Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 01:56

General

  • Target

    5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe

  • Size

    4.4MB

  • MD5

    e862112b0a3781dcf75eaf11b8b6ea7d

  • SHA1

    725b9a18c2c6cdd616ad10d6f9e977753c7eb0e4

  • SHA256

    5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135

  • SHA512

    6a5ebf286858e2a814fedf81fae111bd4468eaafe19ecc2a7eadf2d441b9584bab4ee4a3c5f83415d5cc31bbe11f7888e6dbe2a0a8a006affaefe463de3f535f

  • SSDEEP

    98304:+4uKDZOjVXFcG7BEcyZeW+gP/i6jepIA90sK6LovYr5K49ZQ:+4uKDeFT7BEcyZpDP/RERXKsog5BHQ

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

microsoftbackup.duckdns.org:47600

Mutex

b97303a2-a8f5-4170-91c1-56adceee5081

Attributes
  • encryption_key

    A31E078A7CC45D3676D5AE3FB460C3E365219397

  • install_name

    Client.exe

  • log_directory

    Log

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe
    "C:\Users\Admin\AppData\Local\Temp\5b1365bd1c3648fdfe1aa9699e1647b3967bf3824c0b03eb4e67ef4599840135.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:2208
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAyAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2736
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4084
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:5068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3800

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    4280e36a29fa31c01e4d8b2ba726a0d8

    SHA1

    c485c2c9ce0a99747b18d899b71dfa9a64dabe32

    SHA256

    e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

    SHA512

    494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    06ad34f9739c5159b4d92d702545bd49

    SHA1

    9152a0d4f153f3f40f7e606be75f81b582ee0c17

    SHA256

    474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

    SHA512

    c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    3f534abcf583fea9b7cb7d14c6b360e4

    SHA1

    9a1a0bf59478a1503bcc09a761d15c576b61eea1

    SHA256

    af5161ddf885be9a84a205c1ee185eccc7724415d7b8ff39887cf1c69ef4c520

    SHA512

    cfd9037ba651055197cf48643f300be6715762f8f5a0bd7a92c499825e9376da6153fc1780b1c35031768ca71cddf7b57adba5ccb8477772acb1f7b7a0e33e83

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_olszybin.tq1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2576-134-0x0000000005D30000-0x00000000062D4000-memory.dmp

    Filesize

    5.6MB

  • memory/2576-135-0x0000000005820000-0x00000000058B2000-memory.dmp

    Filesize

    584KB

  • memory/2576-136-0x0000000005740000-0x000000000574A000-memory.dmp

    Filesize

    40KB

  • memory/2576-137-0x0000000005770000-0x0000000005780000-memory.dmp

    Filesize

    64KB

  • memory/2576-138-0x0000000008B20000-0x0000000008B42000-memory.dmp

    Filesize

    136KB

  • memory/2576-133-0x0000000000920000-0x0000000000D84000-memory.dmp

    Filesize

    4.4MB

  • memory/2576-158-0x0000000005770000-0x0000000005780000-memory.dmp

    Filesize

    64KB

  • memory/2736-161-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/2736-139-0x0000000004FD0000-0x0000000005006000-memory.dmp

    Filesize

    216KB

  • memory/2736-154-0x0000000006590000-0x00000000065AE000-memory.dmp

    Filesize

    120KB

  • memory/2736-155-0x0000000007DE0000-0x000000000845A000-memory.dmp

    Filesize

    6.5MB

  • memory/2736-156-0x0000000006A80000-0x0000000006A9A000-memory.dmp

    Filesize

    104KB

  • memory/2736-157-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/2736-146-0x0000000005F10000-0x0000000005F76000-memory.dmp

    Filesize

    408KB

  • memory/2736-159-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/2736-160-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/2736-142-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/2736-141-0x0000000005DF0000-0x0000000005E56000-memory.dmp

    Filesize

    408KB

  • memory/2736-140-0x00000000056E0000-0x0000000005D08000-memory.dmp

    Filesize

    6.2MB

  • memory/2736-143-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/3800-198-0x0000000006280000-0x0000000006898000-memory.dmp

    Filesize

    6.1MB

  • memory/3800-205-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/3800-177-0x0000000000400000-0x0000000000724000-memory.dmp

    Filesize

    3.1MB

  • memory/3800-200-0x0000000006040000-0x00000000060F2000-memory.dmp

    Filesize

    712KB

  • memory/3800-179-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/3800-199-0x0000000005DD0000-0x0000000005E20000-memory.dmp

    Filesize

    320KB

  • memory/4084-183-0x000000006FA10000-0x000000006FA5C000-memory.dmp

    Filesize

    304KB

  • memory/4084-195-0x000000007F8D0000-0x000000007F8E0000-memory.dmp

    Filesize

    64KB

  • memory/4084-196-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-197-0x0000000007B60000-0x0000000007BF6000-memory.dmp

    Filesize

    600KB

  • memory/4084-194-0x0000000007920000-0x000000000792A000-memory.dmp

    Filesize

    40KB

  • memory/4084-193-0x00000000074D0000-0x00000000074EE000-memory.dmp

    Filesize

    120KB

  • memory/4084-182-0x00000000074F0000-0x0000000007522000-memory.dmp

    Filesize

    200KB

  • memory/4084-201-0x0000000006400000-0x000000000640E000-memory.dmp

    Filesize

    56KB

  • memory/4084-202-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

    Filesize

    104KB

  • memory/4084-203-0x0000000007AA0000-0x0000000007AA8000-memory.dmp

    Filesize

    32KB

  • memory/4084-180-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

    Filesize

    64KB