Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2023, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe
Resource
win10v2004-20230220-en
General
-
Target
5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe
-
Size
4.4MB
-
MD5
e862112b0a3781dcf75eaf11b8b6ea7d
-
SHA1
725b9a18c2c6cdd616ad10d6f9e977753c7eb0e4
-
SHA256
5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135
-
SHA512
6a5ebf286858e2a814fedf81fae111bd4468eaafe19ecc2a7eadf2d441b9584bab4ee4a3c5f83415d5cc31bbe11f7888e6dbe2a0a8a006affaefe463de3f535f
-
SSDEEP
98304:+4uKDZOjVXFcG7BEcyZeW+gP/i6jepIA90sK6LovYr5K49ZQ:+4uKDeFT7BEcyZpDP/RERXKsog5BHQ
Malware Config
Extracted
quasar
1.4.1
Office04
microsoftbackup.duckdns.org:47600
b97303a2-a8f5-4170-91c1-56adceee5081
-
encryption_key
A31E078A7CC45D3676D5AE3FB460C3E365219397
-
install_name
Client.exe
-
log_directory
Log
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/3800-177-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\serviceupdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\serviceupdate.exe\"" 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2576 set thread context of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2208 ipconfig.exe 5068 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2736 powershell.exe 2736 powershell.exe 4084 powershell.exe 4084 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 3800 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3800 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2576 wrote to memory of 3496 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 82 PID 2576 wrote to memory of 3496 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 82 PID 2576 wrote to memory of 3496 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 82 PID 3496 wrote to memory of 2208 3496 cmd.exe 84 PID 3496 wrote to memory of 2208 3496 cmd.exe 84 PID 3496 wrote to memory of 2208 3496 cmd.exe 84 PID 2576 wrote to memory of 2736 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 85 PID 2576 wrote to memory of 2736 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 85 PID 2576 wrote to memory of 2736 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 85 PID 2576 wrote to memory of 3504 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 94 PID 2576 wrote to memory of 3504 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 94 PID 2576 wrote to memory of 3504 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 94 PID 3504 wrote to memory of 4084 3504 cmd.exe 96 PID 3504 wrote to memory of 4084 3504 cmd.exe 96 PID 3504 wrote to memory of 4084 3504 cmd.exe 96 PID 2576 wrote to memory of 2896 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 97 PID 2576 wrote to memory of 2896 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 97 PID 2576 wrote to memory of 2896 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 97 PID 2896 wrote to memory of 5068 2896 cmd.exe 99 PID 2896 wrote to memory of 5068 2896 cmd.exe 99 PID 2896 wrote to memory of 5068 2896 cmd.exe 99 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100 PID 2576 wrote to memory of 3800 2576 5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe"C:\Users\Admin\AppData\Local\Temp\5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
PID:2208
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAyAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:5068
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3800
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
Filesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
Filesize
16KB
MD53f534abcf583fea9b7cb7d14c6b360e4
SHA19a1a0bf59478a1503bcc09a761d15c576b61eea1
SHA256af5161ddf885be9a84a205c1ee185eccc7724415d7b8ff39887cf1c69ef4c520
SHA512cfd9037ba651055197cf48643f300be6715762f8f5a0bd7a92c499825e9376da6153fc1780b1c35031768ca71cddf7b57adba5ccb8477772acb1f7b7a0e33e83
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82