Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c325cee3f9b498ebb58368772124a80.exe
Resource
win7-20231020-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c325cee3f9b498ebb58368772124a80.exe
Resource
win10v2004-20231020-en
6 signatures
150 seconds
General
-
Target
5c325cee3f9b498ebb58368772124a80.exe
-
Size
37KB
-
MD5
5c325cee3f9b498ebb58368772124a80
-
SHA1
d5ef0d2717e49979642d54997795f19744b5eec0
-
SHA256
10a8e1c15fa361be35bf0e16c7372aa7e873b7fa252ac5c6dcdd84f96e53221b
-
SHA512
5bccb28d1cf2f88990420bbfb32b66237cf9e7c368c14d9930925fb4b68eb6109bd03a9ebd7a48ce1cdebd3ae2d3b28fbee86f647316d051dc061b40752f0df3
-
SSDEEP
384:8fjWiErk7Hw/5LYou/bQPpsm8U9dfmH97nI8Pc5:8WiEg7QhLYrQsJAmdDI8Pc
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" 5c325cee3f9b498ebb58368772124a80.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eml 5c325cee3f9b498ebb58368772124a80.exe File created C:\Windows\SysWOW64\GiGu.eXe 5c325cee3f9b498ebb58368772124a80.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe 5c325cee3f9b498ebb58368772124a80.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe 5c325cee3f9b498ebb58368772124a80.exe File opened for modification C:\Windows\uGiG.eXe 5c325cee3f9b498ebb58368772124a80.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2884 2024 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe 2024 5c325cee3f9b498ebb58368772124a80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c325cee3f9b498ebb58368772124a80.exe"C:\Users\Admin\AppData\Local\Temp\5c325cee3f9b498ebb58368772124a80.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 5242⤵
- Program crash
PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2024 -ip 20241⤵PID:3844