Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 10:56
Behavioral task
behavioral1
Sample
CandyDDoser-installerx32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CandyDDoser-installerx32.exe
Resource
win10v2004-20241007-en
General
-
Target
CandyDDoser-installerx32.exe
-
Size
3.1MB
-
MD5
b020b1f73c110300f25ae110b3dd59df
-
SHA1
8bfa300b77c9c3e302001311d88568d816c590ae
-
SHA256
ab7f57812dcc2c9ddd51aa06afdbc083d6f42dc8a4d1a9f2ab91bcee9722fef3
-
SHA512
98047f3bab00b4c4d6a3a23c0d31c7940328a8d6d1cfed1173ead3b094fc95ba18f57729a75045f9d5c7a8e5c1e9496f12617efc7a370a75e6c87b25455b9339
-
SSDEEP
49152:/v7I22SsaNYfdPBldt698dBcjHQ0lRJ61bR3LoGdL1THHB72eh2NTz:/vE22SsaNYfdPBldt6+dBcjHQ0lRJ6H
Malware Config
Extracted
quasar
1.4.1
CandyDDoser-Installer
127.0.0.1:5656
a4451484-07b3-4077-bce4-aad7f3859a48
-
encryption_key
0BF10FE69CA9AD8F67C8185E9EEB25C381EB6210
-
install_name
system32remove.exe
-
log_directory
Logs
-
reconnect_delay
10
-
startup_key
system32
-
subdirectory
Windows
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2960-1-0x0000000000F80000-0x00000000012A8000-memory.dmp family_quasar behavioral1/files/0x0008000000016edb-6.dat family_quasar behavioral1/memory/2804-9-0x0000000000DE0000-0x0000000001108000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2804 system32remove.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\Windows\system32remove.exe CandyDDoser-installerx32.exe File opened for modification C:\Windows\system32\Windows\system32remove.exe CandyDDoser-installerx32.exe File opened for modification C:\Windows\system32\Windows CandyDDoser-installerx32.exe File opened for modification C:\Windows\system32\Windows\system32remove.exe system32remove.exe File opened for modification C:\Windows\system32\Windows system32remove.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2428 schtasks.exe 2324 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2960 CandyDDoser-installerx32.exe Token: SeDebugPrivilege 2804 system32remove.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 system32remove.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2804 system32remove.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2804 system32remove.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2428 2960 CandyDDoser-installerx32.exe 30 PID 2960 wrote to memory of 2428 2960 CandyDDoser-installerx32.exe 30 PID 2960 wrote to memory of 2428 2960 CandyDDoser-installerx32.exe 30 PID 2960 wrote to memory of 2804 2960 CandyDDoser-installerx32.exe 32 PID 2960 wrote to memory of 2804 2960 CandyDDoser-installerx32.exe 32 PID 2960 wrote to memory of 2804 2960 CandyDDoser-installerx32.exe 32 PID 2804 wrote to memory of 2324 2804 system32remove.exe 33 PID 2804 wrote to memory of 2324 2804 system32remove.exe 33 PID 2804 wrote to memory of 2324 2804 system32remove.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CandyDDoser-installerx32.exe"C:\Users\Admin\AppData\Local\Temp\CandyDDoser-installerx32.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Windows\system32\Windows\system32remove.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2428
-
-
C:\Windows\system32\Windows\system32remove.exe"C:\Windows\system32\Windows\system32remove.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Windows\system32\Windows\system32remove.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2324
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5b020b1f73c110300f25ae110b3dd59df
SHA18bfa300b77c9c3e302001311d88568d816c590ae
SHA256ab7f57812dcc2c9ddd51aa06afdbc083d6f42dc8a4d1a9f2ab91bcee9722fef3
SHA51298047f3bab00b4c4d6a3a23c0d31c7940328a8d6d1cfed1173ead3b094fc95ba18f57729a75045f9d5c7a8e5c1e9496f12617efc7a370a75e6c87b25455b9339