Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 01:34
Behavioral task
behavioral1
Sample
nigger.exe
Resource
win7-20240705-en
General
-
Target
nigger.exe
-
Size
3.1MB
-
MD5
4999b135603f44230d18f73c4308bffe
-
SHA1
691754c54a1aa05a09ed28512d1b0abf6968ac15
-
SHA256
d68f05e53c7442acc2a4f45dcada6edcc6a2ae5538ae504181176e9eed419e71
-
SHA512
e3a5362cdea95b0a0d5bb1b5b59d9d01948228d2a4ba216281ae2854523a6c11600251dbde18123e7c017f6d7712060ab089bdcc0f0b91db65ba8cf226c6fb06
-
SSDEEP
49152:DvXG42pda6D+/PjlLOlg6yQipVBXac5L3Ak/d8oGd2LdTHHB72eh2NT:Dv242pda6D+/PjlLOlZyQipVhaV
Malware Config
Extracted
quasar
1.4.1
massdm
192.168.1.156:4782
r-minolta.gl.at.ply.gg:63431
7a0df206-428b-4b7b-939a-21fd6eb0a342
-
encryption_key
EB77EF1E2C1E9FC0CC580EBFBB1E68F8B012F37E
-
install_name
massdm.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/1756-1-0x0000000000270000-0x0000000000594000-memory.dmp family_quasar behavioral1/files/0x0034000000015bd7-6.dat family_quasar behavioral1/memory/3048-10-0x0000000000100000-0x0000000000424000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3048 massdm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1920 schtasks.exe 2864 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1756 nigger.exe Token: SeDebugPrivilege 3048 massdm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3048 massdm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1756 wrote to memory of 1920 1756 nigger.exe 29 PID 1756 wrote to memory of 1920 1756 nigger.exe 29 PID 1756 wrote to memory of 1920 1756 nigger.exe 29 PID 1756 wrote to memory of 3048 1756 nigger.exe 31 PID 1756 wrote to memory of 3048 1756 nigger.exe 31 PID 1756 wrote to memory of 3048 1756 nigger.exe 31 PID 3048 wrote to memory of 2864 3048 massdm.exe 32 PID 3048 wrote to memory of 2864 3048 massdm.exe 32 PID 3048 wrote to memory of 2864 3048 massdm.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\nigger.exe"C:\Users\Admin\AppData\Local\Temp\nigger.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\massdm.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1920
-
-
C:\Users\Admin\AppData\Roaming\SubDir\massdm.exe"C:\Users\Admin\AppData\Roaming\SubDir\massdm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\massdm.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD54999b135603f44230d18f73c4308bffe
SHA1691754c54a1aa05a09ed28512d1b0abf6968ac15
SHA256d68f05e53c7442acc2a4f45dcada6edcc6a2ae5538ae504181176e9eed419e71
SHA512e3a5362cdea95b0a0d5bb1b5b59d9d01948228d2a4ba216281ae2854523a6c11600251dbde18123e7c017f6d7712060ab089bdcc0f0b91db65ba8cf226c6fb06