Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c.exe
Resource
win7-20241010-en
General
-
Target
efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c.exe
-
Size
245KB
-
MD5
0464dd5d358b76b610b3ad11fee7f12a
-
SHA1
d89803856515ee3c265321e294dd5a2195b869fb
-
SHA256
efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c
-
SHA512
d9163d7e94a040b4bfca65832be9c640a58afdd8367d2d51672ac9009a6c35c01e388f2863ef784e42cf4d32dbf3575bd9210e78db78f4b9a10c49dc81f9d5e2
-
SSDEEP
6144:w6QA1GjOfUFEz/gShmUV934m832FWNXVoky:6/REz/FDbhw0N
Malware Config
Extracted
gcleaner
208.67.104.97
85.31.46.167
107.182.129.235
171.22.30.106
Signatures
-
Gcleaner family
-
Program crash 9 IoCs
pid pid_target Process procid_target 1868 1792 WerFault.exe 83 2260 1792 WerFault.exe 83 1596 1792 WerFault.exe 83 3332 1792 WerFault.exe 83 4796 1792 WerFault.exe 83 5056 1792 WerFault.exe 83 1580 1792 WerFault.exe 83 4932 1792 WerFault.exe 83 5000 1792 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1792 efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c.exe"C:\Users\Admin\AppData\Local\Temp\efe0742345c9ba2a1ea7077966b34c3ef14010415b4d8158d41b84487f07e78c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 4642⤵
- Program crash
PID:1868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 7642⤵
- Program crash
PID:2260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8042⤵
- Program crash
PID:1596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8042⤵
- Program crash
PID:3332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 8362⤵
- Program crash
PID:4796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 9282⤵
- Program crash
PID:5056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 10202⤵
- Program crash
PID:1580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 10882⤵
- Program crash
PID:4932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 12282⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1792 -ip 17921⤵PID:3648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1792 -ip 17921⤵PID:2560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1792 -ip 17921⤵PID:3696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1792 -ip 17921⤵PID:4284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1792 -ip 17921⤵PID:452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1792 -ip 17921⤵PID:1260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1792 -ip 17921⤵PID:1372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1792 -ip 17921⤵PID:4896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1792 -ip 17921⤵PID:3776