Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c.exe
Resource
win7-20240903-en
General
-
Target
4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c.exe
-
Size
330KB
-
MD5
6369de51ea2478e96c7cd841ecbf78a5
-
SHA1
45b390a89ffdcdf4f279696213d86e07bbcad134
-
SHA256
4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c
-
SHA512
e9d275224dcee4becf99b0896a01251cecd742ca697085006e0dc905a635213e7720bfe2c94d06e9cea4195e387e616eceed5d04b1c3fbce9db0e6596e63eedc
-
SSDEEP
6144:X0BW/7LEKxj4QYplnWzJzdwvgKimZcMoNtdwn3:kB474KxjtYpZWzkgBm65Nvq3
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
Gcleaner family
-
Program crash 8 IoCs
pid pid_target Process procid_target 3592 3284 WerFault.exe 82 2180 3284 WerFault.exe 82 3080 3284 WerFault.exe 82 2560 3284 WerFault.exe 82 2988 3284 WerFault.exe 82 2804 3284 WerFault.exe 82 4896 3284 WerFault.exe 82 5112 3284 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3284 4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c.exe"C:\Users\Admin\AppData\Local\Temp\4e2fbcee0db3907cfc3b65d0adc9ec67dbb5f0229b0ba2c75f38453d605cc91c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 4522⤵
- Program crash
PID:3592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 7642⤵
- Program crash
PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 8042⤵
- Program crash
PID:3080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 8042⤵
- Program crash
PID:2560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 7642⤵
- Program crash
PID:2988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 9282⤵
- Program crash
PID:2804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 10042⤵
- Program crash
PID:4896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 7682⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3284 -ip 32841⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3284 -ip 32841⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3284 -ip 32841⤵PID:4560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3284 -ip 32841⤵PID:1112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3284 -ip 32841⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3284 -ip 32841⤵PID:4244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3284 -ip 32841⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3284 -ip 32841⤵PID:2120