Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 02:43
Behavioral task
behavioral1
Sample
rbxfpsunlocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
rbxfpsunlocker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
rbxfpsunlocker.exe
Resource
win10ltsc2021-20241023-en
General
-
Target
rbxfpsunlocker.exe
-
Size
3.1MB
-
MD5
09a5b059ce629f09d69e340065aeb553
-
SHA1
6b6bff18c4452a25107210a6b59f298229e4ac95
-
SHA256
ec46dd64a026223ff115efdc51fd486069607041025e89d51f25d112cf33b77e
-
SHA512
ce94308bf44567e776e54606308089ddc3505c2cd1a8481d37ad128c6edfa1c2a9df418cb7865329ac1901e4c524d8c01042bd1471672a18721f2a9a25dab0bb
-
SSDEEP
49152:Cvdt62XlaSFNWPjljiFa2RoUYIJeRJ6gbR3LoGdOTHHB72eh2NT:Cvf62XlaSFNWPjljiFXRoUYIJeRJ66
Malware Config
Extracted
quasar
1.4.1
beamed
192.168.203.82:4782
3dad94cd-63f6-460a-a986-b1841d5dfefe
-
encryption_key
DE46F816EBC96DE37F9233DDE7709263C7680426
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
JavaUpdate
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2316-1-0x0000000000270000-0x0000000000594000-memory.dmp family_quasar behavioral1/files/0x0036000000015f81-6.dat family_quasar behavioral1/memory/2800-10-0x0000000000800000-0x0000000000B24000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2800 Client.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\SubDir\Client.exe Client.exe File opened for modification C:\Program Files\SubDir Client.exe File created C:\Program Files\SubDir\Client.exe rbxfpsunlocker.exe File opened for modification C:\Program Files\SubDir\Client.exe rbxfpsunlocker.exe File opened for modification C:\Program Files\SubDir rbxfpsunlocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2744 schtasks.exe 2988 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2316 rbxfpsunlocker.exe Token: SeDebugPrivilege 2800 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2800 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2800 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2744 2316 rbxfpsunlocker.exe 30 PID 2316 wrote to memory of 2744 2316 rbxfpsunlocker.exe 30 PID 2316 wrote to memory of 2744 2316 rbxfpsunlocker.exe 30 PID 2316 wrote to memory of 2800 2316 rbxfpsunlocker.exe 32 PID 2316 wrote to memory of 2800 2316 rbxfpsunlocker.exe 32 PID 2316 wrote to memory of 2800 2316 rbxfpsunlocker.exe 32 PID 2800 wrote to memory of 2988 2800 Client.exe 33 PID 2800 wrote to memory of 2988 2800 Client.exe 33 PID 2800 wrote to memory of 2988 2800 Client.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "JavaUpdate" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2744
-
-
C:\Program Files\SubDir\Client.exe"C:\Program Files\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "JavaUpdate" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD509a5b059ce629f09d69e340065aeb553
SHA16b6bff18c4452a25107210a6b59f298229e4ac95
SHA256ec46dd64a026223ff115efdc51fd486069607041025e89d51f25d112cf33b77e
SHA512ce94308bf44567e776e54606308089ddc3505c2cd1a8481d37ad128c6edfa1c2a9df418cb7865329ac1901e4c524d8c01042bd1471672a18721f2a9a25dab0bb