Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 11:00
Behavioral task
behavioral1
Sample
16888128718a66611c1d86e12.exe
Resource
win7-20230703-en
General
-
Target
16888128718a66611c1d86e12.exe
-
Size
348KB
-
MD5
7834a7e88c159e7f55934c740ca39935
-
SHA1
c5a4dcd4454df284e95472a972511c2488bd79ac
-
SHA256
b8eda4e9e691fe7017981cea833b63299ea6b89e08f3995b630cf705a393d16b
-
SHA512
2c3f4f70cb898eb6fafa60b8f55301ef4b3c1918c527bec6f8721c5146c4affef28bdabda991fdb799df78dc74d70af7d57989fb00dcb787e23a42ee851b4b7d
-
SSDEEP
6144:r2NHXf500MRWfu7waMmbUIgiWebh4OIqppWH5t5BW:yd50Ku8bNOSqpgH5/BW
Malware Config
Extracted
quasar
1.3.0.0
Office04
qrss.duckdns.org:54790
QSR_MUTEX_zlSKJvcuVjgb1gOk4J
-
encryption_key
vUOWxZSgsTmyyUM9Rgsw
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2324-54-0x0000000000D90000-0x0000000000DEE000-memory.dmp family_quasar behavioral1/memory/2324-55-0x0000000004970000-0x00000000049B0000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2324 16888128718a66611c1d86e12.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2324 16888128718a66611c1d86e12.exe