Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 03:31
Behavioral task
behavioral1
Sample
0x0008000000016031-17.exe
Resource
win7-20240903-en
General
-
Target
0x0008000000016031-17.exe
-
Size
3.1MB
-
MD5
7776335b8b0d230370ca39602c484a69
-
SHA1
7705fb56ea438e609a6094bef10bdb2392f55719
-
SHA256
b6bb8a533c77034b0d4eab34ffa434b1a999cac5f59983680d222f04e437729d
-
SHA512
0e290749b442e317fe90591a43549a003d7f95c086d220b04eae018209a9785a1754b834d529a5839b15d2aa783edd17e52f4ab2b331e3a14c47d84ebf24899d
-
SSDEEP
49152:2vAt62XlaSFNWPjljiFa2RoUYI4MxNESEWk/imLoGdcTHHB72eh2NT:2vs62XlaSFNWPjljiFXRoUYI3xVo
Malware Config
Extracted
quasar
1.4.1
svchost 3
41.216.183.179:3742
11b8b70b-ab15-4aab-8132-3e7b18b2b48b
-
encryption_key
0325CE0E85B5B8870BB69FE8C81088DBCBFAC6F7
-
install_name
startui.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
startui
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/2164-1-0x0000000000080000-0x00000000003A4000-memory.dmp family_quasar behavioral2/files/0x000b000000023b63-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2548 startui.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\SubDir 0x0008000000016031-17.exe File opened for modification C:\Program Files\SubDir\startui.exe startui.exe File opened for modification C:\Program Files\SubDir startui.exe File created C:\Program Files\SubDir\startui.exe 0x0008000000016031-17.exe File opened for modification C:\Program Files\SubDir\startui.exe 0x0008000000016031-17.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1996 schtasks.exe 3608 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2164 0x0008000000016031-17.exe Token: SeDebugPrivilege 2548 startui.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2548 startui.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1996 2164 0x0008000000016031-17.exe 86 PID 2164 wrote to memory of 1996 2164 0x0008000000016031-17.exe 86 PID 2164 wrote to memory of 2548 2164 0x0008000000016031-17.exe 88 PID 2164 wrote to memory of 2548 2164 0x0008000000016031-17.exe 88 PID 2548 wrote to memory of 3608 2548 startui.exe 89 PID 2548 wrote to memory of 3608 2548 startui.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0008000000016031-17.exe"C:\Users\Admin\AppData\Local\Temp\0x0008000000016031-17.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "startui" /sc ONLOGON /tr "C:\Program Files\SubDir\startui.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1996
-
-
C:\Program Files\SubDir\startui.exe"C:\Program Files\SubDir\startui.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "startui" /sc ONLOGON /tr "C:\Program Files\SubDir\startui.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD57776335b8b0d230370ca39602c484a69
SHA17705fb56ea438e609a6094bef10bdb2392f55719
SHA256b6bb8a533c77034b0d4eab34ffa434b1a999cac5f59983680d222f04e437729d
SHA5120e290749b442e317fe90591a43549a003d7f95c086d220b04eae018209a9785a1754b834d529a5839b15d2aa783edd17e52f4ab2b331e3a14c47d84ebf24899d