Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 17:21
Behavioral task
behavioral1
Sample
3ba0319e73189975e4d8a212772eddc1.exe
Resource
win7-20240704-en
4 signatures
150 seconds
General
-
Target
3ba0319e73189975e4d8a212772eddc1.exe
-
Size
3.1MB
-
MD5
3ba0319e73189975e4d8a212772eddc1
-
SHA1
935590495562e460c2e028220c583cc93ec97c30
-
SHA256
59b6f157ec7087a025c17d6beecf7d7f3f49106319fbf05708eef51d79b9eee9
-
SHA512
1e1e6f1e6da985451d5f148a398ceb1579fa18d4f30fddd2bae20d481268042a2739c8f7475ff3c1f538d8a80a562f121294d582a8185b63255d2883dea64607
-
SSDEEP
49152:mvBt62XlaSFNWPjljiFa2RoUYImiZFUQmPVoGdGcPGTHHB72eh2NT:mvr62XlaSFNWPjljiFXRoUYImiZFQV
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
45.138.16.215:4782
Mutex
5e9da8c1-b2c5-4ac5-82e5-0040a23e9942
Attributes
-
encryption_key
2243A5B4C698492DB2EDF4E8400CCBCED4A026A1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
syshosts
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/2672-1-0x0000000000F00000-0x0000000001224000-memory.dmp family_quasar -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2672 3ba0319e73189975e4d8a212772eddc1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 3ba0319e73189975e4d8a212772eddc1.exe