Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

497960e1fd...6f.exe

windows7-x64

10

497960e1fd...6f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    111s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 05:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe

  • Size

    13.3MB

  • MD5

    0d6982311c8a21313994773c99380dfb

  • SHA1

    d8a6abfbdf3fe52598f570abeed3b272b10484bd

  • SHA256

    497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f

  • SHA512

    47b4c7f9a8a49ab067d4214d6cb73277bc56f7e671d3ef3c38ca8d845c65dbf2303e083294d71d68bf4348b87558141d4d3281d959d262efe56b29a87e5437c4

  • SSDEEP

    49152:Kqsm55NYMPrb/T7vO90dL3BmAFd4A64nsfJlFngTR55I7NLz1S:Kq95TUGPf

Score
10/10
quasarcom surrogatediscoveryevasionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

COM Surrogate

C2

10.8.1.66:8869

Mutex

119b9028-5664-4725-b2c1-1e4eaf743d68

Attributes
  • encryption_key

    B0092D1E1BA8BCBB825AA0760094E03D6D52E169

  • install_name

    3388.exe

  • log_directory

    COMLogs

  • reconnect_delay

    5000

  • startup_key

    COM Surrogate

Signatures

  • Contains code to disable Windows Defender 4 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe
    "C:\Users\Admin\AppData\Local\Temp\497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\go-memexec-2427138717.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-2427138717.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE
        "C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE"
        3⤵
        • Executes dropped EXE
        PID:4140
      • C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE
        "C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Local\Temp\go-memexec-2927655030.exe
          C:\Users\Admin\AppData\Local\Temp\go-memexec-2927655030.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\go-memexec-2927655030.exe" /rl HIGHEST /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2264
          • C:\Windows\system32\3388.exe
            "C:\Windows\system32\3388.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1464
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Windows\system32\3388.exe" /rl HIGHEST /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:656
      • C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE
        "C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Users\Admin\AppData\Local\Temp\go-memexec-1045855478.exe
          C:\Users\Admin\AppData\Local\Temp\go-memexec-1045855478.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5024
          • \??\c:\windows\system32\cmstp.exe
            "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\1d444jtc.inf
            5⤵
              PID:3952
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\Windows\temp\0rqchlom.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Windows\temp\0rqchlom.exe
        C:\Windows\temp\0rqchlom.exe
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4648
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE
      Filesize

      1.6MB

      MD5

      f50a77623d245a4599777ab4fbf714c6

      SHA1

      ef50b96df7cd351b62bdca83b7244e550d4a2e89

      SHA256

      0f68faff74b9185ca8c48dd2aa5bfdf0ee5dcf0c7a0282e964b4d29d807143cf

      SHA512

      1b8c09465a6cb42a5b121187edbb1082edcd8f5983d61cb243514ef8da4f90a64f7d0d6f9a08b346a869a065f981ab469cc6f97c6edffd5be79f281b180094b6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE
      Filesize

      2.6MB

      MD5

      6f5376f20c7f474f5554222d01456849

      SHA1

      4931b9dc0767c76dc31e3e6c4423a961c0f51d86

      SHA256

      bdbc5164ef806974456f579200541d7c84f643377c86b0bc3c1081ddd1317146

      SHA512

      3c0510afbd1b076889491f7e177e03cd7e73b1debd1c416765bf18890e916a504376af7b04923ee233d78e08124f0d89fc60ca4dcc256ca44adffa87b83a59e0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE
      Filesize

      1.6MB

      MD5

      9af255f8c616c0cce55ba6ebed9575cd

      SHA1

      06e0a3e0183c0dada31c3e7f2195f2156f98f336

      SHA256

      83a53512f6ed96e88941330b73ceffed794603da3204d169eb44826b0a03985f

      SHA512

      05e0c2d059de60ff0186b372198148f3980738e71328366b585045477ef9e3f62ad230fbcbee3c4aac9113f178d77cf2745c0a17205867a12e6dda5766bf14f3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vfxf5nrn.fqe.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\go-memexec-1045855478.exe
      Filesize

      19KB

      MD5

      c6e7fd0dc447c35e6e31aad46e83de96

      SHA1

      5367e124d66f45babf625b56418155ea5a04ccd3

      SHA256

      60a855b888b3021d74803be43ae95ec62ec509ed3d70dd734295d12d9375a0a1

      SHA512

      6c7a43aa7dd335e388db6cb651ab1bfd4e3d3abb82b31dce2900178af27616e330e84d8e5d89a3435eb8939cfed0a23892f3aeac219c883f4e53a51932d61746

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\go-memexec-2427138717.exe
      Filesize

      5.8MB

      MD5

      456fda268601e84c3308378d26dc74d2

      SHA1

      a27d3718b6338927e98a38219862f5859528d5fb

      SHA256

      b9a1d3ee098339ac5942b437f76cb25bf5f33dacb65a883162a447c158702cfb

      SHA512

      a70ab8ffa8f429aa9e98eb181d405ad01333258b4646d67ec3b9743267e56de11cac9eff2a41611e7a3e269f8577a8db6217341f1ca68bdaedafbdd0e7699434

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\go-memexec-2927655030.exe
      Filesize

      502KB

      MD5

      e49e8745bb3748c02b6991155ef988f9

      SHA1

      13ce804a8d4dd951b5535ceb819be3f04372f375

      SHA256

      9e105120064cd753917b8f60a20dedc1d5c33156189afdcc514189b07d23587e

      SHA512

      f7b514a905ba52970f5c17bd91e12a07ebd3e3715d3b5c59284c8f09ea7e4da317fd3968a46b164e520757de9567bd0ef36f0b0bed79e7aacd412032322a416d

      Download Submit

    • C:\Windows\Temp\0rqchlom.exe
      Filesize

      12KB

      MD5

      9cfc5141261e2144858e32a779e4e87f

      SHA1

      5698cb6c917d92a40d44f6e096acbf90be3a86c5

      SHA256

      e117d0ef5ed73d676fb845556b2ca33fe68c1728069ad1df39429b2ad5feaa15

      SHA512

      340af9ef8bad9678ef458e2e57aa79d5038fe1805e8a7a67e5a839efd89f6aa414d0022d233d624317eff1ca225f1b7a3b8637f0555511fddc588a9aeab34003

      Download Submit

    • C:\Windows\temp\1d444jtc.inf
      Filesize

      606B

      MD5

      00b2928899facb1edc3bda24e24715ce

      SHA1

      d35859b8f21de31dd2395379fe0f39aa9100150f

      SHA256

      9aa0aba74bedf19c4006134772a79be3620ade31cd3531e1c43f6f1ccf63994e

      SHA512

      96f1f275e600ff0389a5b0c3f56007d7053365f0c1ad0424a08fbf2806f16379a53327e45ab40e9a0896c241900cc3ff097c429321a9541599074ed9ce7c9830

      Download Submit

    • memory/1240-39-0x0000000000E50000-0x0000000000ED4000-memory.dmp

      Filesize

      528KB

      Download

    • memory/1464-67-0x000000001B180000-0x000000001B1D0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/1464-68-0x000000001B830000-0x000000001B8E2000-memory.dmp

      Filesize

      712KB

      Download

    • memory/4444-47-0x0000000000A50000-0x0000000000A58000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4648-55-0x0000026D0ECB0000-0x0000026D0ECD2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5024-38-0x00000000006E0000-0x00000000006EC000-memory.dmp

      Filesize

      48KB

      Download