Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 20:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.7z
Resource
win10v2004-20250217-en
windows10-2004-x64
18 signatures
120 seconds
General
-
Target
HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.7z
-
Size
252KB
-
MD5
72d78b59ad0456c64a76fa91a1c084e3
-
SHA1
c53539a0abf85c3df78a7f877609bf053ea2d466
-
SHA256
59bba11d5069ab5d7eb810cd75c59da534c97fa565428dff4ed8341b6e65a3ae
-
SHA512
ae84f6e00b55735319ad59651e7c87e928562ec4299786c748cc7bb15f071f0c748956dbde3df804ab1e7197365e7bc8e7986c03129f95a45d8e42f5dadadb55
-
SSDEEP
6144:fzQoKDUrMj+xSH78PB9dNKmCcxES227kRUYTgZLTok3DRrxevC:0o2UrMawbaBUXcxE/Q2U+gLTok3y6
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
gcl-gb.biz
45.9.20.13
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 1 IoCs
resource yara_rule behavioral1/memory/2544-32-0x0000000000400000-0x000000000089E000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe -
Executes dropped EXE 1 IoCs
pid Process 2544 HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 848 2544 WerFault.exe 100 4668 2544 WerFault.exe 100 1092 2544 WerFault.exe 100 3688 2544 WerFault.exe 100 3564 2544 WerFault.exe 100 3572 2544 WerFault.exe 100 2412 2544 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Kills process with taskkill 1 IoCs
pid Process 3192 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1108 7zFM.exe 4028 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeRestorePrivilege 1108 7zFM.exe Token: 35 1108 7zFM.exe Token: SeSecurityPrivilege 1108 7zFM.exe Token: SeDebugPrivilege 4672 taskmgr.exe Token: SeSystemProfilePrivilege 4672 taskmgr.exe Token: SeCreateGlobalPrivilege 4672 taskmgr.exe Token: SeDebugPrivilege 4028 taskmgr.exe Token: SeSystemProfilePrivilege 4028 taskmgr.exe Token: SeCreateGlobalPrivilege 4028 taskmgr.exe Token: 33 4672 taskmgr.exe Token: SeIncBasePriorityPrivilege 4672 taskmgr.exe Token: SeDebugPrivilege 3192 taskkill.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1108 7zFM.exe 1108 7zFM.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4672 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe 4028 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4672 wrote to memory of 4028 4672 taskmgr.exe 99 PID 4672 wrote to memory of 4028 4672 taskmgr.exe 99 PID 2544 wrote to memory of 2008 2544 HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe 115 PID 2544 wrote to memory of 2008 2544 HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe 115 PID 2544 wrote to memory of 2008 2544 HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe 115 PID 2008 wrote to memory of 3192 2008 cmd.exe 118 PID 2008 wrote to memory of 3192 2008 cmd.exe 118 PID 2008 wrote to memory of 3192 2008 cmd.exe 118
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1108
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4028
-
-
C:\Users\Admin\Desktop\HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe"C:\Users\Admin\Desktop\HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 7362⤵
- Program crash
PID:848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 7722⤵
- Program crash
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 9322⤵
- Program crash
PID:1092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 9682⤵
- Program crash
PID:3688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 9682⤵
- Program crash
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 10002⤵
- Program crash
PID:3572
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe" /f & erase "C:\Users\Admin\Desktop\HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 7282⤵
- Program crash
PID:2412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2544 -ip 25441⤵PID:4152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2544 -ip 25441⤵PID:3616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2544 -ip 25441⤵PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2544 -ip 25441⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2544 -ip 25441⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2544 -ip 25441⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2544 -ip 25441⤵PID:2524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
C:\Users\Admin\Desktop\HEUR-Trojan-Downloader.Win32.Upatre.gen-431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6.exe
Filesize444KB
MD5618b9c37470513652fcee22a118b31bd
SHA1db1ef92f18adcdbdb7a7e41a3942b7bd47adac3d
SHA256431da2bfead5da6bfa24bf8ecd9a43863ff06f0ea5cf76f330d7359ade0b23b6
SHA51225ca82f50c2df6fa23c588f0e1e5f98ceb85463f41729ce029b44ed46eeeb7057cfbe2ee38246fc5b9f4d4604dab55ea3dc2553c42195747fb55ea9db9632ab2