Analysis
-
max time kernel
6s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 20:14
Behavioral task
behavioral1
Sample
SystemPropertiesPerformance.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SystemPropertiesPerformance.exe
Resource
win10v2004-20240802-en
General
-
Target
SystemPropertiesPerformance.exe
-
Size
2.0MB
-
MD5
dfbc6ca1e054a26d40e2ca06c8ebecdf
-
SHA1
0b8445b40da39496c44080baef5928bc1a3d54bc
-
SHA256
76189a74bf343877a2099a2d970eccbc354d8eabd07bc6acc018e99e067bb9fe
-
SHA512
73319d7c2bdef5196eaf8de0a26d92bc2d34c278ca32b8d1000f03d6ef451900e22f42cfe4e8dc72a9be09428048675625184e1c3021ecfde49b039fec3dcfc7
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYC:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YM
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/3428-30-0x0000000000ED0000-0x0000000000F2E000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SystemPropertiesPerformance.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation SystemPropertiesPerformance.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 3272 vnc.exe 3428 windef.exe 4904 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
SystemPropertiesPerformance.exedescription ioc process File opened (read-only) \??\v: SystemPropertiesPerformance.exe File opened (read-only) \??\x: SystemPropertiesPerformance.exe File opened (read-only) \??\l: SystemPropertiesPerformance.exe File opened (read-only) \??\m: SystemPropertiesPerformance.exe File opened (read-only) \??\r: SystemPropertiesPerformance.exe File opened (read-only) \??\u: SystemPropertiesPerformance.exe File opened (read-only) \??\t: SystemPropertiesPerformance.exe File opened (read-only) \??\a: SystemPropertiesPerformance.exe File opened (read-only) \??\k: SystemPropertiesPerformance.exe File opened (read-only) \??\q: SystemPropertiesPerformance.exe File opened (read-only) \??\s: SystemPropertiesPerformance.exe File opened (read-only) \??\e: SystemPropertiesPerformance.exe File opened (read-only) \??\j: SystemPropertiesPerformance.exe File opened (read-only) \??\y: SystemPropertiesPerformance.exe File opened (read-only) \??\z: SystemPropertiesPerformance.exe File opened (read-only) \??\n: SystemPropertiesPerformance.exe File opened (read-only) \??\o: SystemPropertiesPerformance.exe File opened (read-only) \??\p: SystemPropertiesPerformance.exe File opened (read-only) \??\w: SystemPropertiesPerformance.exe File opened (read-only) \??\b: SystemPropertiesPerformance.exe File opened (read-only) \??\g: SystemPropertiesPerformance.exe File opened (read-only) \??\h: SystemPropertiesPerformance.exe File opened (read-only) \??\i: SystemPropertiesPerformance.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SystemPropertiesPerformance.exedescription pid process target process PID 1648 set thread context of 4068 1648 SystemPropertiesPerformance.exe SystemPropertiesPerformance.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3608 3272 WerFault.exe vnc.exe 1724 3380 WerFault.exe vnc.exe 4892 4904 WerFault.exe winsock.exe 4508 4772 WerFault.exe winsock.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
SystemPropertiesPerformance.exevnc.exewindef.exeSystemPropertiesPerformance.exeschtasks.exeschtasks.exewinsock.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SystemPropertiesPerformance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SystemPropertiesPerformance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
PING.EXEPING.EXEpid process 4944 PING.EXE 4628 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5080 schtasks.exe 4040 schtasks.exe 3820 schtasks.exe 4768 schtasks.exe 1332 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SystemPropertiesPerformance.exepid process 1648 SystemPropertiesPerformance.exe 1648 SystemPropertiesPerformance.exe 1648 SystemPropertiesPerformance.exe 1648 SystemPropertiesPerformance.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 3428 windef.exe Token: SeDebugPrivilege 4904 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 4904 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
