Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
8s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06/03/2025, 15:48
Static task
static1
Errors
General
-
Target
ItroublveTSC.exe
-
Size
2.0MB
-
MD5
7c2da2ae36228b8b66ec5e5029e90d08
-
SHA1
d636baf89fd305a1f694611097ac6e7bcb1f244c
-
SHA256
c6820f426b28b93295ca3b768780e8b372424fb72e94b5d0c094b030f53d4721
-
SHA512
93cbc698211b0ab0f96ab3f0eb8d393bcd04580418e08fc6df9b935a7cdd091b619a0edab4771b4c887264b0eef6846e6e08a7be24a8681848a1885206a29960
-
SSDEEP
49152:DL+qgtiXBVLcHD/QmJqRsVEzCeePMAnUD:OzcBVYHDjcyVMukAUD
Malware Config
Extracted
quasar
2.1.0.0
Office04
zaidtheboii-50153.portmap.host:50153
VNM_MUTEX_fNWmZ9wa8oprRXUo73
-
encryption_key
PJRTtGrfOi1c09c0GCYT
-
install_name
OneDrive.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft One Drive
-
subdirectory
Microsoft One Drive
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x000a000000027d36-21.dat disable_win_def behavioral1/memory/3728-36-0x0000000000430000-0x00000000004C0000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Microsoft OneDrive.exe -
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Microsoft OneDrive.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Microsoft OneDrive.exe -
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000027d36-21.dat family_quasar behavioral1/memory/3728-36-0x0000000000430000-0x00000000004C0000-memory.dmp family_quasar -
Venomrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3524754987-2550789650-2995585052-1000\Control Panel\International\Geo\Nation ItroublveTSC.exe -
Executes dropped EXE 3 IoCs
pid Process 5116 ItroublveTSC.exe 3728 Microsoft OneDrive.exe 4364 OneDrive.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Microsoft OneDrive.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe Microsoft OneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1776 4364 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ItroublveTSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ItroublveTSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OneDrive.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 972 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 972 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4948 schtasks.exe 3276 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4596 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5116 ItroublveTSC.exe Token: SeDebugPrivilege 3728 Microsoft OneDrive.exe Token: SeDebugPrivilege 4596 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5116 ItroublveTSC.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5116 ItroublveTSC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3796 wrote to memory of 5116 3796 ItroublveTSC.exe 81 PID 3796 wrote to memory of 5116 3796 ItroublveTSC.exe 81 PID 3796 wrote to memory of 5116 3796 ItroublveTSC.exe 81 PID 3796 wrote to memory of 3728 3796 ItroublveTSC.exe 82 PID 3796 wrote to memory of 3728 3796 ItroublveTSC.exe 82 PID 3796 wrote to memory of 3728 3796 ItroublveTSC.exe 82 PID 3728 wrote to memory of 4948 3728 Microsoft OneDrive.exe 84 PID 3728 wrote to memory of 4948 3728 Microsoft OneDrive.exe 84 PID 3728 wrote to memory of 4948 3728 Microsoft OneDrive.exe 84 PID 3728 wrote to memory of 4364 3728 Microsoft OneDrive.exe 86 PID 3728 wrote to memory of 4364 3728 Microsoft OneDrive.exe 86 PID 3728 wrote to memory of 4364 3728 Microsoft OneDrive.exe 86 PID 3728 wrote to memory of 4596 3728 Microsoft OneDrive.exe 87 PID 3728 wrote to memory of 4596 3728 Microsoft OneDrive.exe 87 PID 3728 wrote to memory of 4596 3728 Microsoft OneDrive.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe"C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5116
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4948
-
-
C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe"C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:3276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xNQFPqfVfNKn.bat" "4⤵PID:5060
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:4960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 22284⤵
- Program crash
PID:1776
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4364 -ip 43641⤵PID:4296
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD53fce051fde9fbd1302b4ee16f604553b
SHA1e137d2e6fa0007ddd0bf3a1215a68b37ef2ed653
SHA256a34954a87d0f4354a21e40ea0e9a9eee4420f47987d40be854ea7b98d6d36226
SHA512cb07f753043b7705b0e32bbf4e1ae8ddf6176851562dea567e75a4715b1beb4031d35a43b6bf0bc45d5b2da7430be0d87b6ae61b5b2e07c7c8950bb0247e4a5c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
211B
MD5a17aa37c0e248388e74f6c962bd7aaa9
SHA186290f98ee7e590bda39f0703794245046ee94c0
SHA2561fada5cbf128a74e4a8ed613c0cc4c1bcbe6a01ea556d35f6559f44c8776b62f
SHA51293972aa8023dbe77239116f2dcc10e19753e515cadcdc2ccc332739818dbbeed2b37e4b4420a8643e43a6b88d944c7bc3e1081325bd96c87f6c0fda62d6f800d
-
Filesize
3.9MB
MD553f43b1e9d99d6a356a332d9073b4736
SHA171e6c5a216a66b2b523b1b022d44c10b276c6195
SHA256584bf67e7c8e93629e175733fe42907e60916047e68f1b4973d4cbf3dd2c22d6
SHA512e7c5e4b26309e38dd1dd52b4f509c94fb9f50453e4d5c2ba895b02c48457a15c384866fdeb57185b628f10873ed6a6e6936ad170827f4855c9c5eca15ab8f959