Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 04:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.6446db187cac1f1d85613de3f51b9630.exe
Resource
win7-20231025-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.6446db187cac1f1d85613de3f51b9630.exe
Resource
win10v2004-20231023-en
6 signatures
150 seconds
General
-
Target
NEAS.6446db187cac1f1d85613de3f51b9630.exe
-
Size
37KB
-
MD5
6446db187cac1f1d85613de3f51b9630
-
SHA1
fc2c4e6f65e10091ad5c9fc3e68a18be674dfaf7
-
SHA256
2d2f738a252fc7ca55e4db393de5929eef564e46016f7fc7c9c95ce7d2e78784
-
SHA512
42f205d87ab5d9f8b8ba53cd8c593bee90a6fd6ef1cec5fe35b8142dff34de8ead6a359c2b75abb4456662b3b56ad9b89a25c101424e71751ebf55cc35a8fd6e
-
SSDEEP
384:glmkiuv7xlgiJjlTnJXHJfIZbceD2gYFpkv0vnMh60y2HnnYnI8Gjv:glmkiuz4iJjlTJXi+HtvMByhI8G7
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" NEAS.6446db187cac1f1d85613de3f51b9630.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GiGu.eXe NEAS.6446db187cac1f1d85613de3f51b9630.exe File created C:\Windows\SysWOW64\GiGu.eml NEAS.6446db187cac1f1d85613de3f51b9630.exe File created C:\Windows\SysWOW64\GiGu.eXe NEAS.6446db187cac1f1d85613de3f51b9630.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\uGiG.eXe NEAS.6446db187cac1f1d85613de3f51b9630.exe File created C:\Windows\uGiG.eXe NEAS.6446db187cac1f1d85613de3f51b9630.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 884 2972 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 884 2972 NEAS.6446db187cac1f1d85613de3f51b9630.exe 28 PID 2972 wrote to memory of 884 2972 NEAS.6446db187cac1f1d85613de3f51b9630.exe 28 PID 2972 wrote to memory of 884 2972 NEAS.6446db187cac1f1d85613de3f51b9630.exe 28 PID 2972 wrote to memory of 884 2972 NEAS.6446db187cac1f1d85613de3f51b9630.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6446db187cac1f1d85613de3f51b9630.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6446db187cac1f1d85613de3f51b9630.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 1762⤵
- Program crash
PID:884
-