Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22b7d0a1007c21e4950728d00c4b2e42.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
22b7d0a1007c21e4950728d00c4b2e42.exe
Resource
win10v2004-20231201-en
0 signatures
150 seconds
General
-
Target
22b7d0a1007c21e4950728d00c4b2e42.exe
-
Size
37KB
-
MD5
22b7d0a1007c21e4950728d00c4b2e42
-
SHA1
4f6e27c4b459002cdd3546e1fbed2131318fa754
-
SHA256
5bdefc69ef69bf2ee1f01e57f1c6f6a8d50b3bd7af69bc75ebd302320f0d045b
-
SHA512
940d07d05eba8593a0eff84ff1887f6daa86b7de480ae6986fd2f251a290d67b55ad66aac000b732a19814f5b0af172c72bd4e0ca5727e159a6e846475a5c326
-
SSDEEP
384:lorhaQoJZudfOqCMO/t9MMHEOduDiANbnY8knC4EyinI8o2ux4U:loNo7Af3hOjMTOduDiAjPkn6jI8H64
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" 22b7d0a1007c21e4950728d00c4b2e42.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eXe 22b7d0a1007c21e4950728d00c4b2e42.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe 22b7d0a1007c21e4950728d00c4b2e42.exe File created C:\Windows\SysWOW64\GiGu.eml 22b7d0a1007c21e4950728d00c4b2e42.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe 22b7d0a1007c21e4950728d00c4b2e42.exe File opened for modification C:\Windows\uGiG.eXe 22b7d0a1007c21e4950728d00c4b2e42.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2156 1220 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1220 wrote to memory of 2156 1220 22b7d0a1007c21e4950728d00c4b2e42.exe 28 PID 1220 wrote to memory of 2156 1220 22b7d0a1007c21e4950728d00c4b2e42.exe 28 PID 1220 wrote to memory of 2156 1220 22b7d0a1007c21e4950728d00c4b2e42.exe 28 PID 1220 wrote to memory of 2156 1220 22b7d0a1007c21e4950728d00c4b2e42.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\22b7d0a1007c21e4950728d00c4b2e42.exe"C:\Users\Admin\AppData\Local\Temp\22b7d0a1007c21e4950728d00c4b2e42.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 1762⤵
- Program crash
PID:2156
-