Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
0c8c53fc87610174bd8d304940ed84dd.exe
Resource
win7-20240903-en
General
-
Target
0c8c53fc87610174bd8d304940ed84dd.exe
-
Size
2.6MB
-
MD5
0c8c53fc87610174bd8d304940ed84dd
-
SHA1
e049d2b70beec23414f252d3aab26f179e1573bc
-
SHA256
eee98aabaf632f6d85b08f40401058696980c57a60bbf57ffae069e6ee1b827c
-
SHA512
7150b0f65b6bb01d8be8d36a49c08239950384aa4382bda387b8de733f3f4f0db9eabf148e85b9b11efaf60761be703a6c28fdfdc6df87b03db6fb96acc4380e
-
SSDEEP
49152:b+PPOOZeF0a/ICoVrIdEXZe1pVhZ88hfOKx/13ZvTIqab7SNudXjdTF:HOk0axoVrIuXytKtKTrROJF
Malware Config
Extracted
quasar
1.4.1
bild
147.45.44.184:4782
c3e182b5-304a-49a7-85b2-6d514cf6f590
-
encryption_key
7248469493201CDB45E041FBAB664BCC303EC021
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/4340-82-0x000000001C210000-0x000000001C534000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 0c8c53fc87610174bd8d304940ed84dd.tmp -
Executes dropped EXE 2 IoCs
pid Process 1756 0c8c53fc87610174bd8d304940ed84dd.tmp 232 0c8c53fc87610174bd8d304940ed84dd.tmp -
Loads dropped DLL 8 IoCs
pid Process 1756 0c8c53fc87610174bd8d304940ed84dd.tmp 1756 0c8c53fc87610174bd8d304940ed84dd.tmp 232 0c8c53fc87610174bd8d304940ed84dd.tmp 232 0c8c53fc87610174bd8d304940ed84dd.tmp 4692 regsvr32.exe 4340 regsvr32.exe 4328 regsvr32.EXE 4468 regsvr32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 1832 powershell.exe 5076 powershell.exe 1832 powershell.exe 3468 powershell.exe 2780 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c8c53fc87610174bd8d304940ed84dd.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 232 0c8c53fc87610174bd8d304940ed84dd.tmp 232 0c8c53fc87610174bd8d304940ed84dd.tmp 4340 regsvr32.exe 4340 regsvr32.exe 5076 powershell.exe 5076 powershell.exe 1832 powershell.exe 1832 powershell.exe 4340 regsvr32.exe 4340 regsvr32.exe 4328 regsvr32.EXE 4328 regsvr32.EXE 3468 powershell.exe 3468 powershell.exe 4328 regsvr32.EXE 4328 regsvr32.EXE 4468 regsvr32.EXE 4468 regsvr32.EXE 2780 powershell.exe 2780 powershell.exe 4468 regsvr32.EXE 4468 regsvr32.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5076 powershell.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe Token: SeBackupPrivilege 5076 powershell.exe Token: SeRestorePrivilege 5076 powershell.exe Token: SeShutdownPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 5076 powershell.exe Token: SeRemoteShutdownPrivilege 5076 powershell.exe Token: SeUndockPrivilege 5076 powershell.exe Token: SeManageVolumePrivilege 5076 powershell.exe Token: 33 5076 powershell.exe Token: 34 5076 powershell.exe Token: 35 5076 powershell.exe Token: 36 5076 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeIncreaseQuotaPrivilege 1832 powershell.exe Token: SeSecurityPrivilege 1832 powershell.exe Token: SeTakeOwnershipPrivilege 1832 powershell.exe Token: SeLoadDriverPrivilege 1832 powershell.exe Token: SeSystemProfilePrivilege 1832 powershell.exe Token: SeSystemtimePrivilege 1832 powershell.exe Token: SeProfSingleProcessPrivilege 1832 powershell.exe Token: SeIncBasePriorityPrivilege 1832 powershell.exe Token: SeCreatePagefilePrivilege 1832 powershell.exe Token: SeBackupPrivilege 1832 powershell.exe Token: SeRestorePrivilege 1832 powershell.exe Token: SeShutdownPrivilege 1832 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeSystemEnvironmentPrivilege 1832 powershell.exe Token: SeRemoteShutdownPrivilege 1832 powershell.exe Token: SeUndockPrivilege 1832 powershell.exe Token: SeManageVolumePrivilege 1832 powershell.exe Token: 33 1832 powershell.exe Token: 34 1832 powershell.exe Token: 35 1832 powershell.exe Token: 36 1832 powershell.exe Token: SeIncreaseQuotaPrivilege 1832 powershell.exe Token: SeSecurityPrivilege 1832 powershell.exe Token: SeTakeOwnershipPrivilege 1832 powershell.exe Token: SeLoadDriverPrivilege 1832 powershell.exe Token: SeSystemProfilePrivilege 1832 powershell.exe Token: SeSystemtimePrivilege 1832 powershell.exe Token: SeProfSingleProcessPrivilege 1832 powershell.exe Token: SeIncBasePriorityPrivilege 1832 powershell.exe Token: SeCreatePagefilePrivilege 1832 powershell.exe Token: SeBackupPrivilege 1832 powershell.exe Token: SeRestorePrivilege 