Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.14c924f9222154dccbe7d268032d4870_JC.exe
Resource
win7-20230831-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.14c924f9222154dccbe7d268032d4870_JC.exe
Resource
win10v2004-20230915-en
6 signatures
150 seconds
General
-
Target
NEAS.14c924f9222154dccbe7d268032d4870_JC.exe
-
Size
37KB
-
MD5
14c924f9222154dccbe7d268032d4870
-
SHA1
496ba3e159765097ee043e9da135cf9a6f7b349b
-
SHA256
0c9dfd2d2d74505ce53b391d4cd4c3102217765f2dd61bd336263c4bb6cb7acd
-
SHA512
082fb9b3ea8efbe546767001a3cf7820dc0c66e78259f394992564bd1a06e3f6e68c2ad2f273d9621157ba63278fd35000c8c0448c4c9b30cadcf17d8de7d74f
-
SSDEEP
768:bsbTjblUCHt6u2txoKqfBB9x5n7OI8nX:bsflzHrKw94nX
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" NEAS.14c924f9222154dccbe7d268032d4870_JC.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eXe NEAS.14c924f9222154dccbe7d268032d4870_JC.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe NEAS.14c924f9222154dccbe7d268032d4870_JC.exe File created C:\Windows\SysWOW64\GiGu.eml NEAS.14c924f9222154dccbe7d268032d4870_JC.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe NEAS.14c924f9222154dccbe7d268032d4870_JC.exe File opened for modification C:\Windows\uGiG.eXe NEAS.14c924f9222154dccbe7d268032d4870_JC.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1964 924 WerFault.exe 16 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 924 NEAS.14c924f9222154dccbe7d268032d4870_JC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 924 wrote to memory of 1964 924 NEAS.14c924f9222154dccbe7d268032d4870_JC.exe 28 PID 924 wrote to memory of 1964 924 NEAS.14c924f9222154dccbe7d268032d4870_JC.exe 28 PID 924 wrote to memory of 1964 924 NEAS.14c924f9222154dccbe7d268032d4870_JC.exe 28 PID 924 wrote to memory of 1964 924 NEAS.14c924f9222154dccbe7d268032d4870_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.14c924f9222154dccbe7d268032d4870_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.14c924f9222154dccbe7d268032d4870_JC.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 1762⤵
- Program crash
PID:1964
-