Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
86s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 17:59
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
73c23b1192bfd4f2fd59ca10523e13f2
-
SHA1
587f13586069971b5fb715a66aa498c36510a5dc
-
SHA256
d9db91945538a06bb9f9fd23cdba8b769953b654486c9d6ef85e891c58df2ffd
-
SHA512
07195c5b5f75aa682a5957e5f1bd440dd6b4cce1b6a4fd76ae0a9d621d8b32e25633178b71bffb02bb0c8af482dc00863e29a18e016694d8cfd5fb89740d32ec
-
SSDEEP
49152:HvLlL26AaNeWgPhlmVqvMQ7XSKOfsqIBe9joGARVTHHB72eh2NT:HvxL26AaNeWgPhlmVqkQ7XSKOEqZ
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.10.126:52427
94.31.108.129:52427
Mutex
8338883e-e167-4933-893d-9116970a5a7e
Attributes
-
encryption_key
FFFB8904E2A834B666E9B38240430975448158C8
-
install_name
pcimprover.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft-Imrpover
-
subdirectory
find
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2752-1-0x0000000000FD0000-0x00000000012F4000-memory.dmp family_quasar behavioral1/files/0x000800000002411c-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3624 pcimprover.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\find pcimprover.exe File created C:\Program Files\find\pcimprover.exe Client-built.exe File opened for modification C:\Program Files\find\pcimprover.exe Client-built.exe File opened for modification C:\Program Files\find Client-built.exe File opened for modification C:\Program Files\find\pcimprover.exe pcimprover.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 916 schtasks.exe 4840 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2752 Client-built.exe Token: SeDebugPrivilege 3624 pcimprover.exe Token: SeDebugPrivilege 4724 taskmgr.exe Token: SeSystemProfilePrivilege 4724 taskmgr.exe Token: SeCreateGlobalPrivilege 4724 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3624 pcimprover.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3624 pcimprover.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe 4724 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3624 pcimprover.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2752 wrote to memory of 916 2752 Client-built.exe 89 PID 2752 wrote to memory of 916 2752 Client-built.exe 89 PID 2752 wrote to memory of 3624 2752 Client-built.exe 91 PID 2752 wrote to memory of 3624 2752 Client-built.exe 91 PID 3624 wrote to memory of 4840 3624 pcimprover.exe 93 PID 3624 wrote to memory of 4840 3624 pcimprover.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft-Imrpover" /sc ONLOGON /tr "C:\Program Files\find\pcimprover.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:916
-
-
C:\Program Files\find\pcimprover.exe"C:\Program Files\find\pcimprover.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft-Imrpover" /sc ONLOGON /tr "C:\Program Files\find\pcimprover.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4840
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4724
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD573c23b1192bfd4f2fd59ca10523e13f2
SHA1587f13586069971b5fb715a66aa498c36510a5dc
SHA256d9db91945538a06bb9f9fd23cdba8b769953b654486c9d6ef85e891c58df2ffd
SHA51207195c5b5f75aa682a5957e5f1bd440dd6b4cce1b6a4fd76ae0a9d621d8b32e25633178b71bffb02bb0c8af482dc00863e29a18e016694d8cfd5fb89740d32ec