Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2024, 22:04 UTC

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    afbe43a1d3e9986c5a72a9d7dc2db574

  • SHA1

    21ef2f45fd401a680094ee78d4429338aebd53fa

  • SHA256

    e041e66e2ae3d5f3788712173628f211d4ac597071a9724035655e3d5812f632

  • SHA512

    03d734318c8fff5a3a6d30601bcfd35f6ce95f8a32f7f095f103464551b7afdaf22f3a98aaa1ac7c35a53058db85455250d9ecfcb65521de138f88377c80b5a4

  • SSDEEP

    49152:/vblL26AaNeWgPhlmVqvMQ7XSKCkbQMoGdv5THHB72eh2NT:/vBL26AaNeWgPhlmVqkQ7XSKCkbd

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

traffic-appointed.gl.at.ply.gg:15980

Mutex

a1cf046f-88d0-4438-ba9e-206f45ca6749

Attributes
  • encryption_key

    F426A0AAE097F6C161D9B012687B93AED480E211

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2756
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2796

Network

  • flag-us
    DNS
    traffic-appointed.gl.at.ply.gg
    Client.exe
    Remote address:
    8.8.8.8:53
    Request
    traffic-appointed.gl.at.ply.gg
    IN A
    Response
    traffic-appointed.gl.at.ply.gg
    IN A
    147.185.221.24
  • 147.185.221.24:15980
    traffic-appointed.gl.at.ply.gg
    Client.exe
    152 B
    3
  • 147.185.221.24:15980
    traffic-appointed.gl.at.ply.gg
    Client.exe
    152 B
    3
  • 147.185.221.24:15980
    traffic-appointed.gl.at.ply.gg
    Client.exe
    152 B
    3
  • 147.185.221.24:15980
    traffic-appointed.gl.at.ply.gg
    Client.exe
    152 B
    3
  • 147.185.221.24:15980
    traffic-appointed.gl.at.ply.gg
    Client.exe
    152 B
    3
  • 147.185.221.24:15980
    traffic-appointed.gl.at.ply.gg
    Client.exe
    152 B
    3
  • 8.8.8.8:53
    traffic-appointed.gl.at.ply.gg
    dns
    Client.exe
    76 B
    92 B
    1
    1

    DNS Request

    traffic-appointed.gl.at.ply.gg

    DNS Response

    147.185.221.24

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

    Filesize

    3.1MB

    MD5

    afbe43a1d3e9986c5a72a9d7dc2db574

    SHA1

    21ef2f45fd401a680094ee78d4429338aebd53fa

    SHA256

    e041e66e2ae3d5f3788712173628f211d4ac597071a9724035655e3d5812f632

    SHA512

    03d734318c8fff5a3a6d30601bcfd35f6ce95f8a32f7f095f103464551b7afdaf22f3a98aaa1ac7c35a53058db85455250d9ecfcb65521de138f88377c80b5a4

  • memory/2364-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

    Filesize

    4KB

  • memory/2364-1-0x0000000000BE0000-0x0000000000F04000-memory.dmp

    Filesize

    3.1MB

  • memory/2364-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2364-9-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2916-7-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2916-8-0x0000000000CD0000-0x0000000000FF4000-memory.dmp

    Filesize

    3.1MB

  • memory/2916-10-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2916-11-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

    Filesize

    9.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.