Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 01:36
Behavioral task
behavioral1
Sample
KAZZAK Nova/KAZZAK Nova/Installer.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
KAZZAK Nova/KAZZAK Nova/Installer.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
KAZZAK Nova/KAZZAK Nova/READ BEFORE USING.txt
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
KAZZAK Nova/KAZZAK Nova/READ BEFORE USING.txt
Resource
win10v2004-20250129-en
General
-
Target
KAZZAK Nova/KAZZAK Nova/Installer.exe
-
Size
3.1MB
-
MD5
c85c392d4f402f6d1efe69a397874fc8
-
SHA1
d7bf20fc60a832f2c101fb47133fde314c164427
-
SHA256
e33a67ca41bd7f1dbe94489e953d2a6d720dccd5fb82d62353946a193be862eb
-
SHA512
605c12a4140fb1a18f76112040704c9c41a7b78b887324b12852400b56ab1c7e20d1587dfdc9ed62de1480eecaeb0e5b6f845157637aeecc429bdd60a068c971
-
SSDEEP
49152:3vrI22SsaNYfdPBldt698dBcjHZTRJ6VbR3LoGdkTHHB72eh2NT:3vU22SsaNYfdPBldt6+dBcjHZTRJ6n
Malware Config
Extracted
quasar
1.4.1
Office04
kaziahlds-23371.portmap.io:23371
04d20254-5898-4b4a-8396-e1aacfd3225f
-
encryption_key
1127B18519097512D1F8F01C3CC393354B9F8404
-
install_name
Loader.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
KAZZAK
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2660-1-0x0000000001270000-0x0000000001594000-memory.dmp family_quasar behavioral1/files/0x000700000001939b-6.dat family_quasar behavioral1/memory/2676-8-0x0000000000110000-0x0000000000434000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2676 Loader.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3044 schtasks.exe 2800 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2660 Installer.exe Token: SeDebugPrivilege 2676 Loader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2676 Loader.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2800 2660 Installer.exe 30 PID 2660 wrote to memory of 2800 2660 Installer.exe 30 PID 2660 wrote to memory of 2800 2660 Installer.exe 30 PID 2660 wrote to memory of 2676 2660 Installer.exe 32 PID 2660 wrote to memory of 2676 2660 Installer.exe 32 PID 2660 wrote to memory of 2676 2660 Installer.exe 32 PID 2676 wrote to memory of 3044 2676 Loader.exe 33 PID 2676 wrote to memory of 3044 2676 Loader.exe 33 PID 2676 wrote to memory of 3044 2676 Loader.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\KAZZAK Nova\KAZZAK Nova\Installer.exe"C:\Users\Admin\AppData\Local\Temp\KAZZAK Nova\KAZZAK Nova\Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "KAZZAK" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Loader.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Loader.exe"C:\Users\Admin\AppData\Roaming\SubDir\Loader.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "KAZZAK" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Loader.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c85c392d4f402f6d1efe69a397874fc8
SHA1d7bf20fc60a832f2c101fb47133fde314c164427
SHA256e33a67ca41bd7f1dbe94489e953d2a6d720dccd5fb82d62353946a193be862eb
SHA512605c12a4140fb1a18f76112040704c9c41a7b78b887324b12852400b56ab1c7e20d1587dfdc9ed62de1480eecaeb0e5b6f845157637aeecc429bdd60a068c971