Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    39s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    01/01/2025, 12:10

General

  • Target

    Aimbot MTA.zip

  • Size

    1.1MB

  • MD5

    daa57cdeeab30823f89e5349b832a817

  • SHA1

    feb679856d7a4a04d5e1a26e741dd6deb5ee0e88

  • SHA256

    129c9712c6553669392a034fc14842a4045df98bb8abce95a6b74ecf9760a4de

  • SHA512

    1403f94c54374a91e8d9e29b594b490ff49c16b4bd404148157e7b2a7eb57beced3459e612045433e3b4a0f78aca93d34fe2f4c198fc5669dee85c139273f376

  • SSDEEP

    24576:3bPC4RI32t9KyRPCKNJrYjWj1JkpsnWvWjI7mBPJiOMSeFAPNuHWE:rKsIm3K8voCApsnBnFJirjSU2E

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

azxq0ap.localto.net:3425

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    WindowsUpdate.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsUpdate

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Aimbot MTA.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4752
  • C:\Users\Admin\Desktop\Aimbot MTA.exe
    "C:\Users\Admin\Desktop\Aimbot MTA.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2144
    • C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1076
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4536
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffef7facc40,0x7ffef7facc4c,0x7ffef7facc58
      2⤵
        PID:4780
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1956 /prefetch:2
        2⤵
          PID:948
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2180,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
            PID:4236
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2276 /prefetch:8
            2⤵
              PID:2680
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:1920
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3200 /prefetch:1
                2⤵
                  PID:944
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3708 /prefetch:1
                  2⤵
                    PID:5112
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4720,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4748 /prefetch:1
                    2⤵
                      PID:2796
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3392,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3184 /prefetch:1
                      2⤵
                        PID:4908
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4960,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5020 /prefetch:8
                        2⤵
                          PID:3096
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,16489347388146347286,14032768062764852273,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5036 /prefetch:8
                          2⤵
                            PID:4660
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:228
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:4260

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                              Filesize

                              649B

                              MD5

                              7b9b67cc27cd370dfb3d0306d77b2a2c

                              SHA1

                              061e79154ff3a58251ebdb43dd8093d41fe7ee51

                              SHA256

                              b6fee0f07d30bef876a568a6bfcc761498637afddce5afcdae0be87323ecd866

                              SHA512

                              f965506508033ee9540fe9ed05374bc2d36108009c60191e908d601de01019dc40859fb293139263b536e3d156d4baac328b54ed7a7e73fd5b67fdea0a622fba

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              480B

                              MD5

                              2098dfb408351abd414c96f23af09e22

                              SHA1

                              12065d35bad9f4d4dfb64ce4e88c61e0ef7ca2f1

                              SHA256

                              e9c29c6e71b6aae7c63155d0f6dac556f505478f06e92c0511852d251df85ebc

                              SHA512

                              4c0ee49a3e9cc6005916bc298da48029cf6a0b1f8fca5291c7400c985787db5e059dc208e8fbc9c6cf71ece4b7c07f77994932d8bc8a47c52b4b07fef15e27a6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              065ac2f69f6068dbd43ac95eab326f15

                              SHA1

                              c93aed30432119fefafe0750040c73fd6db9da7f

                              SHA256

                              ce49a8615f6e8346579870ae26d15e4607e5e3d74f02c3c0ee3b079fc749a1b0

                              SHA512

                              93c6d467d5cba43f95c011208aa14b152df59f3d3e206c8209925b473db041fc18da3cecdf0f65a2dcc323bcb18dba38295e7706c4aae71175fb18539c49eedb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              858B

                              MD5

                              d5859c37a78fa418f150c84417d9bec8

                              SHA1

                              4d69e5b5d7a9654b59a60b0d8505b981c2b216ea

                              SHA256

                              252b2e1eaa8b571bed0d55c3e0a2a50f6a698a24d1b29a4419605f152a965990

                              SHA512

                              264ebb99c392587f652acf1ce8b114636ad884cb78993ba04e1711f4764a18e044eaace88b977d9a1a371c9a3c079255dfc4785e5014a51e18fb1983d45429f1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              858B

