Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 18:28

General

  • Target

    0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe

  • Size

    2.0MB

  • MD5

    40fe3f6effff7596e593c7ecd56502a3

  • SHA1

    4b384c82d3cca32ea9e9bae8dc7af1e4334fed51

  • SHA256

    0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca

  • SHA512

    1b3426aef8e0eaff11b2fed8cec1db85bacec1027bc5c0e32aea329fc7f809747c5a961ada6b9bd7f93c509dde91b3051efeac8af5d8e216e04bb80fa5246109

  • SSDEEP

    24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYJ:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y/

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes
  • encryption_key

    MWhG6wsClMX8aJM2CVXT

  • install_name

    winsock.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win defender run

  • subdirectory

    SubDir

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 5 IoCs
  • Detects executables containing common artifacts observed in infostealers 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
    "C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Local\Temp\vnc.exe
      "C:\Users\Admin\AppData\Local\Temp\vnc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k
        3⤵
        • Maps connected drives based on registry
        PID:2608
    • C:\Users\Admin\AppData\Local\Temp\windef.exe
      "C:\Users\Admin\AppData\Local\Temp\windef.exe"
      2⤵
      • Executes dropped EXE
      PID:2640
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:1128
      • C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
        3⤵
          PID:2712
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f
            4⤵
            • Creates scheduled task(s)
            PID:1940
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\TrSd9xJt8AVP.bat" "
            4⤵
              PID:2960
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                5⤵
                  PID:956
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 10 localhost
                  5⤵
                  • Runs ping.exe
                  PID:1800
                • C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
                  5⤵
                    PID:1744
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 1500
                  4⤵
                  • Program crash
                  PID:1656
            • C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
              "C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"
              2⤵
                PID:2584
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
                2⤵
                • Creates scheduled task(s)
                PID:1712
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {D0ACF43A-9F37-4686-BDD4-54E278563C95} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
              1⤵
                PID:1972
                • C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
                  C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
                  2⤵
                    PID:1820
                    • C:\Users\Admin\AppData\Local\Temp\vnc.exe
                      "C:\Users\Admin\AppData\Local\Temp\vnc.exe"
                      3⤵
                        PID:2392
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k
                          4⤵
                            PID:1104
                        • C:\Users\Admin\AppData\Local\Temp\windef.exe
                          "C:\Users\Admin\AppData\Local\Temp\windef.exe"
                          3⤵
                            PID:308
                          • C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
                            "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"
                            3⤵
                              PID:2316
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
                              3⤵
                              • Creates scheduled task(s)
                              PID:2764

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\TrSd9xJt8AVP.bat

                          Filesize

                          208B

                          MD5

                          b2de5e79e01a9cb01237304807471f1f

                          SHA1

                          d6a1278901542fd14b055cbdc5db284bc78c179d

                          SHA256

                          7c8009d124d1de33d3565af4de23814f299572850e589f479679aa5c9d727374

                          SHA512

                          2a3a43c662dab6434b550d9e6d5eefbdaeecf70239b41d37abc52cfd7e382aa1072bb942ce24f912e023d2a48c1cbfaf93e8c65558c029226936e1970b0e9468

                        • C:\Users\Admin\AppData\Local\Temp\vnc.exe

                          Filesize

                          405KB

                          MD5

                          b8ba87ee4c3fc085a2fed0d839aadce1

                          SHA1

                          b3a2e3256406330e8b1779199bb2b9865122d766

                          SHA256

                          4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4

                          SHA512

                          7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DC4W6HBI.txt

                          Filesize

                          213B

                          MD5

                          746d3ba5c82cfc5fc89bed2668c1e06d

                          SHA1

                          ae2da886d1cdaf05471ceb9ed840a3b20d90889b

                          SHA256

                          ad654ff3404ddb609a812501b9ef03575b4d65a70d9b06a016a2695f3249eb92

                          SHA512

                          4f9aae160b29daf6be6738ff3ad48c336a2bac6b4a437837f3a661b40571c171948b4c6fdca2f51553780f4498962a5fd81d1531ebef595e410d36439f1ad02d

                        • C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

                          Filesize

                          2.0MB

                          MD5

                          5b54d2a9d7a38d30544570e8406875d7

                          SHA1

                          81eb35ecf14c3f419fd220c0ef24bf0451a1f409

                          SHA256

                          b5e2e2276486bf1946b462698ad6b16f9c8316bc8517e258552d4c121e139749

                          SHA512

                          086abdd03d9c91e6cc8b6c53a7c46288c2dabb3af22f51599570faf9b81af17c8e82e6f455a925e45becba7295e3006a8d943b2e96959977ab987ebcbfb64977

                        • \Users\Admin\AppData\Local\Temp\windef.exe

                          Filesize

                          349KB

                          MD5

                          b4a202e03d4135484d0e730173abcc72

                          SHA1

                          01b30014545ea526c15a60931d676f9392ea0c70

                          SHA256

                          7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9

                          SHA512

                          632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

                        • memory/308-116-0x0000000000BD0000-0x0000000000C2E000-memory.dmp

                          Filesize

                          376KB

                        • memory/1104-117-0x0000000000160000-0x00000000001FC000-memory.dmp

                          Filesize

                          624KB

                        • memory/1104-101-0x0000000000160000-0x00000000001FC000-memory.dmp

                          Filesize

                          624KB

                        • memory/1104-99-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

                          Filesize

                          4KB

                        • memory/1540-30-0x0000000000880000-0x0000000000881000-memory.dmp

                          Filesize

                          4KB

                        • memory/2316-114-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/2316-107-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/2316-110-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                        • memory/2584-31-0x0000000000080000-0x00000000000A0000-memory.dmp

                          Filesize

                          128KB

                        • memory/2584-33-0x0000000000080000-0x00000000000A0000-memory.dmp

                          Filesize

                          128KB

                        • memory/2584-39-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                        • memory/2584-43-0x0000000000080000-0x00000000000A0000-memory.dmp

                          Filesize

                          128KB

                        • memory/2608-46-0x0000000000020000-0x0000000000021000-memory.dmp

                          Filesize

                          4KB

                        • memory/2608-49-0x0000000000190000-0x000000000022C000-memory.dmp

                          Filesize

                          624KB

                        • memory/2608-53-0x0000000000190000-0x000000000022C000-memory.dmp

                          Filesize

                          624KB

                        • memory/2608-48-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

                          Filesize

                          4KB

                        • memory/2640-54-0x0000000001160000-0x00000000011BE000-memory.dmp

                          Filesize

                          376KB

                        • memory/2712-64-0x0000000001000000-0x000000000105E000-memory.dmp

                          Filesize

                          376KB