Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe
Resource
win7-20231129-en
General
-
Target
c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe
-
Size
9.0MB
-
MD5
4921d7a6d49401873cff200a4f3d990d
-
SHA1
3d008d53e798505b858ff48574f3080210c56e27
-
SHA256
c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047
-
SHA512
9bc506b0615f3e7ba18ed70c92bef4dff257aad5437f17670ba88d8aec1ce20b0b46f8c194918e2c0fa0fa0397ec0ef2f954801da09fbf211c8597936fc097c4
-
SSDEEP
98304:F6D7RBxsErIVyJTk8LJ5i4J/OCV4HEZFrp:QRw08yJIC5uuT
Malware Config
Extracted
quasar
1.4.1
Office04
93.123.85.108:4782
e14b8f59-979b-4ebf-8602-dd3c4d6c301e
-
encryption_key
534734397C0FA9A1D28F061AD75DF4100BFF5787
-
install_name
Msconfig.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/1396-16-0x0000000001420000-0x0000000001744000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral2/memory/1396-16-0x0000000001420000-0x0000000001744000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule behavioral2/memory/1396-16-0x0000000001420000-0x0000000001744000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 1 IoCs
resource yara_rule behavioral2/memory/1396-16-0x0000000001420000-0x0000000001744000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Detects executables packed with SmartAssembly 3 IoCs
resource yara_rule behavioral2/memory/4652-1-0x0000000000BF0000-0x00000000014FE000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/1444-6-0x0000000000E00000-0x000000000112A000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/files/0x000a000000023b96-14.dat INDICATOR_EXE_Packed_SmartAssembly -
Executes dropped EXE 2 IoCs
pid Process 1260 msconfig.exe 3796 msconfig.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4652 set thread context of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 1444 set thread context of 1396 1444 csc.exe 109 PID 1260 set thread context of 1264 1260 msconfig.exe 121 PID 1264 set thread context of 2732 1264 csc.exe 137 PID 3796 set thread context of 5020 3796 msconfig.exe 147 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2780 schtasks.exe 4368 schtasks.exe 1392 schtasks.exe 4552 schtasks.exe 4364 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1396 csc.exe Token: SeDebugPrivilege 2732 csc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1396 csc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 1444 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 100 PID 4652 wrote to memory of 4380 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 101 PID 4652 wrote to memory of 4380 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 101 PID 4652 wrote to memory of 4380 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 101 PID 4652 wrote to memory of 1392 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 103 PID 4652 wrote to memory of 1392 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 103 PID 4652 wrote to memory of 1392 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 103 PID 1392 wrote to memory of 2780 1392 cmd.exe 105 PID 1392 wrote to memory of 2780 1392 cmd.exe 105 PID 1392 wrote to memory of 2780 1392 cmd.exe 105 PID 4652 wrote to memory of 920 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 106 PID 4652 wrote to memory of 920 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 106 PID 4652 wrote to memory of 920 4652 c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe 106 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 1396 1444 csc.exe 109 PID 1444 wrote to memory of 4988 1444 csc.exe 110 PID 1444 wrote to memory of 4988 1444 csc.exe 110 PID 1444 wrote to memory of 4988 1444 csc.exe 110 PID 1444 wrote to memory of 4264 1444 csc.exe 112 PID 1444 wrote to memory of 4264 1444 csc.exe 112 PID 1444 wrote to memory of 4264 1444 csc.exe 112 PID 4264 wrote to memory of 4368 4264 cmd.exe 114 PID 4264 wrote to memory of 4368 4264 cmd.exe 114 PID 4264 wrote to memory of 4368 4264 cmd.exe 114 PID 1444 wrote to memory of 4704 1444 csc.exe 115 PID 1444 wrote to memory of 4704 1444 csc.exe 115 PID 1444 wrote to memory of 4704 1444 csc.exe 115 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1264 1260 msconfig.exe 121 PID 1260 wrote to memory of 1344 1260 msconfig.exe 122 PID 1260 wrote to memory of 1344 1260 msconfig.exe 122 PID 1260 wrote to memory of 1344 1260 msconfig.exe 122 PID 1260 wrote to memory of 4324 1260 msconfig.exe 124 PID 1260 wrote to memory of 4324 1260 msconfig.exe 124 PID 1260 wrote to memory of 4324 1260 msconfig.exe 124 PID 4324 wrote to memory of 1392 4324 cmd.exe 126 PID 4324 wrote to memory of 1392 4324 cmd.exe 126 PID 4324 wrote to memory of 1392 4324 cmd.exe 126 PID 1260 wrote to memory of 3560 1260 msconfig.exe 127 PID 1260 wrote to memory of 3560 1260 msconfig.exe 127 PID 1260 wrote to memory of 3560 1260 msconfig.exe 127 PID 1264 wrote to memory of 2732 1264 csc.exe 137 PID 1264 wrote to memory of 2732 1264 csc.exe 137 PID 1264 wrote to memory of 2732 1264 csc.exe 137 PID 1264 wrote to memory of 2732 1264 csc.exe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe"C:\Users\Admin\AppData\Local\Temp\c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1396
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"3⤵PID:4988
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f4⤵
- Creates scheduled task(s)
PID:4368
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"3⤵PID:4704
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"2⤵PID:4380
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Creates scheduled task(s)
PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"2⤵PID:920
-
-
C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exeC:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"3⤵PID:3892
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵PID:2428
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f4⤵
- Creates scheduled task(s)
PID:4552
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"3⤵PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"2⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Creates scheduled task(s)
PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"2⤵PID:3560
-
-
C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exeC:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:5020
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\msconfig"2⤵PID:4404
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f2⤵PID:4844
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe'" /f3⤵
- Creates scheduled task(s)
PID:4364
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe" "C:\Users\Admin\AppData\Roaming\msconfig\msconfig.exe"2⤵PID:3224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
Filesize
9.0MB
MD54921d7a6d49401873cff200a4f3d990d
SHA13d008d53e798505b858ff48574f3080210c56e27
SHA256c9d37a723484c763c7c25000eb11c7bb9cda571a8c2b7886f4610af6cd473047
SHA5129bc506b0615f3e7ba18ed70c92bef4dff257aad5437f17670ba88d8aec1ce20b0b46f8c194918e2c0fa0fa0397ec0ef2f954801da09fbf211c8597936fc097c4