SystemPropertiesPerformance.exevnc.exewindef.exewinsock.exedescription pid process target process PID 1648 wrote to memory of 3272 1648 SystemPropertiesPerformance.exe vnc.exe PID 1648 wrote to memory of 3272 1648 SystemPropertiesPerformance.exe vnc.exe PID 1648 wrote to memory of 3272 1648 SystemPropertiesPerformance.exe vnc.exe PID 1648 wrote to memory of 3428 1648 SystemPropertiesPerformance.exe windef.exe PID 1648 wrote to memory of 3428 1648 SystemPropertiesPerformance.exe windef.exe PID 1648 wrote to memory of 3428 1648 SystemPropertiesPerformance.exe windef.exe PID 3272 wrote to memory of 1212 3272 vnc.exe svchost.exe PID 3272 wrote to memory of 1212 3272 vnc.exe svchost.exe PID 3272 wrote to memory of 1212 3272 vnc.exe svchost.exe PID 1648 wrote to memory of 4068 1648 SystemPropertiesPerformance.exe SystemPropertiesPerformance.exe PID 1648 wrote to memory of 4068 1648 SystemPropertiesPerformance.exe SystemPropertiesPerformance.exe PID 1648 wrote to memory of 4068 1648 SystemPropertiesPerformance.exe SystemPropertiesPerformance.exe PID 1648 wrote to memory of 4068 1648 SystemPropertiesPerformance.exe SystemPropertiesPerformance.exe PID 1648 wrote to memory of 4068 1648 SystemPropertiesPerformance.exe SystemPropertiesPerformance.exe PID 1648 wrote to memory of 4040 1648 SystemPropertiesPerformance.exe schtasks.exe PID 1648 wrote to memory of 4040 1648 SystemPropertiesPerformance.exe schtasks.exe PID 1648 wrote to memory of 4040 1648 SystemPropertiesPerformance.exe schtasks.exe PID 3428 wrote to memory of 3820 3428 windef.exe schtasks.exe PID 3428 wrote to memory of 3820 3428 windef.exe schtasks.exe PID 3428 wrote to memory of 3820 3428 windef.exe schtasks.exe PID 3428 wrote to memory of 4904 3428 windef.exe winsock.exe PID 3428 wrote to memory of 4904 3428 windef.exe winsock.exe PID 3428 wrote to memory of 4904 3428 windef.exe winsock.exe PID 4904 wrote to memory of 4768 4904 winsock.exe schtasks.exe PID 4904 wrote to memory of 4768 4904 winsock.exe schtasks.exe PID 4904 wrote to memory of 4768 4904 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 5483⤵
- Program crash
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3820 -
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6C7u4DKgtmru.bat" "4⤵PID:5000
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:3448
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4944 -
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:4772
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pWlbQvUCnZUb.bat" "6⤵PID:3708
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:2352
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4628 -
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵PID:2464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 22326⤵
- Program crash
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 16684⤵
- Program crash
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3272 -ip 32721⤵PID:1104
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:3380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 5203⤵
- Program crash
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:3636
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:4964
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3380 -ip 33801⤵PID:832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4904 -ip 49041⤵PID:3500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4772 -ip 47721⤵PID:1660
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4388
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:760
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4172
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3012
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3028
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3656
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1356
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4004
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:432
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2004
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4512
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1080
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD57dd06cc88a4e5b7292159d73c2111f28
SHA1b8b426b66c4940235097085a4eeb9320dc34ee03
SHA25689206c970a2e298e5a029b69b6b6d97e1b385a7b11b64e82a299e507d31e5ecc
SHA512bd33787213c0ad31aefd9f51aa67038f18260b3faba10361c761c8c2d4818ca5067b67ffc4e02fa61771ae134f2061959c6512a00052ba277089bd3109f400e8
-
Filesize
208B
MD5e6e5f6b16c701ba9d64e32445d31a863
SHA1d11f5944cf4d6e0b7dd15c3f9e3257e2eb832a74
SHA256d372cea26b8310d301443c646e337f6249b9ef57afcd0c0bc615cb2142665edc
SHA51254ef802c532075047056619cb75d618090f6d1244d419a18e0e632707d9f50eac4efc94f80bcbbeabecd215be9cf553800626119aec51115c15391646bfc0b69
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD591cfa8199810f46d41399f07101fbf85
SHA154fda62dec94d3a9d7e64dd3d40ebb1e1e7c996f
SHA256c4ee6ed7fe5eaf7f19d4aab7c472f44019dd0ea9a1dfcfcc29e12eb4f8e8bc5c
SHA5129dccf168ce40c760cee266093f6f939cfe5101b9fb4a92bb5433a551462cb668f747fc3ec0b20ee898222f9c90e6ed7ff7e98cdaaf88cdf23921f351112929f4
-
Filesize
2.0MB
MD5d5841b5501109d580c91d3b3f56d0a57
SHA1d1d8052577cc85095621453096dd8266980d5b8c
SHA256b33107fd74ec9a913aa4a8544c4666e2ee36422b383d638bb7d5a14328ce4b0a
SHA5120fa578bab4b865d4ce23f7c3243001b7ef8d684dc38f692d50c428c2d65671b5af8afc81688bd9dd90d7ebb6449a6256d42d0909654529059193e78e77e02612