Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
Client-built2.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Client-built2.exe
Resource
win10v2004-20240508-en
General
-
Target
Client-built2.exe
-
Size
342KB
-
MD5
13068ff1db0fbb26129b02afe8567572
-
SHA1
0fe5b876286049d09c1f4dbf0259c0dac94f1a8a
-
SHA256
12dc2baf687f02a7df0fed338cb08d23f36a4a603ca5f79c4ac4e56a5ba513f8
-
SHA512
939594001ac03b07e242cbf9b98067e25eab2684d68b489d702032bfaf941f9ce37d5514cef6d57d856f1e97caf73fa666de6ee1f5604fc95c7ba8169c4cc9a3
-
SSDEEP
6144:f8CnG6AjVvEdTn4b12eBNwktELSSvllMr2aZn55e45N7m6NiQ+1cuAIfu:f8BIdUbjNvpXr2aTdm6NiXc7f
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Client.exe -
Executes dropped EXE 1 IoCs
pid Process 1772 Client.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quasar Client Startup = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\"" Client.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com 8 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3348 schtasks.exe 4540 schtasks.exe 4304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1392 Client-built2.exe 1392 Client-built2.exe 1392 Client-built2.exe 1392 Client-built2.exe 1392 Client-built2.exe 1772 Client.exe 1772 Client.exe 1772 Client.exe 1772 Client.exe 1772 Client.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1392 Client-built2.exe Token: SeDebugPrivilege 1772 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1772 Client.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1392 wrote to memory of 4540 1392 Client-built2.exe 82 PID 1392 wrote to memory of 4540 1392 Client-built2.exe 82 PID 1392 wrote to memory of 1772 1392 Client-built2.exe 84 PID 1392 wrote to memory of 1772 1392 Client-built2.exe 84 PID 1772 wrote to memory of 4304 1772 Client.exe 85 PID 1772 wrote to memory of 4304 1772 Client.exe 85 PID 1772 wrote to memory of 3348 1772 Client.exe 87 PID 1772 wrote to memory of 3348 1772 Client.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built2.exe"C:\Users\Admin\AppData\Local\Temp\Client-built2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built2.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4540
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4304
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /sc MINUTE /MO 13⤵
- Scheduled Task/Job: Scheduled Task
PID:3348
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342KB
MD513068ff1db0fbb26129b02afe8567572
SHA10fe5b876286049d09c1f4dbf0259c0dac94f1a8a
SHA25612dc2baf687f02a7df0fed338cb08d23f36a4a603ca5f79c4ac4e56a5ba513f8
SHA512939594001ac03b07e242cbf9b98067e25eab2684d68b489d702032bfaf941f9ce37d5514cef6d57d856f1e97caf73fa666de6ee1f5604fc95c7ba8169c4cc9a3