Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/12/2024, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da.exe
Resource
win7-20240903-en
General
-
Target
f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da.exe
-
Size
329KB
-
MD5
11384252b8279a1256194fb56b9ea9f9
-
SHA1
a4500cdb459a1f893c5b92627dcb23312362809b
-
SHA256
f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da
-
SHA512
4900b377f99cf05afcb4210799a967d22ca1638fdcb28c8f33838070f52bd0f32d285f42d454a69b85d546386c4b1edd5739c1efb496e3b259921a68191d92ae
-
SSDEEP
3072:GXOW8eDHPKpe7LtX2jD7n5u1raKjpb2yc4o9GAZZmlEG9mIy4/xm42K0w26jsM/z:u3HP+e7L+Der/9Kyc4oZZmdmu/x0wq8
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
Gcleaner family
-
Program crash 8 IoCs
pid pid_target Process procid_target 3092 1456 WerFault.exe 81 4704 1456 WerFault.exe 81 4736 1456 WerFault.exe 81 1124 1456 WerFault.exe 81 1140 1456 WerFault.exe 81 1896 1456 WerFault.exe 81 3212 1456 WerFault.exe 81 4056 1456 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1456 f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da.exe"C:\Users\Admin\AppData\Local\Temp\f1470d0bd0bd2a5ff0199ec3ef48b776a01a7961651d081b4b1f247b695466da.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 4602⤵
- Program crash
PID:3092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 7642⤵
- Program crash
PID:4704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 7842⤵
- Program crash
PID:4736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 7842⤵
- Program crash
PID:1124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 8042⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 9282⤵
- Program crash
PID:1896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 9322⤵
- Program crash
PID:3212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 7682⤵
- Program crash
PID:4056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1456 -ip 14561⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1456 -ip 14561⤵PID:3124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1456 -ip 14561⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1456 -ip 14561⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1456 -ip 14561⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1456 -ip 14561⤵PID:4224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1456 -ip 14561⤵PID:3612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1456 -ip 14561⤵PID:4860