Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2025, 13:57

General

  • Target

    0c8c53fc87610174bd8d304940ed84dd.exe

  • Size

    2.6MB

  • MD5

    0c8c53fc87610174bd8d304940ed84dd

  • SHA1

    e049d2b70beec23414f252d3aab26f179e1573bc

  • SHA256

    eee98aabaf632f6d85b08f40401058696980c57a60bbf57ffae069e6ee1b827c

  • SHA512

    7150b0f65b6bb01d8be8d36a49c08239950384aa4382bda387b8de733f3f4f0db9eabf148e85b9b11efaf60761be703a6c28fdfdc6df87b03db6fb96acc4380e

  • SSDEEP

    49152:b+PPOOZeF0a/ICoVrIdEXZe1pVhZ88hfOKx/13ZvTIqab7SNudXjdTF:HOk0axoVrIuXytKtKTrROJF

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

bild

C2

147.45.44.184:4782

Mutex

c3e182b5-304a-49a7-85b2-6d514cf6f590

Attributes
  • encryption_key

    7248469493201CDB45E041FBAB664BCC303EC021

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to execute payload.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe
    "C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\is-AE8F9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AE8F9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$5014E,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe
        "C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Users\Admin\AppData\Local\Temp\is-DQNR9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-DQNR9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$6014E,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Windows\SysWOW64\regsvr32.exe
            "regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\system32\regsvr32.exe
              /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"
              6⤵
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:772
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1896
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{4B1931F9-293C-4188-CD2C-5696595E17F4}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-DQNR9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp

    Filesize

    1.1MB

    MD5

    bcc236a3921e1388596a42b05686ff5e

    SHA1

    43bffbbac6a1bf5f1fa21e971e06e6f1d0af9263

    SHA256

    43a656bcd060e8a36502ca2deb878d56a99078f13d3e57dcd73a87128588c9e9

    SHA512

    e3baaf1a8f4eb0e1ab57a1fb35bc7ded476606b65fafb09835d34705d8c661819c3cfa0ecc43c5a0d0085fd570df581438de27944e054e12c09a6933bbf5ce04

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SZU313X0VSV6JXIZJJ5O.temp

    Filesize

    7KB

    MD5

    8d6ea5a51a75084b069ebc0c4c7ed0b4

    SHA1

    445e7de9e4334878c2e0a64c61d950709e4d9a21

    SHA256

    a57bffdf854fc85710476ccc3920b882b1afdbfb4d530221302410a2a4bf0c86

    SHA512

    0deb524c31ecb15caf2fa2453df004131583dcbe45e4805392501b2eb87c17eba043b4ac721adcba4e23c179846c68a4d4cba0a8add633240ad0a681adc57266

  • \Users\Admin\AppData\Local\Temp\is-93Q29.tmp\_isetup\_isdecmp.dll

    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • \Users\Admin\AppData\Local\Temp\is-93Q29.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Roaming\1iphlpapi.drv

    Filesize

    4.2MB

    MD5

    0eb9dd8cd99ba5cda1580cedd1337c47

    SHA1

    47d50257261756ee304375fa84531cde9f1b2d80

    SHA256

    744ef584ca4ac58a3ee825f5ead1129753d6d44198b3b14a53e368b7d24e84ef

    SHA512

    2e7c3cc9cdbca9776b1e4ffa004a761d40629e4e5c5626df73367e1f41f7c560d3ae496a0ea211db497d7437855e9686205fb32220e23fab30f8b489d232e25a

  • memory/772-73-0x000007FEF55E0000-0x000007FEF59FC000-memory.dmp

    Filesize

    4.1MB

  • memory/772-72-0x000000001B830000-0x000000001BB54000-memory.dmp

    Filesize

    3.1MB

  • memory/1896-61-0x000000001B770000-0x000000001BA52000-memory.dmp

    Filesize

    2.9MB

  • memory/1896-62-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

    Filesize

    32KB

  • memory/2584-51-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/2684-24-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/2684-8-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/2736-27-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2736-2-0x0000000000401000-0x0000000000417000-memory.dmp

    Filesize

    88KB

  • memory/2736-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2872-25-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2872-22-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2872-53-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2980-70-0x0000000002690000-0x0000000002698000-memory.dmp

    Filesize

    32KB

  • memory/2980-69-0x000000001B590000-0x000000001B872000-memory.dmp

    Filesize

    2.9MB