Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    30s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 23:51

General

  • Target

    Client-built2.exe

  • Size

    342KB

  • MD5

    13068ff1db0fbb26129b02afe8567572

  • SHA1

    0fe5b876286049d09c1f4dbf0259c0dac94f1a8a

  • SHA256

    12dc2baf687f02a7df0fed338cb08d23f36a4a603ca5f79c4ac4e56a5ba513f8

  • SHA512

    939594001ac03b07e242cbf9b98067e25eab2684d68b489d702032bfaf941f9ce37d5514cef6d57d856f1e97caf73fa666de6ee1f5604fc95c7ba8169c4cc9a3

  • SSDEEP

    6144:f8CnG6AjVvEdTn4b12eBNwktELSSvllMr2aZn55e45N7m6NiQ+1cuAIfu:f8BIdUbjNvpXr2aTdm6NiXc7f

Malware Config

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built2.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built2.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4540
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4304
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /sc MINUTE /MO 1
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

    Filesize

    342KB

    MD5

    13068ff1db0fbb26129b02afe8567572

    SHA1

    0fe5b876286049d09c1f4dbf0259c0dac94f1a8a

    SHA256

    12dc2baf687f02a7df0fed338cb08d23f36a4a603ca5f79c4ac4e56a5ba513f8

    SHA512

    939594001ac03b07e242cbf9b98067e25eab2684d68b489d702032bfaf941f9ce37d5514cef6d57d856f1e97caf73fa666de6ee1f5604fc95c7ba8169c4cc9a3

  • memory/1392-0-0x00007FFFEFE53000-0x00007FFFEFE55000-memory.dmp

    Filesize

    8KB

  • memory/1392-1-0x00000000004F0000-0x00000000004F8000-memory.dmp

    Filesize

    32KB

  • memory/1392-2-0x0000000000DB0000-0x0000000000E4E000-memory.dmp

    Filesize

    632KB

  • memory/1392-3-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

    Filesize

    10.8MB

  • memory/1392-4-0x0000000002670000-0x0000000002682000-memory.dmp

    Filesize

    72KB

  • memory/1392-5-0x00007FFFEFE53000-0x00007FFFEFE55000-memory.dmp

    Filesize

    8KB

  • memory/1392-6-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

    Filesize

    10.8MB

  • memory/1392-12-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

    Filesize

    10.8MB

  • memory/1772-13-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

    Filesize

    10.8MB

  • memory/1772-14-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

    Filesize

    10.8MB