63.197.221/add?substr=mixtwo&s=three&sub=

    HTTP Response

    200

    HTTP Request

    GET http://92.63.197.221/dll/key
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2084-0-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-1-0x0000000077C70000-0x0000000077C72000-memory.dmp

    Filesize

    8KB

  • memory/2084-3-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-4-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-2-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/2084-6-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-7-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-8-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-9-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-10-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/2084-11-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-12-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-13-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-14-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-15-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-16-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-17-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-18-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-19-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-20-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-21-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-22-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-23-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-24-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-25-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-26-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

  • memory/2084-27-0x0000000000400000-0x0000000000C5C000-memory.dmp

    Filesize

    8.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.