Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 10:53
Behavioral task
behavioral1
Sample
CandyDDoser-installer x32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CandyDDoser-installer x32.exe
Resource
win10v2004-20241007-en
General
-
Target
CandyDDoser-installer x32.exe
-
Size
3.1MB
-
MD5
b020b1f73c110300f25ae110b3dd59df
-
SHA1
8bfa300b77c9c3e302001311d88568d816c590ae
-
SHA256
ab7f57812dcc2c9ddd51aa06afdbc083d6f42dc8a4d1a9f2ab91bcee9722fef3
-
SHA512
98047f3bab00b4c4d6a3a23c0d31c7940328a8d6d1cfed1173ead3b094fc95ba18f57729a75045f9d5c7a8e5c1e9496f12617efc7a370a75e6c87b25455b9339
-
SSDEEP
49152:/v7I22SsaNYfdPBldt698dBcjHQ0lRJ61bR3LoGdL1THHB72eh2NTz:/vE22SsaNYfdPBldt6+dBcjHQ0lRJ6H
Malware Config
Extracted
quasar
1.4.1
CandyDDoser-Installer
127.0.0.1:5656
a4451484-07b3-4077-bce4-aad7f3859a48
-
encryption_key
0BF10FE69CA9AD8F67C8185E9EEB25C381EB6210
-
install_name
system32remove.exe
-
log_directory
Logs
-
reconnect_delay
10
-
startup_key
system32
-
subdirectory
Windows
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/1732-1-0x00000000011C0000-0x00000000014E8000-memory.dmp family_quasar behavioral1/files/0x00060000000191fd-6.dat family_quasar behavioral1/memory/3056-9-0x0000000000120000-0x0000000000448000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3056 system32remove.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\Windows\system32remove.exe CandyDDoser-installer x32.exe File opened for modification C:\Windows\system32\Windows CandyDDoser-installer x32.exe File opened for modification C:\Windows\system32\Windows\system32remove.exe system32remove.exe File opened for modification C:\Windows\system32\Windows system32remove.exe File created C:\Windows\system32\Windows\system32remove.exe CandyDDoser-installer x32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2516 schtasks.exe 2796 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 CandyDDoser-installer x32.exe Token: SeDebugPrivilege 3056 system32remove.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 system32remove.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3056 system32remove.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3056 system32remove.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2516 1732 CandyDDoser-installer x32.exe 31 PID 1732 wrote to memory of 2516 1732 CandyDDoser-installer x32.exe 31 PID 1732 wrote to memory of 2516 1732 CandyDDoser-installer x32.exe 31 PID 1732 wrote to memory of 3056 1732 CandyDDoser-installer x32.exe 33 PID 1732 wrote to memory of 3056 1732 CandyDDoser-installer x32.exe 33 PID 1732 wrote to memory of 3056 1732 CandyDDoser-installer x32.exe 33 PID 3056 wrote to memory of 2796 3056 system32remove.exe 34 PID 3056 wrote to memory of 2796 3056 system32remove.exe 34 PID 3056 wrote to memory of 2796 3056 system32remove.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CandyDDoser-installer x32.exe"C:\Users\Admin\AppData\Local\Temp\CandyDDoser-installer x32.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Windows\system32\Windows\system32remove.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2516
-
-
C:\Windows\system32\Windows\system32remove.exe"C:\Windows\system32\Windows\system32remove.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "system32" /sc ONLOGON /tr "C:\Windows\system32\Windows\system32remove.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5b020b1f73c110300f25ae110b3dd59df
SHA18bfa300b77c9c3e302001311d88568d816c590ae
SHA256ab7f57812dcc2c9ddd51aa06afdbc083d6f42dc8a4d1a9f2ab91bcee9722fef3
SHA51298047f3bab00b4c4d6a3a23c0d31c7940328a8d6d1cfed1173ead3b094fc95ba18f57729a75045f9d5c7a8e5c1e9496f12617efc7a370a75e6c87b25455b9339