Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

7a56b9a7be...8b.exe

windows7-x64

10

7a56b9a7be...8b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    108s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 05:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a56b9a7be5d627a61b4fcd3716b73aefa76ecbe38c8edc5c11b47dedb3b888b.exe

  • Size

    6.7MB

  • MD5

    818c5a007a2075f7c56eb69b75d12acb

  • SHA1

    2f33d50e879a18ff744424855d6356bae8f2d5d9

  • SHA256

    79712e68d88a6d2d87555f24f9dc767868289ce0e70000c14e3e72df1b4a58f9

  • SHA512

    f15717749deac968f48ac8c5df01368735658eca535efa19c1b5c2bcb3a1b1f065baa05b609b6526c384a6800b78adccfc8249aab8e7ce411041575303da8ec4

  • SSDEEP

    196608:hwy9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKDSy3n1B:hwykYVI5DK2NNs6LtYdEhSp24B

Score
10/10
quasaroffice04agilenetdefense_evasiondiscoveryexecutionspywarestealerthemidatrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

movies-concerning.gl.at.ply.gg:12712

Mutex

5f7b0195-4eaf-4ae9-b4f8-cc2f6f6c4eb3

Attributes
  • encryption_key

    27AAC11A05508545506D258070495FCDA9A82735

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a56b9a7be5d627a61b4fcd3716b73aefa76ecbe38c8edc5c11b47dedb3b888b.exe
    "C:\Users\Admin\AppData\Local\Temp\7a56b9a7be5d627a61b4fcd3716b73aefa76ecbe38c8edc5c11b47dedb3b888b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5476
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C wmic path win32_ComputerSystem get model
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_ComputerSystem get model
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2256
    • C:\Users\Admin\AppData\Local\Temp\NpQzalVJdj\Vortex Crypter.exe
      "C:\Users\Admin\AppData\Local\Temp\NpQzalVJdj\Vortex Crypter.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:6040
    • C:\Users\Admin\AppData\Local\Temp\jTHUitoGBzSF\Client-built.exe
      "C:\Users\Admin\AppData\Local\Temp\jTHUitoGBzSF\Client-built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4892
      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5452
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4836
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" reagentc /disable
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4492
          • C:\Windows\System32\reagentc.exe
            reagentc /disable
            5⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            PID:4168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$([System.Environment]::GetEnvironmentVariable('SystemDrive'))\"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1540
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /delete /tn "Quasar Modded Client Startup" /f
          4⤵
            PID:1192
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3CGA3d4LA2wW.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5264
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:3632
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                5⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3848
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C TIMEOUT /T 3 && DEL /f "C:\Users\Admin\AppData\Local\Temp\7a56b9a7be5d627a61b4fcd3716b73aefa76ecbe38c8edc5c11b47dedb3b888b.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Windows\system32\timeout.exe
            TIMEOUT /T 3
            3⤵
            • Delays execution with timeout.exe
            PID:4764

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Virtualization/Sandbox Evasion

      1
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Query Registry

      4
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      4
      T1082

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Virtualization/Sandbox Evasion

      1
      T1497

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\3CGA3d4LA2wW.bat
        Filesize

        211B

        MD5

        75734cdc770958663e8a2314c99a615f

        SHA1

        13fc9a7af1fca362a895cacf438b0d199453046c

        SHA256

        275367957b95457f0fb2a5d58fc194965e187e02a709512328a94cc0699233b4

        SHA512

        c489ef42923ddb5da5e667ceaee88d00ea43413d38f019046a8dc8bce846fdbf35423a8c2c5743fe9bff789ebd6ba7ebdf6a6c4d991676bd6d9dc2edbe120db3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\NpQzalVJdj\Vortex Crypter.exe
        Filesize

        5.9MB

        MD5

        95373b3cad383bc50fe84a2a598b5cfb

        SHA1

        e65e24821a2167656a2bc2dffbb1bd82cd08aeec

        SHA256

        d02da3d3909dc335bee98ffb284ce5413c84d349137c236715a9f898eba6fa42

        SHA512

        9756fb770c8e6716328b1046fb0fd6bbccb16cbcdc7e05f581a47264f89ab0f5f9a691b1b0857a9f2fad1018ab81aa158de7a07446a28311f0aba3088b35b82e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xljiyxyg.mgs.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ec62652a-4173-490a-bf30-4c378c0dcdd3\AgileDotNetRT64.dll
        Filesize

        2.9MB

        MD5

        9bb6ed08af544d3738e60200d2804180

        SHA1

        5a40b484ca56b1ce59add4ec283e21d60070be02

        SHA256

        86d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7

        SHA512

        63e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\jTHUitoGBzSF\Client-built.exe
        Filesize

        556KB

        MD5

        85410a49050c880d856c15b4c958d86d

        SHA1

        f520f25b5cd537b1060d8ca66f53bac745f8f8fa

        SHA256

        9365b6cee47eecc6eab2c6d138f0d5714c31ff1473143ce14ce874eb896f01b3

        SHA512

        94ac76b3fb61b14f39b9cc9848d530842c834ae32efede2da7c5ce3d062940a788391d7b22e888ec5b024dba7437ef043ee11554fe62509e1f71ee202791f7d5

        Download Submit

      • memory/1540-61-0x00000210A88A0000-0x00000210A88C2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2812-28-0x00000232B6610000-0x00000232B66A0000-memory.dmp

        Filesize

        576KB

        Download

      • memory/2812-30-0x00000232B6A40000-0x00000232B6A58000-memory.dmp

        Filesize

        96KB

        Download

      • memory/5452-49-0x000002002C1C0000-0x000002002C210000-memory.dmp

        Filesize

        320KB

        Download

      • memory/5452-55-0x000002002C510000-0x000002002C54C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/5452-56-0x000002002CAA0000-0x000002002CAB2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/5452-50-0x000002002C550000-0x000002002C602000-memory.dmp

        Filesize

        712KB

        Download

      • memory/5452-51-0x000002002C170000-0x000002002C1BE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/5452-54-0x000002002C4B0000-0x000002002C4C2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/5476-37-0x00007FFA45760000-0x00007FFA46221000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5476-2-0x00007FFA45760000-0x00007FFA46221000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5476-1-0x0000000000E10000-0x00000000014C0000-memory.dmp

        Filesize

        6.7MB

        Download

      • memory/5476-0-0x00007FFA45763000-0x00007FFA45765000-memory.dmp

        Filesize

        8KB

        Download

      • memory/6040-27-0x00000221B4D40000-0x00000221B5328000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/6040-48-0x00007FFA3F560000-0x00007FFA3FD12000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/6040-41-0x00007FFA54F50000-0x00007FFA5509E000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/6040-40-0x00007FFA3F560000-0x00007FFA3FD12000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/6040-38-0x00007FFA3F560000-0x00007FFA3FD12000-memory.dmp

        Filesize

        7.7MB

        Download