Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 10:07
Behavioral task
behavioral1
Sample
Awp.ggCRACKED.exe
Resource
win7-20240708-en
General
-
Target
Awp.ggCRACKED.exe
-
Size
3.1MB
-
MD5
b622196e254ed84e5b1f59f1aac2cfb1
-
SHA1
f77a050aaff00d2cc3da7f11fb35e0bd2c0338be
-
SHA256
1d55a256b3519b624f19c81a9b9f0477d8ad45a967f853e723a921194ee585f0
-
SHA512
5a525dda3785449a3770f98ce105bf83a417654537a70e6f8a4ddfcba938dffa029e11161d1ae64afed48e78e6bd3336777c97334c7c1a453e9e742506520fbf
-
SSDEEP
49152:rvyI22SsaNYfdPBldt698dBcjHBdLf1JlaoGdVTHHB72eh2NT:rvf22SsaNYfdPBldt6+dBcjHBdLQ
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.19:4782
cbd5bb11-a5b0-4dee-8e4b-bb4f3dacc71d
-
encryption_key
17F9A06104A1A84BB74B1E617E0D5896149A2953
-
install_name
Solora.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/4856-1-0x0000000000F80000-0x00000000012A4000-memory.dmp family_quasar behavioral2/files/0x000a000000023ba0-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2892 Solora.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2928 schtasks.exe 4984 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4856 Awp.ggCRACKED.exe Token: SeDebugPrivilege 2892 Solora.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2892 Solora.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2928 4856 Awp.ggCRACKED.exe 82 PID 4856 wrote to memory of 2928 4856 Awp.ggCRACKED.exe 82 PID 4856 wrote to memory of 2892 4856 Awp.ggCRACKED.exe 84 PID 4856 wrote to memory of 2892 4856 Awp.ggCRACKED.exe 84 PID 2892 wrote to memory of 4984 2892 Solora.exe 85 PID 2892 wrote to memory of 4984 2892 Solora.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Awp.ggCRACKED.exe"C:\Users\Admin\AppData\Local\Temp\Awp.ggCRACKED.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2928
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe"C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5b622196e254ed84e5b1f59f1aac2cfb1
SHA1f77a050aaff00d2cc3da7f11fb35e0bd2c0338be
SHA2561d55a256b3519b624f19c81a9b9f0477d8ad45a967f853e723a921194ee585f0
SHA5125a525dda3785449a3770f98ce105bf83a417654537a70e6f8a4ddfcba938dffa029e11161d1ae64afed48e78e6bd3336777c97334c7c1a453e9e742506520fbf