Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
31/10/2023, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe
-
Size
37KB
-
MD5
c2f27ae6c87643b2b7f11a28acba7a30
-
SHA1
310acd1aff1687a7dd3693344eaca70d6546b21c
-
SHA256
5730f0fc5c86d44820cf604d3a6f17266e74109718dce0302a8d5adf92b6a12a
-
SHA512
fef2ca5385a5b447420dd01900795875b0b104b4de860931e55d64d71809ad906b64522dc0b378036372b3a61bb75d40a412a08cdf0bce020a98820e589f0c1a
-
SSDEEP
384:4x/lbQJ5h+LBCCfnewrDZBuRWBNIBWJJkNMHvYHfgc9R81YN6HJnI89Cyb:c/ZQ602ekDZB4WBNI4J/Wgc01dI84y
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eXe NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe File created C:\Windows\SysWOW64\GiGu.eml NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe File opened for modification C:\Windows\uGiG.eXe NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3068 1632 WerFault.exe 20 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 3068 1632 NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe 28 PID 1632 wrote to memory of 3068 1632 NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe 28 PID 1632 wrote to memory of 3068 1632 NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe 28 PID 1632 wrote to memory of 3068 1632 NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 1762⤵
- Program crash
PID:3068
-