Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/09/2024, 19:17
240919-xzbwqswana 919/09/2024, 14:45
240919-r421tsvbjr 719/09/2024, 14:37
240919-rzaqsatcnc 7Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 14:37
General
-
Target
qitasc.exe
-
Size
5.1MB
-
MD5
43ebe9df7e67597a160f5effa8868bf3
-
SHA1
3cd79d15f53e36e4864122d7af81d12581fbf71c
-
SHA256
1859dfca6e5251f22c90aa4245a953c6afb26b0d2e6dec2b4747ceef4f7df18d
-
SHA512
c3d73c071ea7da40aad5e693e7690018f488c6d9b74577e111a016deca9fef4725436ee940f82b7940505db21a59f64dedad903a52d0dd39f8446b7f7f99758a
-
SSDEEP
49152:XOuEZOZHIXrb/TCvO90dL3BmAFd4A64nsfJIUGBXbLxPCZMKd33UicObbWdE5qeH:XOu1oiUoB4X37Z5q0RjyJRJ3pQ+E
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\qitasc.exe"C:\Users\Admin\AppData\Local\Temp\qitasc.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -version2⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\QiTASC\installer\installer-gui.jar2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4444,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD526fce827644482663f3572255a2f2070
SHA1794c3b39f76c7d388c2b763e4021e5045f5a808c
SHA25632fb01fea0a325d1cfaebea319836a607476a7918d2f13a050526e35bec33eda
SHA51270c62a0283318c0013c2283d2e2d9de4bbf8beb770fc4469e3c529537e482479c955c8f744aab2b99a4c3c87eac2847189083c83904f17e7e979bcda8969e553
-
Filesize
574B
MD5270939667b2c1e18fc19f98a89782a6f
SHA166612051ead4493da44723eb408927ae4c31eb00
SHA256bb1b7ddfd74257040ad2a8f4f55918983960a1d2e9690aff388949fb65b373c0
SHA5120eaec2ad1397d417a5e63f7dc21843f720888e5a679d9f49a943c0832724b5d12c62ce46ed31b3b096202b2004bcc324fe4add03e993ba03fa02bbfaf4f7fcd6
-
Filesize
5.7MB
MD5ef7879d4b7f850f161c2eb569c528a7b
SHA15400d9b6bff2c01e37a5fb921af0268f86e74fd2
SHA256cc96c40bc12c33bf4b3457ef9d1f5a60f018efb0f5ad728272c360fb48ba9446
SHA512ab79e23fcc03427bfcd58cf8179a8dc597f306255b1f0e9a139ed6f9ff2ba62c86f48a2b882b6afc6dc002ce3abffd2f8a499893d4134bb72e330fe1a6fe823c
-
Filesize
34B
MD517c98c6eec35c4462440578981fbc4f9
SHA1cbd7f9f7fc7a591f03868a2a16384bfbba3c0ac8
SHA256958d0c427ac396becf36406da82e8724484f875d1339e64e5173e914e802b980
SHA5126b35bfc2baa8297778f619d333ca1b3e834addf42565d4621e77e9320ee2982669c60d68923924ddf93f5853072ac8bb739770f6ba83d6a1c801cd995a708264
-
Filesize
39KB
MD5376e4cfaa0cb5b487b2b5a5426bea58a
SHA1935f228e0f92018b31657f97391d84d147ab929a
SHA2562352605e14708002c4e2943246bc2e0ff77afa1eff408c05e1d248b0ba6f480c
SHA51212d6127cc68d009410610f7ddf0bd4d830f2a911ea5f856d160be468cffe7ebf000f77259b8628dc3d0063f6fe2c6bf35de7266a4518ba00e5b0198bcce28f5c
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB