Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
0c8c53fc87610174bd8d304940ed84dd.exe
Resource
win7-20240903-en
General
-
Target
0c8c53fc87610174bd8d304940ed84dd.exe
-
Size
2.6MB
-
MD5
0c8c53fc87610174bd8d304940ed84dd
-
SHA1
e049d2b70beec23414f252d3aab26f179e1573bc
-
SHA256
eee98aabaf632f6d85b08f40401058696980c57a60bbf57ffae069e6ee1b827c
-
SHA512
7150b0f65b6bb01d8be8d36a49c08239950384aa4382bda387b8de733f3f4f0db9eabf148e85b9b11efaf60761be703a6c28fdfdc6df87b03db6fb96acc4380e
-
SSDEEP
49152:b+PPOOZeF0a/ICoVrIdEXZe1pVhZ88hfOKx/13ZvTIqab7SNudXjdTF:HOk0axoVrIuXytKtKTrROJF
Malware Config
Extracted
quasar
1.4.1
bild
147.45.44.184:4782
c3e182b5-304a-49a7-85b2-6d514cf6f590
-
encryption_key
7248469493201CDB45E041FBAB664BCC303EC021
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/772-72-0x000000001B830000-0x000000001BB54000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 2584 0c8c53fc87610174bd8d304940ed84dd.tmp -
Loads dropped DLL 10 IoCs
pid Process 2736 0c8c53fc87610174bd8d304940ed84dd.exe 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 2872 0c8c53fc87610174bd8d304940ed84dd.exe 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 3048 regsvr32.exe 772 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to execute payload.
pid Process 2980 powershell.exe 1896 powershell.exe 2980 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.tmp -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 772 regsvr32.exe 1896 powershell.exe 2980 powershell.exe 772 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1896 powershell.exe Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 772 regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2584 0c8c53fc87610174bd8d304940ed84dd.tmp -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2736 wrote to memory of 2684 2736 0c8c53fc87610174bd8d304940ed84dd.exe 30 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2684 wrote to memory of 2872 2684 0c8c53fc87610174bd8d304940ed84dd.tmp 31 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2872 wrote to memory of 2584 2872 0c8c53fc87610174bd8d304940ed84dd.exe 32 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 2584 wrote to memory of 3048 2584 0c8c53fc87610174bd8d304940ed84dd.tmp 33 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 3048 wrote to memory of 772 3048 regsvr32.exe 34 PID 772 wrote to memory of 1896 772 regsvr32.exe 35 PID 772 wrote to memory of 1896 772 regsvr32.exe 35 PID 772 wrote to memory of 1896 772 regsvr32.exe 35 PID 772 wrote to memory of 2980 772 regsvr32.exe 37 PID 772 wrote to memory of 2980 772 regsvr32.exe 37 PID 772 wrote to memory of 2980 772 regsvr32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\is-AE8F9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp"C:\Users\Admin\AppData\Local\Temp\is-AE8F9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$5014E,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\is-DQNR9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQNR9.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$6014E,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\regsvr32.exe/s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{4B1931F9-293C-4188-CD2C-5696595E17F4}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5bcc236a3921e1388596a42b05686ff5e
SHA143bffbbac6a1bf5f1fa21e971e06e6f1d0af9263
SHA25643a656bcd060e8a36502ca2deb878d56a99078f13d3e57dcd73a87128588c9e9
SHA512e3baaf1a8f4eb0e1ab57a1fb35bc7ded476606b65fafb09835d34705d8c661819c3cfa0ecc43c5a0d0085fd570df581438de27944e054e12c09a6933bbf5ce04
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SZU313X0VSV6JXIZJJ5O.temp
Filesize7KB
MD58d6ea5a51a75084b069ebc0c4c7ed0b4
SHA1445e7de9e4334878c2e0a64c61d950709e4d9a21
SHA256a57bffdf854fc85710476ccc3920b882b1afdbfb4d530221302410a2a4bf0c86
SHA5120deb524c31ecb15caf2fa2453df004131583dcbe45e4805392501b2eb87c17eba043b4ac721adcba4e23c179846c68a4d4cba0a8add633240ad0a681adc57266
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4.2MB
MD50eb9dd8cd99ba5cda1580cedd1337c47
SHA147d50257261756ee304375fa84531cde9f1b2d80
SHA256744ef584ca4ac58a3ee825f5ead1129753d6d44198b3b14a53e368b7d24e84ef
SHA5122e7c3cc9cdbca9776b1e4ffa004a761d40629e4e5c5626df73367e1f41f7c560d3ae496a0ea211db497d7437855e9686205fb32220e23fab30f8b489d232e25a