Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2023, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
BLToolsMod.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BLToolsMod.exe
Resource
win10v2004-20220901-en
General
-
Target
BLToolsMod.exe
-
Size
763KB
-
MD5
869037e716218fb7551d84b8ce7d0ae7
-
SHA1
12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18
-
SHA256
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6
-
SHA512
6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2
-
SSDEEP
12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4
Malware Config
Extracted
quasar
1.4.0.0
Office04
youhackernetpaingodxd.duckdns.org:5557
blablashitspreading.ddns.net:5557
xEoEv3HHdyEIYwJRFM
-
encryption_key
w3WfcmWh1iXT9cxeKFEX
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/1140-147-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation BLToolsMod.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Updater-File.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 1 IoCs
pid Process 4636 Updater-File.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Driver.exe\"" Updater-File.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 37 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4636 set thread context of 1140 4636 Updater-File.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1356 3376 WerFault.exe 79 -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4584 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1704 powershell.exe 1704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3376 BLToolsMod.exe Token: SeDebugPrivilege 4636 Updater-File.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 1140 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1140 RegAsm.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3376 wrote to memory of 4636 3376 BLToolsMod.exe 80 PID 3376 wrote to memory of 4636 3376 BLToolsMod.exe 80 PID 3376 wrote to memory of 4636 3376 BLToolsMod.exe 80 PID 4636 wrote to memory of 1704 4636 Updater-File.exe 87 PID 4636 wrote to memory of 1704 4636 Updater-File.exe 87 PID 4636 wrote to memory of 1704 4636 Updater-File.exe 87 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 4636 wrote to memory of 1140 4636 Updater-File.exe 93 PID 1140 wrote to memory of 4544 1140 RegAsm.exe 94 PID 1140 wrote to memory of 4544 1140 RegAsm.exe 94 PID 1140 wrote to memory of 4544 1140 RegAsm.exe 94 PID 4544 wrote to memory of 3700 4544 cmd.exe 96 PID 4544 wrote to memory of 3700 4544 cmd.exe 96 PID 4544 wrote to memory of 3700 4544 cmd.exe 96 PID 4544 wrote to memory of 4584 4544 cmd.exe 97 PID 4544 wrote to memory of 4584 4544 cmd.exe 97 PID 4544 wrote to memory of 4584 4544 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Roaming\Updater-File.exe"C:\Users\Admin\AppData\Roaming\Updater-File.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MsYYveiMG7iU.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:3700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:4584
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 20962⤵
- Program crash
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3376 -ip 33761⤵PID:4748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270B
MD55ebfd51bdc4b72d54bc91ac8a6065e98
SHA15d46152b2a9033f09edd49c77829203f35e20584
SHA2561372936306530f91e7459f31ee483188bf28a7c481a59a6805133f09d349906f
SHA512a19e148f3be56ee6d2042769f8be73e1cb0600473d3fae346779f98fe09b909e7cb8267e7fa2bb358e0cd7d93806abd260860044f097e0d885e93996f0cd5c49
-
Filesize
224B
MD5f81fec59640307ba7b3202172d206729
SHA1ab90c240b8c3b23a6c06c119a028903a58afce3d
SHA256e79eb0a2f9b56966a8336200336123baffad193e193fed675f4eba468cb30d0f
SHA512397ebf45d2fa62a956443546de0c33fd254bc3891fc6159172790bbc0fcaf320f4ada3ea14fe1c0d94a696716bdb640a055fe2cd2275e3f268569febb276d1cd
-
Filesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b
-
Filesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b