Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    29s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    30/12/2024, 05:24

General

  • Target

    Aimbot MTA.zip

  • Size

    1.1MB

  • MD5

    daa57cdeeab30823f89e5349b832a817

  • SHA1

    feb679856d7a4a04d5e1a26e741dd6deb5ee0e88

  • SHA256

    129c9712c6553669392a034fc14842a4045df98bb8abce95a6b74ecf9760a4de

  • SHA512

    1403f94c54374a91e8d9e29b594b490ff49c16b4bd404148157e7b2a7eb57beced3459e612045433e3b4a0f78aca93d34fe2f4c198fc5669dee85c139273f376

  • SSDEEP

    24576:3bPC4RI32t9KyRPCKNJrYjWj1JkpsnWvWjI7mBPJiOMSeFAPNuHWE:rKsIm3K8voCApsnBnFJirjSU2E

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

azxq0ap.localto.net:3425

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    WindowsUpdate.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsUpdate

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Aimbot MTA.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2084
  • C:\Users\Admin\Desktop\Aimbot MTA.exe
    "C:\Users\Admin\Desktop\Aimbot MTA.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2812
    • C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2272
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffce6cccc40,0x7ffce6cccc4c,0x7ffce6cccc58
      2⤵
        PID:3712
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:4704
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2212 /prefetch:3
          2⤵
            PID:1972
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2300 /prefetch:8
            2⤵
              PID:3416
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:2436
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3248 /prefetch:1
                2⤵
                  PID:3928
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4364,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4544 /prefetch:1
                  2⤵
                    PID:5096
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5000,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5016 /prefetch:8
                    2⤵
                      PID:2272
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5008 /prefetch:8
                      2⤵
                        PID:2472
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4856 /prefetch:8
                        2⤵
                          PID:2352
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4936,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5316 /prefetch:8
                          2⤵
                            PID:2920
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5380 /prefetch:8
                            2⤵
                              PID:3348
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5364,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4964 /prefetch:8
                              2⤵
                                PID:3384
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5716,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5696 /prefetch:2
                                2⤵
                                  PID:1672
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5744,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5272 /prefetch:1
                                  2⤵
                                    PID:5300
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4908,i,18149348508103582885,150552205384904727,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4708 /prefetch:1
                                    2⤵
                                      PID:5752
                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                    1⤵
                                      PID:2320
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                      1⤵
                                        PID:1800
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffce6cccc40,0x7ffce6cccc4c,0x7ffce6cccc58
                                          2⤵
                                            PID:4460
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                          1⤵
                                            PID:3484

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                            Filesize

                                            40B

                                            MD5

                                            67c7f4a90c6057d62f2eec78d9b60f9b

                                            SHA1

                                            077ea200093ee1b5b258268b02f76bed331c3e1e

                                            SHA256

                                            7ae47ce5ec2eae7cdde736d1b770864fa6e3b2b0e78507841272235e2d0dfe5d

                                            SHA512

                                            7b7a8ba989f469f3d31616a635325d4e486c88e2878e18b423a8c94a2592d25fcb7a01a3aa7858b365ff6b582ecded320a9e24183b3b205620834859de7ef2a5

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                            Filesize

                                            649B

                                            MD5

                                            d9e7161aaefc3888a63c191322461c1c

                                            SHA1

                                            146a35ef22df506460b97d54e9545931ab04ae8d

                                            SHA256

                                            87daf5bbdb74bdb0aa70959605f5b000cd35f66b010680ff2d221d93d4d1b7fe

                                            SHA512

                                            7dbb5bcf86e2c2060d8e325ae550c3f4ad167485cbf1ebb8f8993c39da04a502ed26935aae5c7e279146ff37c03381b11b43f73dbf84b294fbe30bd31fbb8f65

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

                                            Filesize

                                            851B

                                            MD5

                                            07ffbe5f24ca348723ff8c6c488abfb8

                                            SHA1

                                            6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                            SHA256

                                            6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                            SHA512

                                            7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

                                            Filesize

                                            854B

                                            MD5

                                            4ec1df2da46182103d2ffc3b92d20ca5

                                            SHA1

                                            fb9d1ba3710cf31a87165317c6edc110e98994ce

                                            SHA256

                                            6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                            SHA512

                                            939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                            Filesize

