Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 08:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.3de91843a1ffb33f1849f866c29270a0.exe
Resource
win7-20231023-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.3de91843a1ffb33f1849f866c29270a0.exe
Resource
win10v2004-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.3de91843a1ffb33f1849f866c29270a0.exe
-
Size
37KB
-
MD5
3de91843a1ffb33f1849f866c29270a0
-
SHA1
6bb70a4243d7133a39d3e29132392a156d6a0c0c
-
SHA256
8a5d9fec3cb5abf6604fccd4385d7ec31827dd9c92214f76f848aa0e4e1a8e6d
-
SHA512
c8aec596ebc31c575e29a1ce208c9c00adfec1cc78cf5ebacc6427f494b33ef7b15aaf5744709a4f19800b3cf7de8d52cebab49ba2dd130c0ea06b7ecc781edd
-
SSDEEP
384:tf5zVQ/CRypz2xR5foabZCxRg5M1PmPmGmLIJ+nI8q:95zi/QypCb5foa8yxPZmLICI8q
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" NEAS.3de91843a1ffb33f1849f866c29270a0.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GiGu.eXe NEAS.3de91843a1ffb33f1849f866c29270a0.exe File created C:\Windows\SysWOW64\GiGu.eml NEAS.3de91843a1ffb33f1849f866c29270a0.exe File created C:\Windows\SysWOW64\GiGu.eXe NEAS.3de91843a1ffb33f1849f866c29270a0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe NEAS.3de91843a1ffb33f1849f866c29270a0.exe File opened for modification C:\Windows\uGiG.eXe NEAS.3de91843a1ffb33f1849f866c29270a0.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2188 2368 WerFault.exe 23 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2188 2368 NEAS.3de91843a1ffb33f1849f866c29270a0.exe 28 PID 2368 wrote to memory of 2188 2368 NEAS.3de91843a1ffb33f1849f866c29270a0.exe 28 PID 2368 wrote to memory of 2188 2368 NEAS.3de91843a1ffb33f1849f866c29270a0.exe 28 PID 2368 wrote to memory of 2188 2368 NEAS.3de91843a1ffb33f1849f866c29270a0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3de91843a1ffb33f1849f866c29270a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3de91843a1ffb33f1849f866c29270a0.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 1762⤵
- Program crash
PID:2188
-