1832 powershell.exe Token: SeShutdownPrivilege 1832 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeSystemEnvironmentPrivilege 1832 powershell.exe Token: SeRemoteShutdownPrivilege 1832 powershell.exe Token: SeUndockPrivilege 1832 powershell.exe Token: SeManageVolumePrivilege 1832 powershell.exe Token: 33 1832 powershell.exe Token: 34 1832 powershell.exe Token: 35 1832 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 232 0c8c53fc87610174bd8d304940ed84dd.tmp -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1756 1520 0c8c53fc87610174bd8d304940ed84dd.exe 83 PID 1520 wrote to memory of 1756 1520 0c8c53fc87610174bd8d304940ed84dd.exe 83 PID 1520 wrote to memory of 1756 1520 0c8c53fc87610174bd8d304940ed84dd.exe 83 PID 1756 wrote to memory of 4956 1756 0c8c53fc87610174bd8d304940ed84dd.tmp 84 PID 1756 wrote to memory of 4956 1756 0c8c53fc87610174bd8d304940ed84dd.tmp 84 PID 1756 wrote to memory of 4956 1756 0c8c53fc87610174bd8d304940ed84dd.tmp 84 PID 4956 wrote to memory of 232 4956 0c8c53fc87610174bd8d304940ed84dd.exe 85 PID 4956 wrote to memory of 232 4956 0c8c53fc87610174bd8d304940ed84dd.exe 85 PID 4956 wrote to memory of 232 4956 0c8c53fc87610174bd8d304940ed84dd.exe 85 PID 232 wrote to memory of 4692 232 0c8c53fc87610174bd8d304940ed84dd.tmp 86 PID 232 wrote to memory of 4692 232 0c8c53fc87610174bd8d304940ed84dd.tmp 86 PID 232 wrote to memory of 4692 232 0c8c53fc87610174bd8d304940ed84dd.tmp 86 PID 4692 wrote to memory of 4340 4692 regsvr32.exe 87 PID 4692 wrote to memory of 4340 4692 regsvr32.exe 87 PID 4340 wrote to memory of 5076 4340 regsvr32.exe 88 PID 4340 wrote to memory of 5076 4340 regsvr32.exe 88 PID 4340 wrote to memory of 1832 4340 regsvr32.exe 91 PID 4340 wrote to memory of 1832 4340 regsvr32.exe 91 PID 4328 wrote to memory of 3468 4328 regsvr32.EXE 111 PID 4328 wrote to memory of 3468 4328 regsvr32.EXE 111 PID 4468 wrote to memory of 2780 4468 regsvr32.EXE 115 PID 4468 wrote to memory of 2780 4468 regsvr32.EXE 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\is-K7DIK.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp"C:\Users\Admin\AppData\Local\Temp\is-K7DIK.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$6021C,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\is-M31L1.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp"C:\Users\Admin\AppData\Local\Temp\is-M31L1.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$601C6,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\system32\regsvr32.exe/s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{5C0D093C-5170-466B-EA9E-971247BAEBD3}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
-
-
-
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD52ac3c9ba89b8c2ef19c601ecebb82157
SHA1a239a4b11438c00e5ff89ebd4a804ede6a01935b
SHA2563c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
SHA512b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432
-
Filesize
1KB
MD5a37d50419f9463557ba395bd8249f5b6
SHA11e94df7e8e5250fe70562bf4d5538c63b3171851
SHA2567e12a5fac8da60dc67fd5d691fe4ee244d974c07d579488863558c9ebe14c1fa
SHA512cdd4fa55ab83ed2c68d8df444755a374899bb6b6f8fd829a014b3fc2f4e17536e357a288bc8209432aa2992a35f7d1df0e04c9bc82af46e04c89b69302f1a238
-
Filesize
1KB
MD512c844ed8342738dacc6eb0072c43257
SHA1b7f2f9e3ec4aaf5e2996720f129cd64887ac91d7
SHA2562afeb7db4e46d3c1524512a73448e9cd0121deec761d8aa54fa9fe8b56df7519
SHA512e3de9103533a69cccc36cd377297ba3ec9bd7a1159e1349d2cc01ab66a88a5a82b4ee3af61fab586a0cdfab915c7408735439fd0462c5c2cc2c787cb0765766a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.1MB
MD5bcc236a3921e1388596a42b05686ff5e
SHA143bffbbac6a1bf5f1fa21e971e06e6f1d0af9263
SHA25643a656bcd060e8a36502ca2deb878d56a99078f13d3e57dcd73a87128588c9e9
SHA512e3baaf1a8f4eb0e1ab57a1fb35bc7ded476606b65fafb09835d34705d8c661819c3cfa0ecc43c5a0d0085fd570df581438de27944e054e12c09a6933bbf5ce04
-
Filesize
4.2MB
MD50eb9dd8cd99ba5cda1580cedd1337c47
SHA147d50257261756ee304375fa84531cde9f1b2d80
SHA256744ef584ca4ac58a3ee825f5ead1129753d6d44198b3b14a53e368b7d24e84ef
SHA5122e7c3cc9cdbca9776b1e4ffa004a761d40629e4e5c5626df73367e1f41f7c560d3ae496a0ea211db497d7437855e9686205fb32220e23fab30f8b489d232e25a