Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
04/01/2024, 18:14
240104-wvbjqshae2 1004/01/2024, 18:10
240104-wsg9hagdaq 1004/01/2024, 17:57
240104-wjq52sgbej 10Analysis
-
max time kernel
94s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 18:10
Behavioral task
behavioral1
Sample
Client-built2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Client-built2.exe
-
Size
3.1MB
-
MD5
25a6e6b8caea99854e5908e9b71362a2
-
SHA1
556604b1fce41861d9c0e8b8f078dc9601ce992e
-
SHA256
7939f7d7f256502832c6c5236e9ab25adb6b42070055ed61003dead58c545d14
-
SHA512
b55d9206df0ed5824d5c28aa705aebd2486a14c20973fd12add63b8a3434d41f146a95f492ec834c171613a3b1f9b600a78f6c68899f6c996199092e886cfec2
-
SSDEEP
49152:jvTlL26AaNeWgPhlmVqvMQ7XSK8cRJ61bR3LoGdfmTHHB72eh2NT:jvJL26AaNeWgPhlmVqkQ7XSK8cRJ6H
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
2a02:ab88:1412:4700:5144:139:e041:bf2:1177
Mutex
cf62a49b-b605-4642-9434-7fa717f78e98
Attributes
-
encryption_key
0D82AEC86C28AE814DDFCE09C92A2D514937B13E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/1764-0-0x0000000000A60000-0x0000000000D84000-memory.dmp family_quasar -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1764 Client-built2.exe Token: SeDebugPrivilege 4704 taskmgr.exe Token: SeSystemProfilePrivilege 4704 taskmgr.exe Token: SeCreateGlobalPrivilege 4704 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 1764 Client-built2.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 1764 Client-built2.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe 4704 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built2.exe"C:\Users\Admin\AppData\Local\Temp\Client-built2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1764
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4704