Analysis
-
max time kernel
201s -
max time network
216s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
Update.exe
Resource
win7-20240221-en
General
-
Target
Update.exe
-
Size
20.4MB
-
MD5
88246c2a001042481486e559a6d10d91
-
SHA1
e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
-
SHA256
4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
-
SHA512
f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
-
SSDEEP
393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o
Malware Config
Extracted
quasar
1.4.1
EmmasSub
85.23.24.170:4782
85.23.109.34:4782
82.128.254.93:4782
f82c7021-f558-4f6f-bbb3-fbe420c708e5
-
encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
-
install_name
RuntimeBroker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
WindowsSecureManager
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule \Program Files (x86)\MyFolder\RunMe.exe family_quasar behavioral1/memory/2644-53-0x0000000000330000-0x0000000000654000-memory.dmp family_quasar behavioral1/memory/584-63-0x00000000010A0000-0x00000000013C4000-memory.dmp family_quasar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 3 IoCs
Processes:
Update.tmpRunMe.exeRuntimeBroker.exepid process 2560 Update.tmp 2644 RunMe.exe 584 RuntimeBroker.exe -
Loads dropped DLL 3 IoCs
Processes:
Update.exeUpdate.tmppid process 2460 Update.exe 2560 Update.tmp 2560 Update.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
RunMe.exeRuntimeBroker.exedescription ioc process File created C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe RunMe.exe File opened for modification C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe RunMe.exe File opened for modification C:\Windows\system32\WindowsSecureManager RunMe.exe File opened for modification C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe RuntimeBroker.exe File opened for modification C:\Windows\system32\WindowsSecureManager RuntimeBroker.exe -
Drops file in Program Files directory 9 IoCs
Processes:
Update.tmppowershell.exedescription ioc process File opened for modification C:\Program Files (x86)\MyFolder\creal.exe Update.tmp File opened for modification C:\Program Files (x86)\MyFolder\RunMe.exe Update.tmp File created C:\Program Files (x86)\MyFolder\unins000.dat Update.tmp File created C:\Program Files (x86)\MyFolder\is-JTK9I.tmp Update.tmp File created C:\Program Files (x86)\MyFolder\is-56DL0.tmp Update.tmp File created C:\Program Files (x86)\MyFolder\is-UJ8LG.tmp Update.tmp File opened for modification C:\Program Files (x86)\MyFolder\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Program Files (x86)\MyFolder\is-68Q2O.tmp Update.tmp File opened for modification C:\Program Files (x86)\MyFolder\unins000.dat Update.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2668 schtasks.exe 476 schtasks.exe -
Modifies registry class 19 IoCs
Processes:
Update.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\"" Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.myp Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\TstFile.myp Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File" Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0" Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications Update.tmp -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Update.tmppowershell.exepid process 2560 Update.tmp 2560 Update.tmp 2196 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Update.tmppid process 2560 Update.tmp -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRunMe.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 2196 powershell.exe Token: SeDebugPrivilege 2644 RunMe.exe Token: SeDebugPrivilege 584 RuntimeBroker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Update.tmppid process 2560 Update.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RuntimeBroker.exepid process 584 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Update.exeUpdate.tmpcmd.exeRunMe.exeRuntimeBroker.exedescription pid process target process PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2460 wrote to memory of 2560 2460 Update.exe Update.tmp PID 2560 wrote to memory of 1768 2560 Update.tmp cmd.exe PID 2560 wrote to memory of 1768 2560 Update.tmp cmd.exe PID 2560 wrote to memory of 1768 2560 Update.tmp cmd.exe PID 2560 wrote to memory of 1768 2560 Update.tmp cmd.exe PID 1768 wrote to memory of 2196 1768 cmd.exe powershell.exe PID 1768 wrote to memory of 2196 1768 cmd.exe powershell.exe PID 1768 wrote to memory of 2196 1768 cmd.exe powershell.exe PID 1768 wrote to memory of 2196 1768 cmd.exe powershell.exe PID 2560 wrote to memory of 2644 2560 Update.tmp RunMe.exe PID 2560 wrote to memory of 2644 2560 Update.tmp RunMe.exe PID 2560 wrote to memory of 2644 2560 Update.tmp RunMe.exe PID 2560 wrote to memory of 2644 2560 Update.tmp RunMe.exe PID 2644 wrote to memory of 2668 2644 RunMe.exe schtasks.exe PID 2644 wrote to memory of 2668 2644 RunMe.exe schtasks.exe PID 2644 wrote to memory of 2668 2644 RunMe.exe schtasks.exe PID 2644 wrote to memory of 584 2644 RunMe.exe RuntimeBroker.exe PID 2644 wrote to memory of 584 2644 RunMe.exe RuntimeBroker.exe PID 2644 wrote to memory of 584 2644 RunMe.exe RuntimeBroker.exe PID 584 wrote to memory of 476 584 RuntimeBroker.exe schtasks.exe PID 584 wrote to memory of 476 584 RuntimeBroker.exe schtasks.exe PID 584 wrote to memory of 476 584 RuntimeBroker.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update.exe"C:\Users\Admin\AppData\Local\Temp\Update.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\is-OGGVE.tmp\Update.tmp"C:\Users\Admin\AppData\Local\Temp\is-OGGVE.tmp\Update.tmp" /SL5="$70120,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Program Files (x86)\MyFolder\RunMe.exe"C:\Program Files (x86)\MyFolder\RunMe.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:2668 -
C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\MyFolder\me.batFilesize
130B
MD50829830a1636e2958b07fc827cb5d3d7
SHA16051bfbf49df5f44c41f20104a079a8d0f7acb94
SHA256b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b
SHA512ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755
-
\Program Files (x86)\MyFolder\RunMe.exeFilesize
3.1MB
MD5392a6ea0718747e4ad443f730047715b
SHA1808d682efeb32bd7f98e49b7b99350683162059e
SHA25636be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257
SHA512b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4
-
\Users\Admin\AppData\Local\Temp\is-OGGVE.tmp\Update.tmpFilesize
3.1MB
MD56a4ac87c4331dc724e6fea16e0ab4b7e
SHA13dcab7b5fc73352c01eb24e827626670fa323cec
SHA2563b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66
SHA512dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6
-
memory/584-63-0x00000000010A0000-0x00000000013C4000-memory.dmpFilesize
3.1MB
-
memory/2460-0-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2460-10-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2460-57-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2460-2-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/2560-32-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/2560-46-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/2560-11-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/2560-56-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/2560-8-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/2644-53-0x0000000000330000-0x0000000000654000-memory.dmpFilesize
3.1MB