Analysis
-
max time kernel
262s -
max time network
357s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 16:45
Static task
static1
Behavioral task
behavioral1
Sample
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe
Resource
win7-20221111-en
General
-
Target
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe
-
Size
630KB
-
MD5
c45c3dbe62846a145d90077e4d64fe00
-
SHA1
a9413e2aadb3d0fbf0168666c93c10a74fddcd8a
-
SHA256
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c
-
SHA512
e7dd8538f223b2484c87cba7e1239d2c3ab85790a9ab5e9a31dfd3f8959982a39edcad838cb6aa5afe9348a344100ef1bc00c79d3a31d862726bbcfb098991ad
-
SSDEEP
12288:2oF8GNlD5ZS/1WEJOAqRSEM3Sy21LVbK89elrrJ5:aGKIDAEQSy2TbKuKN
Malware Config
Extracted
quasar
2.1.0.0
ajith
23.105.131.178:7812
VNM_MUTEX_NdVd2sPSSqFdo7I35g
-
encryption_key
jyerms3KOWmt3C9DBFuq
-
install_name
Windows Defender Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 7 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1924-60-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1924-61-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1924-63-0x0000000000486C4E-mapping.dmp disable_win_def behavioral1/memory/1924-62-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1924-65-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1924-67-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1520-81-0x0000000000486C4E-mapping.dmp disable_win_def -
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe -
Quasar payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-60-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1924-61-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1924-63-0x0000000000486C4E-mapping.dmp family_quasar behavioral1/memory/1924-62-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1924-65-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1924-67-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1520-81-0x0000000000486C4E-mapping.dmp family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Windows Defender Security.exeWindows Defender Security.exepid process 676 Windows Defender Security.exe 1520 Windows Defender Security.exe -
Loads dropped DLL 1 IoCs
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exepid process 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe -
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exeb70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exeWindows Defender Security.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe\"" b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Windows Defender Security.exe\"" Windows Defender Security.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exeWindows Defender Security.exedescription pid process target process PID 672 set thread context of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 676 set thread context of 1520 676 Windows Defender Security.exe Windows Defender Security.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exeWindows Defender Security.exepowershell.exedescription pid process Token: SeDebugPrivilege 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Token: SeDebugPrivilege 1520 Windows Defender Security.exe Token: SeDebugPrivilege 1520 Windows Defender Security.exe Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Defender Security.exepid process 1520 Windows Defender Security.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exeb70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exeWindows Defender Security.exeWindows Defender Security.exedescription pid process target process PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 672 wrote to memory of 1924 672 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe PID 1924 wrote to memory of 816 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe schtasks.exe PID 1924 wrote to memory of 816 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe schtasks.exe PID 1924 wrote to memory of 816 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe schtasks.exe PID 1924 wrote to memory of 816 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe schtasks.exe PID 1924 wrote to memory of 676 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Windows Defender Security.exe PID 1924 wrote to memory of 676 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Windows Defender Security.exe PID 1924 wrote to memory of 676 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Windows Defender Security.exe PID 1924 wrote to memory of 676 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 676 wrote to memory of 1520 676 Windows Defender Security.exe Windows Defender Security.exe PID 1924 wrote to memory of 1732 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe powershell.exe PID 1924 wrote to memory of 1732 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe powershell.exe PID 1924 wrote to memory of 1732 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe powershell.exe PID 1924 wrote to memory of 1732 1924 b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe powershell.exe PID 1520 wrote to memory of 1920 1520 Windows Defender Security.exe schtasks.exe PID 1520 wrote to memory of 1920 1520 Windows Defender Security.exe schtasks.exe PID 1520 wrote to memory of 1920 1520 Windows Defender Security.exe schtasks.exe PID 1520 wrote to memory of 1920 1520 Windows Defender Security.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe"C:\Users\Admin\AppData\Local\Temp\b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe"C:\Users\Admin\AppData\Local\Temp\b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
630KB
MD5c45c3dbe62846a145d90077e4d64fe00
SHA1a9413e2aadb3d0fbf0168666c93c10a74fddcd8a
SHA256b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c
SHA512e7dd8538f223b2484c87cba7e1239d2c3ab85790a9ab5e9a31dfd3f8959982a39edcad838cb6aa5afe9348a344100ef1bc00c79d3a31d862726bbcfb098991ad
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
630KB
MD5c45c3dbe62846a145d90077e4d64fe00
SHA1a9413e2aadb3d0fbf0168666c93c10a74fddcd8a
SHA256b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c
SHA512e7dd8538f223b2484c87cba7e1239d2c3ab85790a9ab5e9a31dfd3f8959982a39edcad838cb6aa5afe9348a344100ef1bc00c79d3a31d862726bbcfb098991ad
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
630KB
MD5c45c3dbe62846a145d90077e4d64fe00
SHA1a9413e2aadb3d0fbf0168666c93c10a74fddcd8a
SHA256b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c
SHA512e7dd8538f223b2484c87cba7e1239d2c3ab85790a9ab5e9a31dfd3f8959982a39edcad838cb6aa5afe9348a344100ef1bc00c79d3a31d862726bbcfb098991ad
-
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
630KB
MD5c45c3dbe62846a145d90077e4d64fe00
SHA1a9413e2aadb3d0fbf0168666c93c10a74fddcd8a
SHA256b70af2ccc8fd78d0cb69aa34cdb17c61d5024055787a2ddb97051834d5d2561c
SHA512e7dd8538f223b2484c87cba7e1239d2c3ab85790a9ab5e9a31dfd3f8959982a39edcad838cb6aa5afe9348a344100ef1bc00c79d3a31d862726bbcfb098991ad
-
memory/672-55-0x0000000075531000-0x0000000075533000-memory.dmpFilesize
8KB
-
memory/672-56-0x0000000000200000-0x000000000020A000-memory.dmpFilesize
40KB
-
memory/672-54-0x0000000000CA0000-0x0000000000D44000-memory.dmpFilesize
656KB
-
memory/676-74-0x0000000001030000-0x00000000010D4000-memory.dmpFilesize
656KB
-
memory/676-71-0x0000000000000000-mapping.dmp
-
memory/816-69-0x0000000000000000-mapping.dmp
-
memory/1520-81-0x0000000000486C4E-mapping.dmp
-
memory/1732-88-0x0000000000000000-mapping.dmp
-
memory/1732-93-0x000000006ED40000-0x000000006F2EB000-memory.dmpFilesize
5.7MB
-
memory/1732-92-0x000000006ED40000-0x000000006F2EB000-memory.dmpFilesize
5.7MB
-
memory/1732-91-0x000000006ED40000-0x000000006F2EB000-memory.dmpFilesize
5.7MB
-
memory/1920-89-0x0000000000000000-mapping.dmp
-
memory/1924-63-0x0000000000486C4E-mapping.dmp
-
memory/1924-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1924-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1924-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1924-61-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1924-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1924-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1924-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB