Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/01/2025, 01:53
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20241010-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
18833ce91b26be79378f897dca190f66
-
SHA1
c7fdea28474a3e12ebe51aa878abeed9969d8d01
-
SHA256
77c61d4dd21b5b2319e14d750799a1be96254cb0fd4c7edd3e81bc825c91594c
-
SHA512
565b069175f60cce8d67eddfe41bc8ab5caadbe2ed41acd7a3108b96c3cf7fbdbc8593af7bbe1ad6ac33dd0444866073eff65ff001458b7e94c8ded9f41561c6
-
SSDEEP
49152:SvaY52fyaSZOrPWluWBuGG5g5hnDmVmzmioGdKeTHHB72eh2NT:Svv52fyaSZOrPWluWBDG5g5hnDmC
Malware Config
Extracted
quasar
1.4.1
Offset
127.0.0.1:8080
6210ab1d-dd45-4f17-a324-f24c1474c4d8
-
encryption_key
CABE6FE0988CAB22AE614AA6065A89402DF1C513
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
conhost
-
subdirectory
Windows
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2060-1-0x00000000013C0000-0x00000000016E4000-memory.dmp family_quasar behavioral1/files/0x0009000000016d3f-6.dat family_quasar behavioral1/memory/1708-8-0x0000000000E10000-0x0000000001134000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1708 svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2620 schtasks.exe 3040 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2060 Client-built.exe Token: SeDebugPrivilege 1708 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1708 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2620 2060 Client-built.exe 30 PID 2060 wrote to memory of 2620 2060 Client-built.exe 30 PID 2060 wrote to memory of 2620 2060 Client-built.exe 30 PID 2060 wrote to memory of 1708 2060 Client-built.exe 32 PID 2060 wrote to memory of 1708 2060 Client-built.exe 32 PID 2060 wrote to memory of 1708 2060 Client-built.exe 32 PID 1708 wrote to memory of 3040 1708 svchost.exe 33 PID 1708 wrote to memory of 3040 1708 svchost.exe 33 PID 1708 wrote to memory of 3040 1708 svchost.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\svchost.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2620
-
-
C:\Users\Admin\AppData\Roaming\Windows\svchost.exe"C:\Users\Admin\AppData\Roaming\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\svchost.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3040
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD518833ce91b26be79378f897dca190f66
SHA1c7fdea28474a3e12ebe51aa878abeed9969d8d01
SHA25677c61d4dd21b5b2319e14d750799a1be96254cb0fd4c7edd3e81bc825c91594c
SHA512565b069175f60cce8d67eddfe41bc8ab5caadbe2ed41acd7a3108b96c3cf7fbdbc8593af7bbe1ad6ac33dd0444866073eff65ff001458b7e94c8ded9f41561c6