Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2023, 20:46

General

  • Target

    5q4psw.msi

  • Size

    496KB

  • MD5

    e35727b10193fe55df216a1f9d166997

  • SHA1

    9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a

  • SHA256

    696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d

  • SHA512

    2bba74b0b7f5ee8509310030bb45def13b87394e55edf8d0e51595d6cc669f4b2c7497d95331c09c9f7b453f3c9acdeb03e41cd5e5dc14f9ecb9dd9f79d7ad8d

  • SSDEEP

    12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154

Malware Config

Extracted

Family

qakbot

Version

404.1320

Botnet

obama265

Campaign

1685436052

C2

103.42.86.42:995

174.4.89.3:443

161.142.103.187:995

78.160.146.127:443

84.35.26.14:995

12.172.173.82:20

70.28.50.223:2078

124.149.143.189:2222

70.160.67.203:443

186.64.67.30:443

103.123.223.133:443

94.207.104.225:443

89.114.140.100:443

213.64.33.61:2222

86.176.144.234:2222

72.134.124.16:443

47.34.30.133:443

109.50.149.241:2222

85.104.105.67:443

81.111.108.123:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5q4psw.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1452
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1872
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3932
      • C:\Windows\system32\wscript.exe
        wscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
        2⤵
          PID:1404
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:2064

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e570a90.rbs

        Filesize

        9KB

        MD5

        c4c2870ad9d276fc753680ede5bf3748

        SHA1

        0c56d7b4b51a825f9c7bad5b85fe087675f93a98

        SHA256

        a1177a71ea9106b3b3b28957ae17738ebc8c05fbf0f861e76a40328bfa1d9334

        SHA512

        f806c37fca3498034da775b6f6ea50258e80a890654cd2b87313286c23d3481d7519fab1d809a5a50e9d422a8a664d2cfe935486aaa4543b537fd39049653e36

      • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

        Filesize

        930KB

        MD5

        0c8e5b12b177a199008b2282c7506fff

        SHA1

        0dfee8bae7073512f8bfdabaf0c0b7c882b3864e

        SHA256

        9a407a2f0ba3c0e3ba3cfa2ffd6472db3bc572b8ef08f1fba7139cbd36cc8dca

        SHA512

        6464ec42cccb85e7c067ad9f7c8b804d064a6974e8184bc5134436fad004bf87630869c107bb91f87bdc59f7938a8a157f59a436ce0265c070db32a54c4541b5

      • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

        Filesize

        930KB

        MD5

        0c8e5b12b177a199008b2282c7506fff

        SHA1

        0dfee8bae7073512f8bfdabaf0c0b7c882b3864e

        SHA256

        9a407a2f0ba3c0e3ba3cfa2ffd6472db3bc572b8ef08f1fba7139cbd36cc8dca

        SHA512

        6464ec42cccb85e7c067ad9f7c8b804d064a6974e8184bc5134436fad004bf87630869c107bb91f87bdc59f7938a8a157f59a436ce0265c070db32a54c4541b5

      • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

        Filesize

        132B

        MD5

        0d4c9f15ce74465c59ae36a27f98c817

        SHA1

        9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a

        SHA256

        d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a

        SHA512

        9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f

      • C:\Windows\Installer\e570a8f.msi

        Filesize

        496KB

        MD5

        e35727b10193fe55df216a1f9d166997

        SHA1

        9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a

        SHA256

        696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d

        SHA512

        2bba74b0b7f5ee8509310030bb45def13b87394e55edf8d0e51595d6cc669f4b2c7497d95331c09c9f7b453f3c9acdeb03e41cd5e5dc14f9ecb9dd9f79d7ad8d

      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

        Filesize

        23.0MB

        MD5

        dbcc2a29396c97b0dbf045f7584ce6de

        SHA1

        65ee7393a5a8e01e71a23fa16a85b9e0c094162a

        SHA256

        1708890e990a39e20fece73710bfc16a4255c56f0f3424151740edf9c726bf83

        SHA512

        d0c17b3d0dd6377b2cb39a9f7b5cc1b392f7ef70d90806a50d07bc100468096c96a03e119a465973114d4e668528c4f8c11555d5efb3e7fbc2a0058eb9aa0533

      • \??\Volume{4cc777a5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1c8a8b6c-e8d3-466c-a088-725b819a4170}_OnDiskSnapshotProp

        Filesize

        5KB

        MD5

        c509ebd1ff0a353f0f772958913c9fb1

        SHA1

        41a954e2fe0f9543a2751fca386326d7101362a1

        SHA256

        6995d088aac5e989e9140aaf46cc6a31c09280956016e43fd34e14541b073eed

        SHA512

        aaa8ed4776a144e7b791696b76d0f5da6943adf3a6162687c3d81ffdfc54b0e20407d9e5769de3ee420f53dcdf5a5452bfae749851ec11b9be4b78109725fb71

      • memory/1712-173-0x0000000010000000-0x0000000010200000-memory.dmp

        Filesize

        2.0MB

      • memory/1712-159-0x0000000000570000-0x0000000000573000-memory.dmp

        Filesize

        12KB

      • memory/1712-160-0x0000000002250000-0x0000000002274000-memory.dmp

        Filesize

        144KB

      • memory/3932-166-0x0000000000EF0000-0x0000000000F14000-memory.dmp

        Filesize

        144KB

      • memory/3932-174-0x0000000000EF0000-0x0000000000F14000-memory.dmp

        Filesize

        144KB

      • memory/3932-175-0x0000000000EF0000-0x0000000000F14000-memory.dmp

        Filesize

        144KB

      • memory/3932-176-0x0000000000EF0000-0x0000000000F14000-memory.dmp

        Filesize

        144KB

      • memory/3932-177-0x0000000000EF0000-0x0000000000F14000-memory.dmp

        Filesize

        144KB

      • memory/3932-172-0x0000000000EF0000-0x0000000000F14000-memory.dmp

        Filesize

        144KB

      • memory/3932-165-0x0000000000F20000-0x0000000000F22000-memory.dmp

        Filesize

        8KB