Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe
Resource
win10v2004-20240419-en
General
-
Target
c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe
-
Size
9.0MB
-
MD5
4921d7a6d49401873cff200a4f3d990d
-
SHA1
3d008d53e798505b858ff48574f3080210c56e27
-
SHA256
c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047
-
SHA512
9bc506b0615f3e7ba18ed70c92bef4dff257aad5437f17670ba88d8aec1ce20b0b46f8c194918e2c0fa0fa0397ec0ef2f954801da09fbf211c8597936fc097c4
-
SSDEEP
98304:F6D7RBxsErIVyJTk8LJ5i4J/OCV4HEZFrp:QRw08yJIC5uuT
Malware Config
Extracted
quasar
1.4.1
Office04
93.123.85.108:4782
e14b8f59-979b-4ebf-8602-dd3c4d6c301e
-
encryption_key
534734397C0FA9A1D28F061AD75DF4100BFF5787
-
install_name
Msconfig.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/3100-17-0x0000000000690000-0x00000000009B4000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 392 msconfig.exe 1536 msconfig.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 748 set thread context of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 3552 set thread context of 3100 3552 csc.exe 110 PID 392 set thread context of 1280 392 msconfig.exe 123 PID 1280 set thread context of 3472 1280 csc.exe 136 PID 1536 set thread context of 2168 1536 msconfig.exe 148 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4624 schtasks.exe 4240 schtasks.exe 816 schtasks.exe 4512 schtasks.exe 2460 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3100 csc.exe Token: SeDebugPrivilege 3472 csc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3100 csc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3552 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 748 wrote to memory of 3124 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 101 PID 748 wrote to memory of 3124 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 101 PID 748 wrote to memory of 3124 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 101 PID 748 wrote to memory of 4636 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 103 PID 748 wrote to memory of 4636 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 103 PID 748 wrote to memory of 4636 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 103 PID 4636 wrote to memory of 816 4636 cmd.exe 105 PID 4636 wrote to memory of 816 4636 cmd.exe 105 PID 4636 wrote to memory of 816 4636 cmd.exe 105 PID 748 wrote to memory of 1992 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 106 PID 748 wrote to memory of 1992 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 106 PID 748 wrote to memory of 1992 748 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 106 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 3100 3552 csc.exe 110 PID 3552 wrote to memory of 1340 3552 csc.exe 111 PID 3552 wrote to memory of 1340 3552 csc.exe 111 PID 3552 wrote to memory of 1340 3552 csc.exe 111 PID 3552 wrote to memory of 2880 3552 csc.exe 113 PID 3552 wrote to memory of 2880 3552 csc.exe 113 PID 3552 wrote to memory of 2880 3552 csc.exe 113 PID 2880 wrote to memory of 4512 2880 cmd.exe 115 PID 2880 wrote to memory of 4512 2880 cmd.exe 115 PID 2880 wrote to memory of 4512 2880 cmd.exe 115 PID 3552 wrote to memory of 2952 3552 csc.exe 116 PID 3552 wrote to memory of 2952 3552 csc.exe 116 PID 3552 wrote to memory of 2952 3552 csc.exe 116 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 1280 392 msconfig.exe 123 PID 392 wrote to memory of 2272 392 msconfig.exe 124 PID 392 wrote to memory of 2272 392 msconfig.exe 124 PID 392 wrote to memory of 2272 392 msconfig.exe 124 PID 392 wrote to memory of 1436 392 msconfig.exe 126 PID 392 wrote to memory of 1436 392 msconfig.exe 126 PID 392 wrote to memory of 1436 392 msconfig.exe 126 PID 1436 wrote to memory of 2460 1436 cmd.exe 128 PID 1436 wrote to memory of 2460 1436 cmd.exe 128 PID 1436 wrote to memory of 2460 1436 cmd.exe 128 PID 392 wrote to memory of 3436 392 msconfig.exe 129 PID 392 wrote to memory of 3436 392 msconfig.exe 129 PID 392 wrote to memory of 3436 392 msconfig.exe 129 PID 1280 wrote to memory of 3472 1280 csc.exe 136 PID 1280 wrote to memory of 3472 1280 csc.exe 136 PID 1280 wrote to memory of 3472 1280 csc.exe 136 PID 1280 wrote to memory of 3472 1280 csc.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe"C:\Users\Admin\AppData\Local\Temp\c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3100
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"3⤵PID:1340
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f4⤵
- Creates scheduled task(s)
PID:4512
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"3⤵PID:2952
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"2⤵PID:3124
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Creates scheduled task(s)
PID:816
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"2⤵PID:1992
-
-
C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exeC:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"3⤵PID:3552
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵PID:2520
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f4⤵
- Creates scheduled task(s)
PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"3⤵PID:1348
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"2⤵PID:2272
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Creates scheduled task(s)
PID:2460
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"2⤵PID:3436
-
-
C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exeC:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:2168
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"2⤵PID:736
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f2⤵PID:5056
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Creates scheduled task(s)
PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"2⤵PID:3356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
Filesize
9.0MB
MD54921d7a6d49401873cff200a4f3d990d
SHA13d008d53e798505b858ff48574f3080210c56e27
SHA256c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047
SHA5129bc506b0615f3e7ba18ed70c92bef4dff257aad5437f17670ba88d8aec1ce20b0b46f8c194918e2c0fa0fa0397ec0ef2f954801da09fbf211c8597936fc097c4