Analysis
-
max time kernel
33s -
max time network
36s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03-12-2024 20:16
Static task
static1
General
-
Target
Panel Ejecutador MTA 3.14.zip
-
Size
1.1MB
-
MD5
d345c2eb24b0d3806865fda604ad1cc8
-
SHA1
6b813317f6108f2c242babda58097070503df242
-
SHA256
9261f3eefa0aef107e865784d8b8b62d4e7213056dfe535893920a344fa0d908
-
SHA512
76c941b833ffcef6da121c2e2735952ed81cbf7c6a6260a227040d37abf0adaa41461045c69710331345d52d95aac89ddf0a256ebc85fbdb2ed703106999ab74
-
SSDEEP
24576:ioRau4l48JTUIlfSsqFDxCs3+UgQYuX370FBZa:ioRUv5UIYsqOs3+UPY234m
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x002800000004504b-2.dat family_quasar behavioral1/memory/988-5-0x0000000000A50000-0x0000000000DA6000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Panel Ejecutador MTA 3.14.exeWindowsUpdate.exepid Process 988 Panel Ejecutador MTA 3.14.exe 1900 WindowsUpdate.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid Process 4260 schtasks.exe 4916 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid Process 2168 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
7zFM.exePanel Ejecutador MTA 3.14.exeWindowsUpdate.exedescription pid Process Token: SeRestorePrivilege 2168 7zFM.exe Token: 35 2168 7zFM.exe Token: SeSecurityPrivilege 2168 7zFM.exe Token: SeDebugPrivilege 988 Panel Ejecutador MTA 3.14.exe Token: SeDebugPrivilege 1900 WindowsUpdate.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
7zFM.exepid Process 2168 7zFM.exe 2168 7zFM.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WindowsUpdate.exepid Process 1900 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Panel Ejecutador MTA 3.14.exeWindowsUpdate.exedescription pid Process procid_target PID 988 wrote to memory of 4260 988 Panel Ejecutador MTA 3.14.exe 91 PID 988 wrote to memory of 4260 988 Panel Ejecutador MTA 3.14.exe 91 PID 988 wrote to memory of 1900 988 Panel Ejecutador MTA 3.14.exe 93 PID 988 wrote to memory of 1900 988 Panel Ejecutador MTA 3.14.exe 93 PID 1900 wrote to memory of 4916 1900 WindowsUpdate.exe 94 PID 1900 wrote to memory of 4916 1900 WindowsUpdate.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Panel Ejecutador MTA 3.14.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2168
-
C:\Users\Admin\Desktop\Panel Ejecutador MTA 3.14.exe"C:\Users\Admin\Desktop\Panel Ejecutador MTA 3.14.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4260
-
-
C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD55791d405ca0a97a89eeaeb4f2be628be
SHA1a012d40aaaa01db12a83b0e4408d012fd383dd0b
SHA2566c67a1bf1d558b31a790e4bdcef062c9b49f00a1b3d7361dfc8308d55b87bc5d
SHA5123971447d6a5f1ffe51bb1acc0d2525aa5bca521358c67828e6bd983d68e8c22dfa83ab49109575bc113e13de861682af563a3ed21e5ef48cce1bfcdb8f1f2afd