                                            2B

                                            MD5

                                            d751713988987e9331980363e24189ce

                                            SHA1

                                            97d170e1550eee4afc0af065b78cda302a97674c

                                            SHA256

                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                            SHA512

                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            686B

                                            MD5

                                            efc7bd459b939754348bf423f21d8c5c

                                            SHA1

                                            5e46e304efb7a75f86e9f394b44d0542288a86c6

                                            SHA256

                                            ebd072a36e9bed1ed280d6b147359edc317d2e91436a6f176fca7e71851c4a36

                                            SHA512

                                            0f1fd004a1b816df9e7d5e4acb72c7c372dd520456a694d6bc6a7e9d744adbb15bc04ca8e92caa97c0f691560f9850b984c60c5848145e0d457cf5260134c999

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            0d71b08f7e469e4fa73ab309e95333c8

                                            SHA1

                                            6b2d6bde6ccd2873ac60bee2cb123cf341101975

                                            SHA256

                                            ffb31437c8d5d190b92a455204a4d3bd6ea357c8053766d4853545b0889061c2

                                            SHA512

                                            60b487066b149cc26ac27679111cd63b4f3569f97e08b47397106e1d098c071b0d1b83883bafa337939817e6e01815d7d9bbf64e3e512b1a546226d64c7f9f6c

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                            Filesize

                                            15KB

                                            MD5

                                            42ec56cfef47c4fb70c8012847661007

                                            SHA1

                                            c622c12ad94b19a182e769d31e9af45f69dc3b49

                                            SHA256

                                            d248e29c45de9b93d123650c00c052037d3644738a6f39c91bfeaacba562f034

                                            SHA512

                                            c4014faa9ba2e9abdbb20e07dcb03cc005c39aad7fac234ca24546b48e3bdbf4bec791268fecbd4af4cfade9c27a93473d1704c3d78d35f243e3e9ad0af91bdf

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            233KB

                                            MD5

                                            df894fe0e413e706e126583796e69784

                                            SHA1

                                            b04d1795c84671964af371318c4e55fd960f1f57

                                            SHA256

                                            0676545d260da8e7d87d7edb527a48a5686b4444776a57f6d4580c7256430f02

                                            SHA512

                                            c3f5a4050c557657a10bb1a142f6bfee37ef3154eac354d8709d998c8ad6d47178deef67699d117407b09e07218ef17f576a8b97caf2bd8266ddd71070a6c25d

                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir4632_2027976243\CRX_INSTALL\_locales\en\messages.json

                                            Filesize

                                            711B

                                            MD5

                                            558659936250e03cc14b60ebf648aa09

                                            SHA1

                                            32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                            SHA256

                                            2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                            SHA512

                                            1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                          • C:\Users\Admin\Desktop\Aimbot MTA.exe

                                            Filesize

                                            3.3MB

                                            MD5

                                            232fbce8fc20397039e7115d6736c5f4

                                            SHA1

                                            ec3f9e41474a0e2597c5aec4be25158ccd2d4c68

                                            SHA256

                                            f9a036faaf0d8069cad71070e3327f2b6318e7026338c32eb46dc23c18ab1291

                                            SHA512

                                            b00d44a3fc0685b917a50008d66efd44c697692a7f02b2bc18f3c325642a8bb94d5966bd66d21fa045aa24d02a88600b3b66122e3a3f6309b3854f6820bc41de

                                          • memory/2708-10-0x000000001C720000-0x000000001C770000-memory.dmp

                                            Filesize

                                            320KB

                                          • memory/2708-30-0x000000001C7F0000-0x000000001C802000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2708-31-0x000000001D370000-0x000000001D3AC000-memory.dmp

                                            Filesize

                                            240KB

                                          • memory/2708-29-0x000000001D860000-0x000000001DD88000-memory.dmp

                                            Filesize

                                            5.2MB

                                          • memory/2708-11-0x000000001C830000-0x000000001C8E2000-memory.dmp

                                            Filesize

                                            712KB

                                          • memory/3544-9-0x00007FFCEC610000-0x00007FFCED0D2000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/3544-6-0x00007FFCEC610000-0x00007FFCED0D2000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/3544-5-0x0000000000120000-0x0000000000476000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/3544-4-0x00007FFCEC613000-0x00007FFCEC615000-memory.dmp

                                            Filesize

                                            8KB