Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe
Resource
win10v2004-20240802-en
General
-
Target
baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe
-
Size
672KB
-
MD5
6f445b9923f4a82bfc54309e2caf33c0
-
SHA1
ba4595eddb84752e446c6ad234ac00a3c7731f56
-
SHA256
baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12
-
SHA512
4abd7d524db27736003b468d0635e8e63acd720512524f578f9d614d6cf0f2f78b0d7fb7da6b879b53093f60b5e25604b09c1d7904755e0efe49d773e8387025
-
SSDEEP
3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjmHzW9hUd56JsuBSjwGPmO12i1DzbC:Hha8iAx+1zwjmHd6vB/jO11z0XGW
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe" baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr" baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE" baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\AVSCANNER.EXE baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe File opened for modification C:\Windows\SysWOW64\AVSCANNER.EXE baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe File created C:\Windows\SysWOW64\GAAG.exe baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe File opened for modification C:\Windows\SysWOW64\GAAG.exe baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe File created C:\Windows\SysWOW64\FifefoxUpdater.scr baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe File opened for modification C:\Windows\SysWOW64\FifefoxUpdater.scr baef98f3ed1241d8a7e8681d5bec8b1daab5952d248e58b91d85b6f7ea325c12N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
682KB
MD54df1698876923a346bcf1efec40fcec6
SHA138473aaf80b7e3b9cb464323d632d5c866ed0033
SHA2563e8d7fdffc97ed063c9be5c866c42907a21896b7db509c4cb75414d804ce950b
SHA512a283b0cf3b86428508cc8e68f46318dc730bb4c210e5f0d36e9043f8fa65c8266647f83c78c1a08a2645662caa33f45d0f6bcc255c9f9aeacc39175238cfa226