Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 08:44
Behavioral task
behavioral1
Sample
8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe
Resource
win7-20240903-en
General
-
Target
8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe
-
Size
3.1MB
-
MD5
1167ed297153d69816e2e8446ecc3507
-
SHA1
26258abcbb54f6b51b74516b9fedbbbf7c7ffbbf
-
SHA256
8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28
-
SHA512
1d1270ea6c217a27ac04b1a3dec63454f43a83f1ae86d0591868a68b1b762ac2592e71fe687751d1b8be6fbca9dd4138c1d48f16f251c0420001a44c5864ac27
-
SSDEEP
49152:CvvY52fyaSZOrPWluWBuGG5g5hVZ/qBxnLoGde9THHB72eh2NT:CvA52fyaSZOrPWluWBDG5g5h7/SO
Malware Config
Extracted
quasar
1.4.1
Office04
127.0.0.1:80
1c12234f-7765-40ab-aaf0-bb1cc31f293c
-
encryption_key
D1A7DEB6F1ABF47AB3D04E42414608718783685B
-
install_name
000.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
000
-
subdirectory
000
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/2756-1-0x0000000000C40000-0x0000000000F64000-memory.dmp family_quasar behavioral2/files/0x000a000000023b78-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1724 000.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\000\000.exe 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe File opened for modification C:\Program Files\000\000.exe 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2928 schtasks.exe 2116 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2756 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe Token: SeDebugPrivilege 1724 000.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 000.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1724 000.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2928 2756 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe 82 PID 2756 wrote to memory of 2928 2756 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe 82 PID 2756 wrote to memory of 1724 2756 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe 84 PID 2756 wrote to memory of 1724 2756 8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe 84 PID 1724 wrote to memory of 2116 1724 000.exe 85 PID 1724 wrote to memory of 2116 1724 000.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe"C:\Users\Admin\AppData\Local\Temp\8e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "000" /sc ONLOGON /tr "C:\Program Files\000\000.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2928
-
-
C:\Program Files\000\000.exe"C:\Program Files\000\000.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "000" /sc ONLOGON /tr "C:\Program Files\000\000.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2116
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD51167ed297153d69816e2e8446ecc3507
SHA126258abcbb54f6b51b74516b9fedbbbf7c7ffbbf
SHA2568e66d22baca31883f715287e49c4d505a026a78c45c213dc409e523a95aeed28
SHA5121d1270ea6c217a27ac04b1a3dec63454f43a83f1ae86d0591868a68b1b762ac2592e71fe687751d1b8be6fbca9dd4138c1d48f16f251c0420001a44c5864ac27