Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 16:19
Behavioral task
behavioral1
Sample
f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe
Resource
win10v2004-20241007-en
General
-
Target
f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe
-
Size
3.1MB
-
MD5
15ac9a2e7aa9fba93576ca6efe92f960
-
SHA1
38cea1bad1bcc254ffaec2ec38afaf6e43c7a9eb
-
SHA256
f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0
-
SHA512
b195a2ed477b2b0f20543982a27426ac04097e3a7134fe12b273cabd2da52002ff933155f7c8aa511dabc29c4173fb7a1a2aa997f626725250acd6427af2109a
-
SSDEEP
49152:7v/lL26AaNeWgPhlmVqvMQ7XSKd74wvMfY8oGdahZTHHB72eh2NT:7vNL26AaNeWgPhlmVqkQ7XSKd74wI
Malware Config
Extracted
quasar
1.4.1
RuntimeBroker
anonam39-41248.portmap.io:41248
bcabad1b-b1a9-478b-a187-3607b6476fd1
-
encryption_key
479AF86B7B3A0AC9CE19AAE974A681BB6EE1949C
-
install_name
RuntimeBroker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
a7
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/752-1-0x00000000001B0000-0x00000000004D4000-memory.dmp family_quasar behavioral1/files/0x000800000001941b-6.dat family_quasar behavioral1/memory/2520-9-0x0000000000A10000-0x0000000000D34000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2520 RuntimeBroker.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\a7 RuntimeBroker.exe File created C:\Windows\system32\a7\RuntimeBroker.exe f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe File opened for modification C:\Windows\system32\a7\RuntimeBroker.exe f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe File opened for modification C:\Windows\system32\a7 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe File opened for modification C:\Windows\system32\a7\RuntimeBroker.exe RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 484 schtasks.exe 2332 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe Token: SeDebugPrivilege 2520 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2520 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 752 wrote to memory of 484 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe 31 PID 752 wrote to memory of 484 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe 31 PID 752 wrote to memory of 484 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe 31 PID 752 wrote to memory of 2520 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe 33 PID 752 wrote to memory of 2520 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe 33 PID 752 wrote to memory of 2520 752 f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe 33 PID 2520 wrote to memory of 2332 2520 RuntimeBroker.exe 34 PID 2520 wrote to memory of 2332 2520 RuntimeBroker.exe 34 PID 2520 wrote to memory of 2332 2520 RuntimeBroker.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe"C:\Users\Admin\AppData\Local\Temp\f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0N.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:484
-
-
C:\Windows\system32\a7\RuntimeBroker.exe"C:\Windows\system32\a7\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2332
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD515ac9a2e7aa9fba93576ca6efe92f960
SHA138cea1bad1bcc254ffaec2ec38afaf6e43c7a9eb
SHA256f575fa2dd2b1745a20c2ad55dcdc08ad8423f7c6c224a5f241e7d144e18f31b0
SHA512b195a2ed477b2b0f20543982a27426ac04097e3a7134fe12b273cabd2da52002ff933155f7c8aa511dabc29c4173fb7a1a2aa997f626725250acd6427af2109a