Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
60s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
23/03/2025, 14:26
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
1efa2ce02b0580a14f2a8fac7a9a4979
-
SHA1
8077e483cdd18cacc8f43da57f448e834dfac5a0
-
SHA256
730b3867b91012ca460ddf78f0cf4dd2bfd15c63adc3a71210fdd642c836141b
-
SHA512
5c93e3e93a934d57efd5520627096037b4d7f225f20b6e39f4be070862b77f3a751d78930349955deb53a7a80acac5f5f88f97960be0aea0f57c7839b4e9c548
-
SSDEEP
49152:KvyI22SsaNYfdPBldt698dBcjHKZRJ6NbR3LoGdxTHHB72eh2NT:Kvf22SsaNYfdPBldt6+dBcjHKZRJ6f
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.100.86:4782
Mutex
504ff898-f46f-4349-af57-001edb7ddaaa
Attributes
-
encryption_key
080C56ED40FE9ADB7C560711D8C27946A3DDA54C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/3744-1-0x0000000000DA0000-0x00000000010C4000-memory.dmp family_quasar behavioral1/files/0x0009000000028146-3.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1896 Client.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 904 schtasks.exe 1664 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3744 Client-built.exe Token: SeDebugPrivilege 1896 Client.exe Token: SeDebugPrivilege 6108 taskmgr.exe Token: SeSystemProfilePrivilege 6108 taskmgr.exe Token: SeCreateGlobalPrivilege 6108 taskmgr.exe Token: 33 6108 taskmgr.exe Token: SeIncBasePriorityPrivilege 6108 taskmgr.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe 6108 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1896 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3744 wrote to memory of 904 3744 Client-built.exe 82 PID 3744 wrote to memory of 904 3744 Client-built.exe 82 PID 3744 wrote to memory of 1896 3744 Client-built.exe 84 PID 3744 wrote to memory of 1896 3744 Client-built.exe 84 PID 1896 wrote to memory of 1664 1896 Client.exe 85 PID 1896 wrote to memory of 1664 1896 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:904
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1664
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6108
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD51efa2ce02b0580a14f2a8fac7a9a4979
SHA18077e483cdd18cacc8f43da57f448e834dfac5a0
SHA256730b3867b91012ca460ddf78f0cf4dd2bfd15c63adc3a71210fdd642c836141b
SHA5125c93e3e93a934d57efd5520627096037b4d7f225f20b6e39f4be070862b77f3a751d78930349955deb53a7a80acac5f5f88f97960be0aea0f57c7839b4e9c548