Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
ItroublveTSC.exe
Resource
win7-20240903-en
General
-
Target
ItroublveTSC.exe
-
Size
2.0MB
-
MD5
7c2da2ae36228b8b66ec5e5029e90d08
-
SHA1
d636baf89fd305a1f694611097ac6e7bcb1f244c
-
SHA256
c6820f426b28b93295ca3b768780e8b372424fb72e94b5d0c094b030f53d4721
-
SHA512
93cbc698211b0ab0f96ab3f0eb8d393bcd04580418e08fc6df9b935a7cdd091b619a0edab4771b4c887264b0eef6846e6e08a7be24a8681848a1885206a29960
-
SSDEEP
49152:DL+qgtiXBVLcHD/QmJqRsVEzCeePMAnUD:OzcBVYHDjcyVMukAUD
Malware Config
Extracted
quasar
2.1.0.0
Office04
zaidtheboii-50153.portmap.host:50153
VNM_MUTEX_fNWmZ9wa8oprRXUo73
-
encryption_key
PJRTtGrfOi1c09c0GCYT
-
install_name
OneDrive.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft One Drive
-
subdirectory
Microsoft One Drive
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x0008000000016276-13.dat disable_win_def behavioral1/memory/1664-19-0x0000000000C50000-0x0000000000CE0000-memory.dmp disable_win_def behavioral1/memory/2604-28-0x0000000000870000-0x0000000000900000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Microsoft OneDrive.exe -
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Microsoft OneDrive.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Microsoft OneDrive.exe -
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/files/0x0008000000016276-13.dat family_quasar behavioral1/memory/1664-19-0x0000000000C50000-0x0000000000CE0000-memory.dmp family_quasar behavioral1/memory/2604-28-0x0000000000870000-0x0000000000900000-memory.dmp family_quasar -
Venomrat family
-
Deletes itself 1 IoCs
pid Process 276 cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 1020 ItroublveTSC.exe 1664 Microsoft OneDrive.exe 2604 OneDrive.exe -
Loads dropped DLL 8 IoCs
pid Process 2324 ItroublveTSC.exe 2324 ItroublveTSC.exe 1664 Microsoft OneDrive.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Microsoft OneDrive.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Microsoft OneDrive.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe Microsoft OneDrive.exe File opened for modification C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe Microsoft OneDrive.exe File created C:\Windows\SysWOW64\Microsoft One Drive\r77-x64.dll Microsoft OneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1852 2604 WerFault.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ItroublveTSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ItroublveTSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2848 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2848 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2796 schtasks.exe 1728 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2544 powershell.exe 1664 Microsoft OneDrive.exe 1664 Microsoft OneDrive.exe 1664 Microsoft OneDrive.exe 1664 Microsoft OneDrive.exe 1664 Microsoft OneDrive.exe 1664 Microsoft OneDrive.exe 1664 Microsoft OneDrive.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1020 ItroublveTSC.exe Token: SeDebugPrivilege 1664 Microsoft OneDrive.exe Token: SeDebugPrivilege 2544 powershell.exe Token: SeDebugPrivilege 2604 OneDrive.exe Token: SeDebugPrivilege 2604 OneDrive.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1020 ItroublveTSC.exe 1020 ItroublveTSC.exe 1020 ItroublveTSC.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1020 ItroublveTSC.exe 1020 ItroublveTSC.exe 1020 ItroublveTSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2604 OneDrive.