Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 06:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe
-
Size
227KB
-
MD5
c01b5c7c2ef1ffe3481e4b4c3f3e50a4
-
SHA1
0a9dc603ed0dda03d0e45cd3fa06e9105f86719c
-
SHA256
690dd94889b4f313ef4ac0b6ef9f5dc5f0728f34092b65ee68e61bd10af48a53
-
SHA512
16ae4363211ee19e84b34fb84750217d26e9452c1de364dbe4a4d0f0abbbfce36f3a7093a922ad81bda27e27f68d8eae1b7e9cc25046df6aaa4d8a01d35134a3
-
SSDEEP
3072:DA3j1PgpirbVPkaCoYvpgJzoK/K4UWWhyeHQZ9skJN+99ybrG53ZY3gz:YhPYirbVPFCoYBU/K9Jpk9R3S3a3e
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 12 IoCs
pid Process 3924 c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe 2028 liadbcbxoku.exe 4888 tyiv.exe 4344 tken.exe 5000 qgpptb.exe 3772 aezyivptmao.exe 1404 owikbm.exe 2528 ruxhuxnbcy.exe 4168 cxzjsy.exe 4768 lxpcloupwfc.exe 4380 aaxcar.exe 2412 vdehw.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3924 wrote to memory of 2028 3924 c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe 99 PID 3924 wrote to memory of 2028 3924 c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe 99 PID 3924 wrote to memory of 2028 3924 c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe 99 PID 2028 wrote to memory of 4888 2028 liadbcbxoku.exe 101 PID 2028 wrote to memory of 4888 2028 liadbcbxoku.exe 101 PID 2028 wrote to memory of 4888 2028 liadbcbxoku.exe 101 PID 4888 wrote to memory of 4344 4888 tyiv.exe 104 PID 4888 wrote to memory of 4344 4888 tyiv.exe 104 PID 4888 wrote to memory of 4344 4888 tyiv.exe 104 PID 4344 wrote to memory of 5000 4344 tken.exe 105 PID 4344 wrote to memory of 5000 4344 tken.exe 105 PID 4344 wrote to memory of 5000 4344 tken.exe 105 PID 5000 wrote to memory of 3772 5000 qgpptb.exe 106 PID 5000 wrote to memory of 3772 5000 qgpptb.exe 106 PID 5000 wrote to memory of 3772 5000 qgpptb.exe 106 PID 3772 wrote to memory of 1404 3772 aezyivptmao.exe 108 PID 3772 wrote to memory of 1404 3772 aezyivptmao.exe 108 PID 3772 wrote to memory of 1404 3772 aezyivptmao.exe 108 PID 1404 wrote to memory of 2528 1404 owikbm.exe 109 PID 1404 wrote to memory of 2528 1404 owikbm.exe 109 PID 1404 wrote to memory of 2528 1404 owikbm.exe 109 PID 2528 wrote to memory of 4168 2528 ruxhuxnbcy.exe 110 PID 2528 wrote to memory of 4168 2528 ruxhuxnbcy.exe 110 PID 2528 wrote to memory of 4168 2528 ruxhuxnbcy.exe 110 PID 4168 wrote to memory of 4768 4168 cxzjsy.exe 119 PID 4168 wrote to memory of 4768 4168 cxzjsy.exe 119 PID 4168 wrote to memory of 4768 4168 cxzjsy.exe 119 PID 4768 wrote to memory of 4380 4768 lxpcloupwfc.exe 120 PID 4768 wrote to memory of 4380 4768 lxpcloupwfc.exe 120 PID 4768 wrote to memory of 4380 4768 lxpcloupwfc.exe 120 PID 4380 wrote to memory of 2412 4380 aaxcar.exe 121 PID 4380 wrote to memory of 2412 4380 aaxcar.exe 121 PID 4380 wrote to memory of 2412 4380 aaxcar.exe 121 PID 2412 wrote to memory of 3088 2412 vdehw.exe 125 PID 2412 wrote to memory of 3088 2412 vdehw.exe 125 PID 2412 wrote to memory of 3088 2412 vdehw.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe"C:\Users\Admin\AppData\Local\Temp\c01b5c7c2ef1ffe3481e4b4c3f3e50a4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\liadbcbxoku.exeC:\Windows\system32\liadbcbxoku.exe2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\tyiv.exeC:\Windows\system32\tyiv.exe3⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\tken.exeC:\Windows\system32\tken.exe4⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\qgpptb.exeC:\Windows\system32\qgpptb.exe5⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\aezyivptmao.exeC:\Windows\system32\aezyivptmao.exe6⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\owikbm.exeC:\Windows\system32\owikbm.exe7⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\ruxhuxnbcy.exeC:\Windows\system32\ruxhuxnbcy.exe8⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cxzjsy.exeC:\Windows\system32\cxzjsy.exe9⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\lxpcloupwfc.exeC:\Windows\system32\lxpcloupwfc.exe10⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\aaxcar.exeC:\Windows\system32\aaxcar.exe11⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\vdehw.exeC:\Windows\system32\vdehw.exe12⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\akasxsztqzfha.exeC:\Windows\system32\akasxsztqzfha.exe13⤵PID:3088
-
-
-
-
-
-
-
-
-
-
-
-