Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
02/11/2023, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c325cee3f9b498ebb58368772124a80.exe
Resource
win7-20231020-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c325cee3f9b498ebb58368772124a80.exe
Resource
win10v2004-20231020-en
6 signatures
150 seconds
General
-
Target
5c325cee3f9b498ebb58368772124a80.exe
-
Size
37KB
-
MD5
5c325cee3f9b498ebb58368772124a80
-
SHA1
d5ef0d2717e49979642d54997795f19744b5eec0
-
SHA256
10a8e1c15fa361be35bf0e16c7372aa7e873b7fa252ac5c6dcdd84f96e53221b
-
SHA512
5bccb28d1cf2f88990420bbfb32b66237cf9e7c368c14d9930925fb4b68eb6109bd03a9ebd7a48ce1cdebd3ae2d3b28fbee86f647316d051dc061b40752f0df3
-
SSDEEP
384:8fjWiErk7Hw/5LYou/bQPpsm8U9dfmH97nI8Pc5:8WiEg7QhLYrQsJAmdDI8Pc
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" 5c325cee3f9b498ebb58368772124a80.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eXe 5c325cee3f9b498ebb58368772124a80.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe 5c325cee3f9b498ebb58368772124a80.exe File created C:\Windows\SysWOW64\GiGu.eml 5c325cee3f9b498ebb58368772124a80.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe 5c325cee3f9b498ebb58368772124a80.exe File opened for modification C:\Windows\uGiG.eXe 5c325cee3f9b498ebb58368772124a80.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2796 2056 WerFault.exe 16 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2796 2056 5c325cee3f9b498ebb58368772124a80.exe 27 PID 2056 wrote to memory of 2796 2056 5c325cee3f9b498ebb58368772124a80.exe 27 PID 2056 wrote to memory of 2796 2056 5c325cee3f9b498ebb58368772124a80.exe 27 PID 2056 wrote to memory of 2796 2056 5c325cee3f9b498ebb58368772124a80.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c325cee3f9b498ebb58368772124a80.exe"C:\Users\Admin\AppData\Local\Temp\5c325cee3f9b498ebb58368772124a80.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1762⤵
- Program crash
PID:2796
-