Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2024, 22:39
Behavioral task
behavioral1
Sample
630c1e5dc1eba3f298e0296ab71ede80N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
630c1e5dc1eba3f298e0296ab71ede80N.exe
Resource
win10v2004-20240802-en
General
-
Target
630c1e5dc1eba3f298e0296ab71ede80N.exe
-
Size
2.0MB
-
MD5
630c1e5dc1eba3f298e0296ab71ede80
-
SHA1
3e4aa4f0111cc295ced8c9d84d79c2ccaf2c2afe
-
SHA256
1c0a2c6ea9e3cf451c09f529d7df9a2ab3f1c5bd7dec5e9dc4aae539f323bba8
-
SHA512
51e0f1c47dd61f335366c665490b8887f41a3dedd47b936cbcb1ef40e5a7bbf9aabf36cd937d282a64d692bb11f8f6b59df08ef5a7a4320afb593e5735996728
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYU:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YS
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000700000002345a-17.dat family_quasar behavioral2/memory/2420-30-0x0000000000A80000-0x0000000000ADE000-memory.dmp family_quasar behavioral2/files/0x000700000002345c-46.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 630c1e5dc1eba3f298e0296ab71ede80N.exe -
Executes dropped EXE 3 IoCs
pid Process 5040 vnc.exe 2420 windef.exe 1940 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\a: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\b: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\e: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\h: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\i: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\j: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\o: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\u: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\v: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\g: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\q: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\x: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\l: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\p: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\t: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\k: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\m: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\n: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\r: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\w: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\y: 630c1e5dc1eba3f298e0296ab71ede80N.exe File opened (read-only) \??\z: 630c1e5dc1eba3f298e0296ab71ede80N.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000700000002345c-46.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4392 set thread context of 3764 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3680 5040 WerFault.exe 84 4756 644 WerFault.exe 110 4764 1940 WerFault.exe 98 4456 3716 WerFault.exe 126 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630c1e5dc1eba3f298e0296ab71ede80N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630c1e5dc1eba3f298e0296ab71ede80N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5104 PING.EXE 4408 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5104 PING.EXE 4408 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 216 schtasks.exe 4704 schtasks.exe 2336 schtasks.exe 2340 schtasks.exe 2196 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2420 windef.exe Token: SeDebugPrivilege 1940 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1940 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4392 wrote to memory of 5040 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 84 PID 4392 wrote to memory of 5040 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 84 PID 4392 wrote to memory of 5040 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 84 PID 4392 wrote to memory of 2420 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 87 PID 4392 wrote to memory of 2420 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 87 PID 4392 wrote to memory of 2420 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 87 PID 5040 wrote to memory of 4932 5040 vnc.exe 88 PID 5040 wrote to memory of 4932 5040 vnc.exe 88 PID 5040 wrote to memory of 4932 5040 vnc.exe 88 PID 4392 wrote to memory of 3764 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 90 PID 4392 wrote to memory of 3764 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 90 PID 4392 wrote to memory of 3764 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 90 PID 4392 wrote to memory of 3764 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 90 PID 4392 wrote to memory of 3764 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 90 PID 4392 wrote to memory of 216 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 91 PID 4392 wrote to memory of 216 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 91 PID 4392 wrote to memory of 216 4392 630c1e5dc1eba3f298e0296ab71ede80N.exe 91 PID 2420 wrote to memory of 4704 2420 windef.exe 96 PID 2420 wrote to memory of 4704 2420 windef.exe 96 PID 2420 wrote to memory of 4704 2420 windef.exe 96 PID 2420 wrote to memory of 1940 2420 windef.exe 98 PID 2420 wrote to memory of 1940 2420 windef.exe 98 PID 2420 wrote to memory of 1940 2420 windef.exe 98 PID 1940 wrote to memory of 2336 1940 winsock.exe 99 PID 1940 wrote to memory of 2336 1940 winsock.exe 99 PID 1940 wrote to memory of 2336 1940 winsock.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\630c1e5dc1eba3f298e0296ab71ede80N.exe"C:\Users\Admin\AppData\Local\Temp\630c1e5dc1eba3f298e0296ab71ede80N.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 5483⤵
- Program crash
PID:3680
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4704
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2336
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fh85kjBKEWBV.bat" "4⤵PID:4624
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:3996
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5104
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:3716
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:2196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VltISJ4eWlnK.bat" "6⤵PID:932
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:4404
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 22086⤵
- Program crash
PID:4456
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 22484⤵
- Program crash
PID:4764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\630c1e5dc1eba3f298e0296ab71ede80N.exe"C:\Users\Admin\AppData\Local\Temp\630c1e5dc1eba3f298e0296ab71ede80N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3764
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 50401⤵PID:3532
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:2560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 5203⤵
- Program crash
PID:4756
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:5036
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:2300
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 644 -ip 6441⤵PID:4452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1940 -ip 19401⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3716 -ip 37161⤵PID:3372
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4844
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD5fa976f6958f8d2f5a83eb5d89c78aceb
SHA186ee7fca5904601f9b06d058961c556e56cb5815
SHA2567d537fc4901c169bb2a311f4785ab8246967ff3dcbb1186ff57fa31e9ec927e8
SHA5120958fabdf8183f2eb9de87b5302605a9ee79e7aac6ba9c0955b44e430a6f130229e576171a68d64da97219af5f880c225adf0a069bacf4aaf4ee82d8af6e5afb
-
Filesize
208B
MD58aa00a959d5b493e30889bb4db11ce9c
SHA1c957174090a8fc89d25df2cc565df6f3b965d1f9
SHA256916e44ab4916503db51214a4e2d414fd0c4fbf9d8ccf8d2d25df873506bf063b
SHA512d5a396400f37c71e744d674ff6f2ddba7e6fb58c0c526d6a1f10b69bce3db262a7e974e9ce58be8de3a9d53f21d635105d330f9ddab42f0c69f1b4006f7968f3
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD573692dd1d171f40df68519157b8bd27c
SHA1a25e2c6ab35085592cf5f50d211ec103701f97ce
SHA256ff862c2b12b5a678e443325ffda6f45de03dc18e2ab3f7d82f4fe44aae1e7c19
SHA5127e08a516832291bd9a4279a4e657865df4c6b4dfc7271af55ea67b5f0f78d41a1c7ebdc06edecf376b0d71c90ebc987830669222495ea4a8e23853b1e04928d8
-
Filesize
2.0MB
MD586d557ddb207c4a30fd6eaeadaa1aca1
SHA121dd484062ba2858bd9b022070cad85e3c4c5016
SHA2566f3fbec639d5155d42aeec0a14b6bd8a9d179c890c7abc3b4a0b2705a21e22d7
SHA512b464097f54e933f2e0365fd90381f9b1d1e5082b8d1330ed9c8f4cee25f437ecc908ae4b162db506be4bd9f10c073a60308a5158ab38d47c9793c727b5cddbd1