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1020 2324 ItroublveTSC.exe 31 PID 2324 wrote to memory of 1020 2324 ItroublveTSC.exe 31 PID 2324 wrote to memory of 1020 2324 ItroublveTSC.exe 31 PID 2324 wrote to memory of 1020 2324 ItroublveTSC.exe 31 PID 2324 wrote to memory of 1664 2324 ItroublveTSC.exe 32 PID 2324 wrote to memory of 1664 2324 ItroublveTSC.exe 32 PID 2324 wrote to memory of 1664 2324 ItroublveTSC.exe 32 PID 2324 wrote to memory of 1664 2324 ItroublveTSC.exe 32 PID 1664 wrote to memory of 2796 1664 Microsoft OneDrive.exe 34 PID 1664 wrote to memory of 2796 1664 Microsoft OneDrive.exe 34 PID 1664 wrote to memory of 2796 1664 Microsoft OneDrive.exe 34 PID 1664 wrote to memory of 2796 1664 Microsoft OneDrive.exe 34 PID 1664 wrote to memory of 2604 1664 Microsoft OneDrive.exe 36 PID 1664 wrote to memory of 2604 1664 Microsoft OneDrive.exe 36 PID 1664 wrote to memory of 2604 1664 Microsoft OneDrive.exe 36 PID 1664 wrote to memory of 2604 1664 Microsoft OneDrive.exe 36 PID 1664 wrote to memory of 2544 1664 Microsoft OneDrive.exe 37 PID 1664 wrote to memory of 2544 1664 Microsoft OneDrive.exe 37 PID 1664 wrote to memory of 2544 1664 Microsoft OneDrive.exe 37 PID 1664 wrote to memory of 2544 1664 Microsoft OneDrive.exe 37 PID 2604 wrote to memory of 1728 2604 OneDrive.exe 39 PID 2604 wrote to memory of 1728 2604 OneDrive.exe 39 PID 2604 wrote to memory of 1728 2604 OneDrive.exe 39 PID 2604 wrote to memory of 1728 2604 OneDrive.exe 39 PID 2604 wrote to memory of 2640 2604 OneDrive.exe 41 PID 2604 wrote to memory of 2640 2604 OneDrive.exe 41 PID 2604 wrote to memory of 2640 2604 OneDrive.exe 41 PID 2604 wrote to memory of 2640 2604 OneDrive.exe 41 PID 2604 wrote to memory of 1852 2604 OneDrive.exe 43 PID 2604 wrote to memory of 1852 2604 OneDrive.exe 43 PID 2604 wrote to memory of 1852 2604 OneDrive.exe 43 PID 2604 wrote to memory of 1852 2604 OneDrive.exe 43 PID 2640 wrote to memory of 1652 2640 cmd.exe 44 PID 2640 wrote to memory of 1652 2640 cmd.exe 44 PID 2640 wrote to memory of 1652 2640 cmd.exe 44 PID 2640 wrote to memory of 1652 2640 cmd.exe 44 PID 2640 wrote to memory of 2848 2640 cmd.exe 45 PID 2640 wrote to memory of 2848 2640 cmd.exe 45 PID 2640 wrote to memory of 2848 2640 cmd.exe 45 PID 2640 wrote to memory of 2848 2640 cmd.exe 45 PID 1664 wrote to memory of 764 1664 Microsoft OneDrive.exe 46 PID 1664 wrote to memory of 764 1664 Microsoft OneDrive.exe 46 PID 1664 wrote to memory of 764 1664 Microsoft OneDrive.exe 46 PID 1664 wrote to memory of 764 1664 Microsoft OneDrive.exe 46 PID 764 wrote to memory of 276 764 cmd.exe 48 PID 764 wrote to memory of 276 764 cmd.exe 48 PID 764 wrote to memory of 276 764 cmd.exe 48 PID 764 wrote to memory of 276 764 cmd.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe"C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2796
-
-
C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe"C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1728
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\eytMnDHWLQHj.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
- System Location Discovery: System Language Discovery
PID:1652
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 14564⤵
- Loads dropped DLL
- Program crash
PID:1852
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*4⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:276
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211B
MD55131bbf01556389d8b8b882e2d3f3271
SHA14903239af48b0ec778d753642c343a2632fdc4bd
SHA25629ef1f8d5ba05335a5442a2c22b3931e4d857505b49895de9045f0ed3821c145
SHA512309e4b6c774e39d9ae356ee7b1daf8d15aa43f7ddbca7f1e73c699f6c9371a488b40cb624103f00a424a338bbd58e950b48088e4ef5ee7ca73932ff082e8afff
-
Filesize
3.9MB
MD553f43b1e9d99d6a356a332d9073b4736
SHA171e6c5a216a66b2b523b1b022d44c10b276c6195
SHA256584bf67e7c8e93629e175733fe42907e60916047e68f1b4973d4cbf3dd2c22d6
SHA512e7c5e4b26309e38dd1dd52b4f509c94fb9f50453e4d5c2ba895b02c48457a15c384866fdeb57185b628f10873ed6a6e6936ad170827f4855c9c5eca15ab8f959
-
Filesize
550KB
MD53fce051fde9fbd1302b4ee16f604553b
SHA1e137d2e6fa0007ddd0bf3a1215a68b37ef2ed653
SHA256a34954a87d0f4354a21e40ea0e9a9eee4420f47987d40be854ea7b98d6d36226
SHA512cb07f753043b7705b0e32bbf4e1ae8ddf6176851562dea567e75a4715b1beb4031d35a43b6bf0bc45d5b2da7430be0d87b6ae61b5b2e07c7c8950bb0247e4a5c