Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 12:10
Behavioral task
behavioral1
Sample
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe
Resource
win7-20240903-en
General
-
Target
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe
-
Size
3.1MB
-
MD5
7f888b6cbd5062a7558eea61eb9a9ca2
-
SHA1
2acfb5c3e7b8e569ea52397154b9b3ffb44e7d87
-
SHA256
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
-
SHA512
7da70e844e0fce4b4bbc70db89503b95b6514cabf9ce9cf66fed643f6c11aafc5e7a8f385b5d16f7fa802cc47c9200bf486030834551d14c55078307ef7e93d8
-
SSDEEP
49152:/v2lL26AaNeWgPhlmVqvMQ7XSKKQSYmzwXoGdVTHHB72eh2NT:/v2L26AaNeWgPhlmVqkQ7XSKKQSq
Malware Config
Extracted
quasar
1.4.1
Office04
llordiWasHere-55715.portmap.host:55715
124c5996-13c0-46a2-804a-191042a109db
-
encryption_key
5F48258CBD7D9014A9443146E8A3D837D1715CAE
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3636-1-0x0000000000DF0000-0x0000000001114000-memory.dmp family_quasar behavioral2/files/0x0007000000023c8c-7.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3772 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3636 864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe Token: SeDebugPrivilege 3772 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3772 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3772 Client.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3636 wrote to memory of 3772 3636 864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe 83 PID 3636 wrote to memory of 3772 3636 864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe"C:\Users\Admin\AppData\Local\Temp\864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD57f888b6cbd5062a7558eea61eb9a9ca2
SHA12acfb5c3e7b8e569ea52397154b9b3ffb44e7d87
SHA256864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
SHA5127da70e844e0fce4b4bbc70db89503b95b6514cabf9ce9cf66fed643f6c11aafc5e7a8f385b5d16f7fa802cc47c9200bf486030834551d14c55078307ef7e93d8