Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 08:51

General

  • Target

    8355ecc5bf7aaff778180863fee588adf6fdc1cb12062c021109a1ec1f130b34.exe

  • Size

    611KB

  • MD5

    cc65b79bc0887658e9c592071bf8cb91

  • SHA1

    a45592c19ed3c8579972c7c7e19ba01af2894348

  • SHA256

    8355ecc5bf7aaff778180863fee588adf6fdc1cb12062c021109a1ec1f130b34

  • SHA512

    0f0155a099487c91485b1df911fdbc4ae00fbbcd9ce48954daffadfe72247dc3d1f1af58d41081216a8977f43d277eb6578d8d4f04dceae32a361168c288b719

  • SSDEEP

    6144:4iBZTVvvVDzRW1BHH3g1NWT+AKYEM+gW4SmSMX0zCVsVwX+v456/Z9ZGoaEKwa/W:4AZTVXFRW1ZpK2bNV0Cgwu/ZGmkAh

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

RAT

C2

23.105.131.178:7812

Mutex

VNM_MUTEX_It9SqdFDNndEItXfKp

Attributes
  • encryption_key

    txgQXKaATimN7DY8jnPH

  • install_name

    Windows Defender Security.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    Microsoft

Signatures

  • Contains code to disable Windows Defender 6 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 6 IoCs
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8355ecc5bf7aaff778180863fee588adf6fdc1cb12062c021109a1ec1f130b34.exe
    "C:\Users\Admin\AppData\Local\Temp\8355ecc5bf7aaff778180863fee588adf6fdc1cb12062c021109a1ec1f130b34.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Checks computer location settings
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4768
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:3332
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
          4⤵
            PID:3652
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\63QINACbFgAU.bat" "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4532
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:2112
            • C:\Windows\SysWOW64\PING.EXE
              ping -n 10 localhost
              4⤵
              • Runs ping.exe
              PID:1164
            • C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe
              "C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1124

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Defender Security.exe.log

        Filesize

        1KB

        MD5

        10eab9c2684febb5327b6976f2047587

        SHA1

        a12ed54146a7f5c4c580416aecb899549712449e

        SHA256

        f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

        SHA512

        7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

      • C:\Users\Admin\AppData\Local\Temp\63QINACbFgAU.bat

        Filesize

        219B

        MD5

        99d2674d26c25908b5cd64b0588f002f

        SHA1

        b6ab6965a606862767ea9afd22c412000dd18995

        SHA256

        948a2cf3f68af806a18a49bab1143fc84671fe10047444dfedf84b173720c43a

        SHA512

        7d11ad1cdcbf8eb1044aeab7b5a058ac76127c55a7c06067b2d4a1ca56fd2389cc9cbeea5bb8bce6ad200482a4a1ca8a4bd56e99c5df8f45eeffd9958621ad81

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe

        Filesize

        535KB

        MD5

        0bd3018c9c566328497be54c7d882159

        SHA1

        8d90c23ee373ab935ba930f25c96374762c4a5a6

        SHA256

        026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

        SHA512

        90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe

        Filesize

        535KB

        MD5

        0bd3018c9c566328497be54c7d882159

        SHA1

        8d90c23ee373ab935ba930f25c96374762c4a5a6

        SHA256

        026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

        SHA512

        90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

      • C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

        Filesize

        535KB

        MD5

        0bd3018c9c566328497be54c7d882159

        SHA1

        8d90c23ee373ab935ba930f25c96374762c4a5a6

        SHA256

        026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

        SHA512

        90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

      • C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

        Filesize

        535KB

        MD5

        0bd3018c9c566328497be54c7d882159

        SHA1

        8d90c23ee373ab935ba930f25c96374762c4a5a6

        SHA256

        026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

        SHA512

        90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

      • C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

        Filesize

        535KB

        MD5

        0bd3018c9c566328497be54c7d882159

        SHA1

        8d90c23ee373ab935ba930f25c96374762c4a5a6

        SHA256

        026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

        SHA512

        90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

      • memory/1068-162-0x00000000071D0000-0x00000000071D8000-memory.dmp

        Filesize

        32KB

      • memory/1068-156-0x00000000074F0000-0x0000000007B6A000-memory.dmp

        Filesize

        6.5MB

      • memory/1068-161-0x00000000071F0000-0x000000000720A000-memory.dmp

        Filesize

        104KB

      • memory/1068-160-0x00000000070E0000-0x00000000070EE000-memory.dmp

        Filesize

        56KB

      • memory/1068-159-0x0000000007130000-0x00000000071C6000-memory.dmp

        Filesize

        600KB

      • memory/1068-158-0x0000000006F20000-0x0000000006F2A000-memory.dmp

        Filesize

        40KB

      • memory/1068-157-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

        Filesize

        104KB

      • memory/1068-155-0x0000000006B80000-0x0000000006B9E000-memory.dmp

        Filesize

        120KB

      • memory/1068-148-0x0000000002280000-0x00000000022B6000-memory.dmp

        Filesize

        216KB

      • memory/1068-149-0x0000000004E50000-0x0000000005478000-memory.dmp

        Filesize

        6.2MB

      • memory/1068-150-0x0000000004C70000-0x0000000004C92000-memory.dmp

        Filesize

        136KB

      • memory/1068-151-0x00000000054F0000-0x0000000005556000-memory.dmp

        Filesize

        408KB

      • memory/1068-152-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

        Filesize

        120KB

      • memory/1068-153-0x0000000006160000-0x0000000006192000-memory.dmp

        Filesize

        200KB

      • memory/1068-154-0x000000006F8A0000-0x000000006F8EC000-memory.dmp

        Filesize

        304KB

      • memory/4544-166-0x0000000007230000-0x000000000723A000-memory.dmp

        Filesize

        40KB

      • memory/4636-132-0x00000000745F0000-0x0000000074BA1000-memory.dmp

        Filesize

        5.7MB

      • memory/4636-136-0x00000000745F0000-0x0000000074BA1000-memory.dmp

        Filesize

        5.7MB

      • memory/4772-141-0x0000000006880000-0x0000000006892000-memory.dmp

        Filesize

        72KB

      • memory/4772-142-0x0000000006CB0000-0x0000000006CEC000-memory.dmp

        Filesize

        240KB

      • memory/4772-138-0x0000000005C10000-0x00000000061B4000-memory.dmp

        Filesize

        5.6MB

      • memory/4772-137-0x0000000000D20000-0x0000000000DAC000-memory.dmp

        Filesize

        560KB

      • memory/4772-139-0x0000000005780000-0x0000000005812000-memory.dmp

        Filesize

        584KB

      • memory/4772-140-0x0000000005B60000-0x0000000005BC6000-memory.dmp

        Filesize

        408KB