Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
18/01/2025, 20:55
Behavioral task
behavioral1
Sample
RC7old.exe
Resource
win7-20241023-en
General
-
Target
RC7old.exe
-
Size
3.1MB
-
MD5
5efb08d03470612d11124136accc84fa
-
SHA1
46abe602f6566ff6103f504ef8ae73f43eae19c1
-
SHA256
853cf003dd01ec972a222a28b1e8b260fb06fab20245e609cb7df103d110343f
-
SHA512
13a1fbeae357662e2e2a60e511a3bce2f63fef40a96ba49f25e745dd466ca3da24de5155f0f2233e8d15941f353a21df14247ab7b4ebf84ee419ca7d7b7ae74a
-
SSDEEP
49152:CvHI22SsaNYfdPBldt698dBcjHuYREEf/yk/65LoGdvYAFTHHB72eh2NT:Cvo22SsaNYfdPBldt6+dBcjHuYRkp
Malware Config
Extracted
quasar
1.4.1
RC7old
yellow-parts.gl.at.ply.gg:52085
8356bffd-2b62-44f9-937c-4adee31d9ea3
-
encryption_key
5471C1CD3CF5D10BA14E0A632D9E07BC5FEE0E2B
-
install_name
RC7old.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
System
-
subdirectory
System
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2116-1-0x0000000001300000-0x0000000001624000-memory.dmp family_quasar behavioral1/memory/2416-8-0x0000000000820000-0x0000000000B44000-memory.dmp family_quasar behavioral1/files/0x0008000000015d81-7.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2416 RC7old.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\System\RC7old.exe RC7old.exe File opened for modification C:\Windows\system32\System\RC7old.exe RC7old.exe File opened for modification C:\Windows\system32\System RC7old.exe File opened for modification C:\Windows\system32\System\RC7old.exe RC7old.exe File opened for modification C:\Windows\system32\System RC7old.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2620 schtasks.exe 2184 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2508 chrome.exe 2508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeDebugPrivilege 2116 RC7old.exe Token: SeDebugPrivilege 2416 RC7old.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2416 RC7old.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 2416 RC7old.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2620 2116 RC7old.exe 30 PID 2116 wrote to memory of 2620 2116 RC7old.exe 30 PID 2116 wrote to memory of 2620 2116 RC7old.exe 30 PID 2116 wrote to memory of 2416 2116 RC7old.exe 32 PID 2116 wrote to memory of 2416 2116 RC7old.exe 32 PID 2116 wrote to memory of 2416 2116 RC7old.exe 32 PID 2416 wrote to memory of 2184 2416 RC7old.exe 33 PID 2416 wrote to memory of 2184 2416 RC7old.exe 33 PID 2416 wrote to memory of 2184 2416 RC7old.exe 33 PID 2508 wrote to memory of 2504 2508 chrome.exe 39 PID 2508 wrote to memory of 2504 2508 chrome.exe 39 PID 2508 wrote to memory of 2504 2508 chrome.exe 39 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 376 2508 chrome.exe 41 PID 2508 wrote to memory of 2988 2508 chrome.exe 42 PID 2508 wrote to memory of 2988 2508 chrome.exe 42 PID 2508 wrote to memory of 2988 2508 chrome.exe 42 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 PID 2508 wrote to memory of 704 2508 chrome.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RC7old.exe"C:\Users\Admin\AppData\Local\Temp\RC7old.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Windows\system32\System\RC7old.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2620
-
-
C:\Windows\system32\System\RC7old.exe"C:\Windows\system32\System\RC7old.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Windows\system32\System\RC7old.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2184
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2928
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef14d9758,0x7fef14d9768,0x7fef14d97782⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:22⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:82⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:82⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2248 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:22⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2868 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:12⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 --field-trial-handle=1292,i,8236042750760945294,3039981657669365,131072 /prefetch:82⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD5a410dd4ad2b304ea483aef9c436ae6e8
SHA1b39408b11278c7a02ce612bdf8088c4dbb856d4c
SHA256a05cef5e1735625e71d7aab7b3b0d9979f3b637334eb7ca56e59419e5836b0a4
SHA51260b7cb75a01829d5b30e23ccaa755600cea8cadabac4235c59028f95b877331cff3e88a6d0a7f0229d1fc18556e40194f0044622beefa43d3389502d42b3f2c0
-
Filesize
5KB
MD504e4d98006597426a2f006b4e67489e1
SHA115caad8ae7000d4d3837503fa0cfd9e12f2be10e
SHA2566298eb5e96b72bd185667a5506d590e20f975e16143734c4e11f5bba93a114d8
SHA51223f72eb4aeb19ccac72e0cd1ed73c3cb899bbf48104217a9886fa00c8455e84cf2e085e17078ce1624dffe457e94157a539da710ee14496f1b5de6f6d655da9a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
3.1MB
MD55efb08d03470612d11124136accc84fa
SHA146abe602f6566ff6103f504ef8ae73f43eae19c1
SHA256853cf003dd01ec972a222a28b1e8b260fb06fab20245e609cb7df103d110343f
SHA51213a1fbeae357662e2e2a60e511a3bce2f63fef40a96ba49f25e745dd466ca3da24de5155f0f2233e8d15941f353a21df14247ab7b4ebf84ee419ca7d7b7ae74a