Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe
Resource
win7-20241010-en
General
-
Target
TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe
-
Size
3.6MB
-
MD5
678283be56a5f0178969a88915020601
-
SHA1
49932acde6ce46c7e2c982985deff7297667934a
-
SHA256
b35f831b82f4648f91b37d8b8799cb26d30b069a52cf12e14ba9b4c06e8fb571
-
SHA512
c8a51bde2f62d7230cd350b82942fd1de149843dd006e6de9dbc8149f0009b11c02d86313d4a676f3590f2e7af00e5eee6107b15f5af0378a1fc722435ec5df5
-
SSDEEP
98304:Ro+TeAkm0hMH+Xv590DRdEww+EwJVeZy2:RZ63pMH+Xv5GnEww+E2VeZf
Malware Config
Extracted
quasar
1.4.1
CODE
twart.myfirewall.org:9792
rency.ydns.eu:5287
wqo9.firewall-gateway.de:8841
code1.ydns.eu:5287
wqo9.firewall-gateway.de:9792
025351e291-5d1041-4fa37-932c7-869aeiQec514992
-
encryption_key
3145298725BA5E0DD56E87FFE3F8898EA81E6EDA
-
install_name
Exccelworkbook.exe
-
log_directory
Logs
-
reconnect_delay
6000
-
startup_key
pdfdocument
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 5 IoCs
resource yara_rule behavioral1/memory/2004-11-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar behavioral1/memory/2004-19-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar behavioral1/memory/2004-17-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar behavioral1/memory/2004-15-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar behavioral1/memory/2004-12-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Executes dropped EXE 3 IoCs
pid Process 2832 Exccelworkbook.exe 2784 Exccelworkbook.exe 2988 Exccelworkbook.exe -
Loads dropped DLL 1 IoCs
pid Process 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1740 set thread context of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 2832 set thread context of 2988 2832 Exccelworkbook.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exccelworkbook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exccelworkbook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2480 schtasks.exe 1516 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2832 Exccelworkbook.exe 2832 Exccelworkbook.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe Token: SeDebugPrivilege 2832 Exccelworkbook.exe Token: SeDebugPrivilege 2988 Exccelworkbook.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2988 Exccelworkbook.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 1740 wrote to memory of 2004 1740 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 30 PID 2004 wrote to memory of 2480 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 31 PID 2004 wrote to memory of 2480 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 31 PID 2004 wrote to memory of 2480 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 31 PID 2004 wrote to memory of 2480 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 31 PID 2004 wrote to memory of 2832 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 33 PID 2004 wrote to memory of 2832 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 33 PID 2004 wrote to memory of 2832 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 33 PID 2004 wrote to memory of 2832 2004 TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe 33 PID 2832 wrote to memory of 2784 2832 Exccelworkbook.exe 34 PID 2832 wrote to memory of 2784 2832 Exccelworkbook.exe 34 PID 2832 wrote to memory of 2784 2832 Exccelworkbook.exe 34 PID 2832 wrote to memory of 2784 2832 Exccelworkbook.exe 34 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2832 wrote to memory of 2988 2832 Exccelworkbook.exe 35 PID 2988 wrote to memory of 1516 2988 Exccelworkbook.exe 36 PID 2988 wrote to memory of 1516 2988 Exccelworkbook.exe 36 PID 2988 wrote to memory of 1516 2988 Exccelworkbook.exe 36 PID 2988 wrote to memory of 1516 2988 Exccelworkbook.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2480
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe"C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe"C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe"4⤵
- Executes dropped EXE
PID:2784
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe"C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1516
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5678283be56a5f0178969a88915020601
SHA149932acde6ce46c7e2c982985deff7297667934a
SHA256b35f831b82f4648f91b37d8b8799cb26d30b069a52cf12e14ba9b4c06e8fb571
SHA512c8a51bde2f62d7230cd350b82942fd1de149843dd006e6de9dbc8149f0009b11c02d86313d4a676f3590f2e7af00e5eee6107b15f5af0378a1fc722435ec5df5