                              MD5

                              d03452e4cebe54c0886f10d0e7930cdf

                              SHA1

                              33701a482c9ccf836a4a1a538dd88f184d8fc8d1

                              SHA256

                              1a7cee2efcffb6147ffe0f92d1f5728482aa1562c945e44f647305a701a64078

                              SHA512

                              7865145afaeac1114aed7fa4fa047a8d0bfd76a0d7847af2ddc7b2fa342d0e68211ebe0b5e299f478894161d0e46c9ecf94e951cfad609476e022d81caed8dc7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              c8f226cdda9ba531429cbd812cfb99ca

                              SHA1

                              9afc468f4cb4a2ba4734e1c2a82fadaabf538f0b

                              SHA256

                              da38428ad010fe32aed87eecca55fa5b4a40c0bbec0a84872d1cac802d6e6dcb

                              SHA512

                              b8d6f1901bbc40fa2c156f7f0b792df0845a1c5c3f30e37166b8c69f6aebc0c2396fa39aea5ecf9495dc3d4481a5fe766aa2a66c5f442b7522327d9068bc6e8f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              bd308e98185e10f88dd23ad0e6dc465b

                              SHA1

                              29acdb1ba31907f103af2a76d93fe963fc933546

                              SHA256

                              36969700594bdf6e27cafb6f038bc04d6ce907937ba589a0578e1bd63cf95b9e

                              SHA512

                              8a27d1f1b8477ccd15b39471835960812c962ad0076068c216b1e72074990f2b6efaa84f4029c812cb0f05ed698ac837408b9b75d4d36317b36dc2f06c3c4b43

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              12KB

                              MD5

                              2de04336087f586e9342f0d1dd3d1a7e

                              SHA1

                              1caf937420082c18723f823ecffe62979bcdcb57

                              SHA256

                              428f9f979eaefabdd482aa4e83c0e5f5f743da201cf46b3f051c61e75493ae2b

                              SHA512

                              b1b6bc32607290655521c0c3b8359e0fde42ea8d9999d6ae45c070cab5b131d5a450203b95cc82162aff598df2af601decc0afb314c2e83b2da6e1fd74a77f56

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              233KB

                              MD5

                              10ff74cf8e4caeb386977a2d308775ab

                              SHA1

                              8d82cb844ed5d83f38ab7a747792680d1515282c

                              SHA256

                              09929173504a9a25265d024672d61c783864ae3d5a744f496d6e086b1ab8130e

                              SHA512

                              2acac713c29138c8f84b330d2d888466bf988b7237a3f99da6707713f4f7270e8bd5a3af974a3bad66699ffc6db256408de4ceff0139a2c11f56b20a06f9ae4c

                            • C:\Users\Admin\Desktop\Aimbot MTA.exe

                              Filesize

                              3.3MB

                              MD5

                              232fbce8fc20397039e7115d6736c5f4

                              SHA1

                              ec3f9e41474a0e2597c5aec4be25158ccd2d4c68

                              SHA256

                              f9a036faaf0d8069cad71070e3327f2b6318e7026338c32eb46dc23c18ab1291

                              SHA512

                              b00d44a3fc0685b917a50008d66efd44c697692a7f02b2bc18f3c325642a8bb94d5966bd66d21fa045aa24d02a88600b3b66122e3a3f6309b3854f6820bc41de

                            • memory/1076-40-0x000000001E130000-0x000000001E16C000-memory.dmp

                              Filesize

                              240KB

                            • memory/1076-39-0x000000001D050000-0x000000001D062000-memory.dmp

                              Filesize

                              72KB

                            • memory/1076-36-0x000000001D7C0000-0x000000001DCE8000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/1076-25-0x000000001D0D0000-0x000000001D182000-memory.dmp

                              Filesize

                              712KB

                            • memory/1076-24-0x000000001CFC0000-0x000000001D010000-memory.dmp

                              Filesize

                              320KB

                            • memory/4756-9-0x00007FFEFD1F0000-0x00007FFEFDCB2000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4756-6-0x00007FFEFD1F0000-0x00007FFEFDCB2000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4756-5-0x00000000002C0000-0x0000000000616000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/4756-4-0x00007FFEFD1F3000-0x00007FFEFD1F5000-memory.dmp

                              Filesize

                              8KB