Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe
-
Size
850KB
-
MD5
aac68aaf7e423d7a87ce6e97b397b2d9
-
SHA1
4733d5b2698fa17676722a293c9cbd4332314df9
-
SHA256
dcdd7927934f88e4735f3d42fbcaa1207cdf988760ed0477365ade6cc99d0168
-
SHA512
d945da95fd99b0149679e4fab5b403f82b1a7c28a098c412e837239a7db6e1cebabc4658ccfe1333524d9ab7363c18969b91141ea750ac5cc95982dd209bacc1
-
SSDEEP
3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjw75W6vfH2i1wB:Hha8iAx+1zwjJHd6vB/75W6XmVIOI
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE" aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe" aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr" aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\AVSCANNER.EXE aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe File created C:\Windows\SysWOW64\GAAG.exe aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe File opened for modification C:\Windows\SysWOW64\GAAG.exe aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe File created C:\Windows\SysWOW64\FifefoxUpdater.scr aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe File opened for modification C:\Windows\SysWOW64\FifefoxUpdater.scr aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe File created C:\Windows\SysWOW64\AVSCANNER.EXE aac68aaf7e423d7a87ce6e97b397b2d9_JC.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
MD507ae97ec33cec0e868cb67680b193a8f
SHA1f764525d8897df1f8c5900cb5d71378a591aaf8b
SHA256569e1720534dc48c371c79f82b4eb3128a7ad82a37794d41d974b1058cafa180
SHA512d2f26db68b79b2d5e2290c1fc72b9a5f91baeb074c866b7d3819205d225a12d25e942f9007f8a1c222cded32d23166f6a774c50a3930649427ba637301a8fb72