Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 18:28
Behavioral task
behavioral1
Sample
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
Resource
win10v2004-20240426-en
General
-
Target
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
-
Size
2.0MB
-
MD5
40fe3f6effff7596e593c7ecd56502a3
-
SHA1
4b384c82d3cca32ea9e9bae8dc7af1e4334fed51
-
SHA256
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca
-
SHA512
1b3426aef8e0eaff11b2fed8cec1db85bacec1027bc5c0e32aea329fc7f809747c5a961ada6b9bd7f93c509dde91b3051efeac8af5d8e216e04bb80fa5246109
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYJ:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y/
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 5 IoCs
resource yara_rule behavioral1/files/0x002f0000000133b7-26.dat family_quasar behavioral1/memory/2640-54-0x0000000001160000-0x00000000011BE000-memory.dmp family_quasar behavioral1/memory/2712-64-0x0000000001000000-0x000000000105E000-memory.dmp family_quasar behavioral1/files/0x000a0000000139d6-66.dat family_quasar behavioral1/memory/308-116-0x0000000000BD0000-0x0000000000C2E000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 5 IoCs
resource yara_rule behavioral1/files/0x002f0000000133b7-26.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2640-54-0x0000000001160000-0x00000000011BE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2712-64-0x0000000001000000-0x000000000105E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x000a0000000139d6-66.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/308-116-0x0000000000BD0000-0x0000000000C2E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 5 IoCs
resource yara_rule behavioral1/files/0x002f0000000133b7-26.dat INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2640-54-0x0000000001160000-0x00000000011BE000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2712-64-0x0000000001000000-0x000000000105E000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/files/0x000a0000000139d6-66.dat INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/308-116-0x0000000000BD0000-0x0000000000C2E000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 2 IoCs
pid Process 2148 vnc.exe 2640 windef.exe -
Loads dropped DLL 8 IoCs
pid Process 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\q: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\t: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\u: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\y: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\j: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\e: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\h: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\k: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\m: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\n: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\w: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\z: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\b: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\i: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\p: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\x: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\a: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\o: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\r: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\s: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\v: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\g: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 svchost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000a0000000139d6-66.dat autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1540 set thread context of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 2148 set thread context of 2608 2148 vnc.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1656 2712 WerFault.exe 37 -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1712 schtasks.exe 1128 schtasks.exe 1940 schtasks.exe 2764 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1800 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2148 vnc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2148 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 28 PID 1540 wrote to memory of 2148 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 28 PID 1540 wrote to memory of 2148 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 28 PID 1540 wrote to memory of 2148 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 28 PID 2148 wrote to memory of 2608 2148 vnc.exe 29 PID 2148 wrote to memory of 2608 2148 vnc.exe 29 PID 2148 wrote to memory of 2608 2148 vnc.exe 29 PID 2148 wrote to memory of 2608 2148 vnc.exe 29 PID 2148 wrote to memory of 2608 2148 vnc.exe 29 PID 1540 wrote to memory of 2640 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 30 PID 1540 wrote to memory of 2640 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 30 PID 1540 wrote to memory of 2640 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 30 PID 1540 wrote to memory of 2640 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 30 PID 1540 wrote to memory of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 1540 wrote to memory of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 1540 wrote to memory of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 1540 wrote to memory of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 1540 wrote to memory of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 1540 wrote to memory of 2584 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 31 PID 1540 wrote to memory of 1712 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 32 PID 1540 wrote to memory of 1712 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 32 PID 1540 wrote to memory of 1712 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 32 PID 1540 wrote to memory of 1712 1540 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 32 PID 2148 wrote to memory of 2608 2148 vnc.exe 29 PID 2148 wrote to memory of 2608 2148 vnc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
PID:2608
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1128
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵PID:2712
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:1940
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TrSd9xJt8AVP.bat" "4⤵PID:2960
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:956
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:1800
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:1744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 15004⤵
- Program crash
PID:1656
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"2⤵PID:2584
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1712
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D0ACF43A-9F37-4686-BDD4-54E278563C95} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵PID:1972
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe2⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"3⤵PID:2392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k4⤵PID:1104
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"3⤵PID:308
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"3⤵PID:2316
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5b2de5e79e01a9cb01237304807471f1f
SHA1d6a1278901542fd14b055cbdc5db284bc78c179d
SHA2567c8009d124d1de33d3565af4de23814f299572850e589f479679aa5c9d727374
SHA5122a3a43c662dab6434b550d9e6d5eefbdaeecf70239b41d37abc52cfd7e382aa1072bb942ce24f912e023d2a48c1cbfaf93e8c65558c029226936e1970b0e9468
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
213B
MD5746d3ba5c82cfc5fc89bed2668c1e06d
SHA1ae2da886d1cdaf05471ceb9ed840a3b20d90889b
SHA256ad654ff3404ddb609a812501b9ef03575b4d65a70d9b06a016a2695f3249eb92
SHA5124f9aae160b29daf6be6738ff3ad48c336a2bac6b4a437837f3a661b40571c171948b4c6fdca2f51553780f4498962a5fd81d1531ebef595e410d36439f1ad02d
-
Filesize
2.0MB
MD55b54d2a9d7a38d30544570e8406875d7
SHA181eb35ecf14c3f419fd220c0ef24bf0451a1f409
SHA256b5e2e2276486bf1946b462698ad6b16f9c8316bc8517e258552d4c121e139749
SHA512086abdd03d9c91e6cc8b6c53a7c46288c2dabb3af22f51599570faf9b81af17c8e82e6f455a925e45becba7295e3006a8d943b2e96959977ab987ebcbfb64977
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb