Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
31/07/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
5d4c27d2f4c9f70f4b9c568c2492da00N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d4c27d2f4c9f70f4b9c568c2492da00N.exe
Resource
win10v2004-20240730-en
General
-
Target
5d4c27d2f4c9f70f4b9c568c2492da00N.exe
-
Size
37KB
-
MD5
5d4c27d2f4c9f70f4b9c568c2492da00
-
SHA1
d342e651eeb4e3254d0307db74bf6d2e2a4dc11f
-
SHA256
4128f280d07d779023b837d8b2cfcf603858a4a5484d60807ebdc086b250638a
-
SHA512
7b16dd70a5ecb670235152d6ad3734ad02031ec719d97f08342dec40b57c90f337a14329196c938f670c94cbbb8ae46cd9693a13c54d7b30b3b84815d466bb17
-
SSDEEP
384:d+iQTHnIGeHL4L8t3NHizczo0SHWNbdj/qb5IS9Dwv335cnI8T3:AiOHM4L+UF2NhYRuv335uI8T3
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" 5d4c27d2f4c9f70f4b9c568c2492da00N.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\GiGu.eXe 5d4c27d2f4c9f70f4b9c568c2492da00N.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe 5d4c27d2f4c9f70f4b9c568c2492da00N.exe File created C:\Windows\SysWOW64\GiGu.eml 5d4c27d2f4c9f70f4b9c568c2492da00N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uGiG.eXe 5d4c27d2f4c9f70f4b9c568c2492da00N.exe File opened for modification C:\Windows\uGiG.eXe 5d4c27d2f4c9f70f4b9c568c2492da00N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2732 1820 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d4c27d2f4c9f70f4b9c568c2492da00N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2732 1820 5d4c27d2f4c9f70f4b9c568c2492da00N.exe 29 PID 1820 wrote to memory of 2732 1820 5d4c27d2f4c9f70f4b9c568c2492da00N.exe 29 PID 1820 wrote to memory of 2732 1820 5d4c27d2f4c9f70f4b9c568c2492da00N.exe 29 PID 1820 wrote to memory of 2732 1820 5d4c27d2f4c9f70f4b9c568c2492da00N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d4c27d2f4c9f70f4b9c568c2492da00N.exe"C:\Users\Admin\AppData\Local\Temp\5d4c27d2f4c9f70f4b9c568c2492da00N.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 1762⤵
- Program crash
PID:2732
-