Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0cef008dd1a97bd1c1215cdadfb6be3a.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0cef008dd1a97bd1c1215cdadfb6be3a.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
0cef008dd1a97bd1c1215cdadfb6be3a.exe
-
Size
47KB
-
MD5
0cef008dd1a97bd1c1215cdadfb6be3a
-
SHA1
0c5704c392d34220b9788110627cc55afcc9c33f
-
SHA256
2602572a4796a821b4e34c006db92a38b8de312e5c2f447a9a11b2061fd24101
-
SHA512
94e29ae15ff3eb07770743dfcc3f5cf55122c22bce61d6b1c747304d6893231614f40af2cee05c0d07717f60a989416986f066701badd4f568da158c7dbf0ab6
-
SSDEEP
768:3gdS9lYkqLiul1LroiVUcfS3hufoqHd7ypJtk13:3gdCeLiq1LhVUw+YfZdiJe
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gaFAi50yDt = "C:\\ProgramData\\whujqnor\\qzghapsp.exe" qzghapsp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run qzghapsp.exe -
Executes dropped EXE 1 IoCs
pid Process 2416 qzghapsp.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1136 wrote to memory of 2416 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe 105 PID 1136 wrote to memory of 2416 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe 105 PID 1136 wrote to memory of 2416 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe 105 PID 1136 wrote to memory of 1132 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe 104 PID 1136 wrote to memory of 1132 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe 104 PID 1136 wrote to memory of 1132 1136 0cef008dd1a97bd1c1215cdadfb6be3a.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cef008dd1a97bd1c1215cdadfb6be3a.exe"C:\Users\Admin\AppData\Local\Temp\0cef008dd1a97bd1c1215cdadfb6be3a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exe/c del /f C:\Users\Admin\AppData\Local\Temp\0CEF00~1.EXE.bak >> NUL2⤵PID:1132
-
-
C:\ProgramData\whujqnor\qzghapsp.exeC:\ProgramData\whujqnor\qzghapsp.exe2⤵
- Adds policy Run key to start application
- Executes dropped EXE
PID:2416
-