Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
023691895a5916d7670864f952b90a60N.exe
Resource
win7-20240705-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
023691895a5916d7670864f952b90a60N.exe
Resource
win10v2004-20240704-en
6 signatures
150 seconds
General
-
Target
023691895a5916d7670864f952b90a60N.exe
-
Size
37KB
-
MD5
023691895a5916d7670864f952b90a60
-
SHA1
af952fb62facd334495d3027c12738acc2373e13
-
SHA256
31432fbd7e85846f2d8f61cc70d2cc4c57e63d37174e591833c5833ba084810e
-
SHA512
c422ebfad22a034d9140fc7b63c298d6a95bfd4c38d62ddbcf0d2c6a7b820956e37fba99538a0b451c8023f7823bbdd812aa206d2a5bb6b62a6e05f936a7def4
-
SSDEEP
768:0/zXu6t51XJ8icoZgzPmHt42V/c0+yLbbBiI8:OzXuyj3CPxfybBY
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" 023691895a5916d7670864f952b90a60N.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eml 023691895a5916d7670864f952b90a60N.exe File created C:\Windows\SysWOW64\GiGu.eXe 023691895a5916d7670864f952b90a60N.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe 023691895a5916d7670864f952b90a60N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe 023691895a5916d7670864f952b90a60N.exe File opened for modification C:\Windows\uGiG.eXe 023691895a5916d7670864f952b90a60N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2144 3048 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2144 3048 023691895a5916d7670864f952b90a60N.exe 30 PID 3048 wrote to memory of 2144 3048 023691895a5916d7670864f952b90a60N.exe 30 PID 3048 wrote to memory of 2144 3048 023691895a5916d7670864f952b90a60N.exe 30 PID 3048 wrote to memory of 2144 3048 023691895a5916d7670864f952b90a60N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\023691895a5916d7670864f952b90a60N.exe"C:\Users\Admin\AppData\Local\Temp\023691895a5916d7670864f952b90a60N.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1762⤵
- Program crash
PID:2144
-