Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979.exe
Resource
win7-20240903-en
General
-
Target
0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979.exe
-
Size
335KB
-
MD5
13e4fddd6b99ec63502a7c7ef0305c31
-
SHA1
5514a46109d5055468f556982d3ef8eec4972468
-
SHA256
0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979
-
SHA512
73f91303587413e10a0a952552cba8ad006d2d10e9cff9b66724be63e3c8f3fcf6cdb3d5476a4027dc64c7cb6071612dc41d1b1b81a31b100541777b101e891f
-
SSDEEP
6144:Xk5nmc05lZphh2zBp0DpSRQ02GTts/KoyBuqa48igafwVf:X7cslZp2ciih4Z
Malware Config
Extracted
gcleaner
45.141.237.38
31.210.20.149
212.192.241.16
203.159.80.49
-
url_path
/software.php
/software.php
Signatures
-
Gcleaner family
-
Program crash 9 IoCs
pid pid_target Process procid_target 4572 4512 WerFault.exe 81 2592 4512 WerFault.exe 81 5052 4512 WerFault.exe 81 1804 4512 WerFault.exe 81 1480 4512 WerFault.exe 81 408 4512 WerFault.exe 81 3204 4512 WerFault.exe 81 3020 4512 WerFault.exe 81 768 4512 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4512 0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979.exe"C:\Users\Admin\AppData\Local\Temp\0312676b0a8a4594da2ba4a13675ce3ae5855d3e166bf86d2688a6679ab1c979.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 4402⤵
- Program crash
PID:4572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 7642⤵
- Program crash
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 7962⤵
- Program crash
PID:5052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 8162⤵
- Program crash
PID:1804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 8362⤵
- Program crash
PID:1480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 9282⤵
- Program crash
PID:408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 10042⤵
- Program crash
PID:3204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 11082⤵
- Program crash
PID:3020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 7682⤵
- Program crash
PID:768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4512 -ip 45121⤵PID:3496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4512 -ip 45121⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4512 -ip 45121⤵PID:4592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4512 -ip 45121⤵PID:3608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4512 -ip 45121⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4512 -ip 45121⤵PID:1128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4512 -ip 45121⤵PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4512 -ip 45121⤵PID:32
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4512 -ip 45121⤵PID:1840