Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 20:46
Behavioral task
behavioral1
Sample
retard.exe
Resource
win7-20240903-en
General
-
Target
retard.exe
-
Size
3.1MB
-
MD5
b55e5489b45595fb38bf5bb30b69717b
-
SHA1
7511ee8909e0a0c53625eef4bd6b57250e561391
-
SHA256
4f111d05ddb93bf8e4ec906d2705740790402254ee115982d9e5aae36c3b4ffe
-
SHA512
40a520e89579a298922595428033b7f0ae0b8bd5bd6ead29488cad9707b153998ab88c3d55316045315297d185fefaaba49ef21b392ca216ac220e75220d1ead
-
SSDEEP
49152:6vxt62XlaSFNWPjljiFa2RoUYI4N83bR4LoGdzTHHB72eh2NT:6v762XlaSFNWPjljiFXRoUYI4N80
Malware Config
Extracted
quasar
1.4.1
afafaf
194.26.192.167:2768
c1060262-cacc-4b5e-8e09-ac72d84cef52
-
encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
-
install_name
OneDrive.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
OneDrive
-
subdirectory
OneDrive
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/1984-1-0x0000000000FC0000-0x00000000012E4000-memory.dmp family_quasar -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3040 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1984 retard.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1984 retard.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 3040 1984 retard.exe 30 PID 1984 wrote to memory of 3040 1984 retard.exe 30 PID 1984 wrote to memory of 3040 1984 retard.exe 30 PID 2980 wrote to memory of 2240 2980 chrome.exe 33 PID 2980 wrote to memory of 2240 2980 chrome.exe 33 PID 2980 wrote to memory of 2240 2980 chrome.exe 33 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 2728 2980 chrome.exe 35 PID 2980 wrote to memory of 1992 2980 chrome.exe 36 PID 2980 wrote to memory of 1992 2980 chrome.exe 36 PID 2980 wrote to memory of 1992 2980 chrome.exe 36 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 PID 2980 wrote to memory of 2352 2980 chrome.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\retard.exe"C:\Users\Admin\AppData\Local\Temp\retard.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef0819758,0x7fef0819768,0x7fef08197782⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:22⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:82⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1456 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1856 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:12⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1820 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:12⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2172 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:22⤵PID:580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1300 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:12⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 --field-trial-handle=1788,i,3344975333327795754,13991595718647817655,131072 /prefetch:82⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
633B
MD59767c5b239949ab150ecc0e9611195c3
SHA1b6f2bcd52457588061c54e39a865f3f9b74d0766
SHA2568029d5484029bab8c2436fb53ad9a774cffcc0d833e0030cb4844f50b140bb7c
SHA512d5f0224226379b5d63d1ca08066ed2b64fb94f516187fa94f880cd96847d6d40228b05134ae025bae06edad13e874fed836a17666148c0ffb28ed14b26f2e25b
-
Filesize
5KB
MD5172e46391b40caec6ddb705223c93cbe
SHA1cddc9b781d29b6c915ea83d0a193705aea932c06
SHA25610ba1bb3830d05da75a559e71b7f184a1bebaedb229d0650fbcad8cccfae77ee
SHA512d662bac65c83c4f04481951b4748df5aac48b88f2ef13ad992a2cf81b88667b7dcda6a2a84ce1cb91230dfac15b3a00c8ed49278c7e48eae15d42d32cb005251
-
Filesize
5KB
MD5fd1d937e791c9ddd666fffaa8718a5ce
SHA12dfcf4b65c2ea5bb1269ac4e8b0624263b2ed35f
SHA2561fbb9093ab50fc41bd7de847d4cea6d8d9b77017bffb7f8914e9346a24c5c1ce
SHA512e75f1553bd61a7bfd7667a76fe45705aeb39d8fdb672cb6f0b66fc7451062acbcf59582d5fb65376436abd1d9fb9065c63563da9de8d6fc12d512a3c8a64de90
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2