quasar | 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Analysis

max time kernel
144s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-05-2023 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar v1.4.1/Quasar.exe
Size

1.2MB
MD5

12ebf922aa80d13f8887e4c8c5e7be83
SHA1

7f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA256

43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512

fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
SSDEEP

12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral10/memory/4100-119-0x000002C523740000-0x000002C523878000-memory.dmp	family_quasar
behavioral10/memory/4100-120-0x000002C5254B0000-0x000002C5254C6000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 59 IoCs

Processes:

explorer.exefirefox.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000bc562502100054656d7000003a0009000400efbe5456af94bc5625022e000000b6520100000001000000000000000000000000000000dcf11400540065006d007000000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000005456af941100557365727300640009000400efbe724a0b5d5456af942e000000320500000000010000000000000000003a00000000007488e90055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000005456c89610004c6f63616c003c0009000400efbe5456af945456c8962e000000b552010000000100000000000000000000000000000073d1c6004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000054562da0100041646d696e003c0009000400efbe5456af9454562da02e0000009752010000000100000000000000000000000000000012068900410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000005456af9412004170704461746100400009000400efbe5456af945456af942e000000a2520100000001000000000000000000000000000000fe3adb004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 6600310000000000bc56300210005155415341527e312e3100004c0009000400efbebc561702bc5630022e00000083ae0100000009000000000000000000000000000000ae712b005100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

1256 explorer.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Quasar.exe

pid process

4100 Quasar.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Quasar.exefirefox.exe

description pid process

Token: SeDebugPrivilege 4100 Quasar.exe
Token: SeDebugPrivilege 4620 firefox.exe
Token: SeDebugPrivilege 4620 firefox.exe

pid	process
1256	explorer.exe

description	pid	process
Token: SeDebugPrivilege	4100	Quasar.exe
Token: SeDebugPrivilege	4620	firefox.exe
Token: SeDebugPrivilege	4620	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

Quasar.exefirefox.exe

pid	process
4100	Quasar.exe
4620	firefox.exe
4620	firefox.exe
4620	firefox.exe
4620	firefox.exe
4620	firefox.exe
4620	firefox.exe
4620	firefox.exe
4620	firefox.exe
4100	Quasar.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

Quasar.exefirefox.exe

pid process

4100 Quasar.exe
4620 firefox.exe
4620 firefox.exe
4620 firefox.exe
4620 firefox.exe
4620 firefox.exe
4620 firefox.exe
4620 firefox.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

firefox.exeexplorer.exe

pid process

4620 firefox.exe
1256 explorer.exe
1256 explorer.exe
1256 explorer.exe
1256 explorer.exe
1256 explorer.exe
1256 explorer.exe

pid	process
4620	firefox.exe
1256	explorer.exe
1256	explorer.exe
1256	explorer.exe
1256	explorer.exe
1256	explorer.exe
1256	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 2484 wrote to memory of 4620	2484	firefox.exe	firefox.exe
PID 4620 wrote to memory of 2952	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 2952	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1300	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1564	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1564	4620	firefox.exe	firefox.exe
PID 4620 wrote to memory of 1564	4620	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4100

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" /select, "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12"
2⤵
PID:864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.0.210545785\1019315393" -parentBuildID 20221007134813 -prefsHandle 1612 -prefMapHandle 1600 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12f66eab-071f-4994-85c3-156465ae7c99} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 1704 28046803258 gpu
3⤵
PID:2952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.1.2027843983\764840020" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f935094-33c8-4249-85af-ce2ec02d3669} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 2072 280455fa258 socket
3⤵
- Checks processor information in registry
PID:1300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.2.1315099996\22904753" -childID 1 -isForBrowser -prefsHandle 2688 -prefMapHandle 2924 -prefsLen 21039 -prefMapSize 232645 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0ebaa4c-4075-45cf-b19e-ef9bb1f18b06} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 2660 28049550858 tab
3⤵
PID:1564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.3.1582689135\1643639101" -childID 2 -isForBrowser -prefsHandle 3180 -prefMapHandle 3176 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63119031-c5d7-4422-9a9a-0edd87372646} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 3188 2803aa5e258 tab
3⤵
PID:4396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.4.214488625\2082180990" -childID 3 -isForBrowser -prefsHandle 3728 -prefMapHandle 3724 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9b754a1-6f5e-4a2c-9d67-0a4293df2e9a} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 3740 2803aa5b258 tab
3⤵
PID:5020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.6.802060433\420477328" -childID 5 -isForBrowser -prefsHandle 4816 -prefMapHandle 4820 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43fa4c16-84bb-444d-8609-02c6a487f348} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 4812 2804ba5bc58 tab
3⤵
PID:1804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.7.1528844502\1522572703" -childID 6 -isForBrowser -prefsHandle 5012 -prefMapHandle 5084 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9450c7d-9dad-4643-8e5c-2d1e8eccdcd4} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 5096 2804ba5bf58 tab
3⤵
PID:1756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4620.5.1546382007\630235137" -childID 4 -isForBrowser -prefsHandle 4664 -prefMapHandle 4624 -prefsLen 26543 -prefMapSize 232645 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e849f178-16a0-4c77-a3c6-139832bc154c} 4620 "\\.\pipe\gecko-crash-server-pipe.4620" 4672 2804ba5a758 tab
3⤵
PID:1988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp
Filesize
141KB

MD5
c281c95088be82f4f0ab4650c3a77b05

SHA1
812f9e86dbdc01a0b58d12821b225d17cf54381a

SHA256
8c53feea6f8146fbe95b451bb8d103837303e2655b22db63a37ccd6ac51e6ee1

SHA512
7f61d40745b65aee44bd05d7ea4d82a6f34789087f29d5a1b02e7407b4b755005e6acc8735c5fac2624abed800bce71805fc905169a8aa1611d90ff5758f6f00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12
Filesize
4KB

MD5
36cfb73a419af58bf47f4f3ae8fe7bc8

SHA1
4f07bc98f0e27e8de67bc455ed573b46e35125d6

SHA256
fd1b970a845ae5f20fdca035ad2fc21e700c6a73376d399d579e7c89ba6084d9

SHA512
6df799bbd0a0998f2281b896466b7854132ada7b126d89ae19b68d56ff2874f332db4c55bc5711bc684e4410aee8bd6ef7db47b35ceaf542217af0da5658e3aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs.js
Filesize
6KB

MD5
cdb5a91b7898f75f98e448e80b41dba6

SHA1
c749651f98e32a2320d2e52fd467fd6217660535

SHA256
ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc

SHA512
b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4
Filesize
883B

MD5
a891ac572dc4f13eb5e88a75309b4578

SHA1
8c64beeb174ef06e47866b066b5389b3ab93b804

SHA256
a2184929c8b63a0c17a921e8a3b0afc8aff5c750005271ade5738a80a063e338

SHA512
2b66e09871601d5d00dd8add071cb77b7c6cd35e541ffe2707c7641395a208bfb3b11e2bd3e39a7c1d173ae75f506607eeeab6d1c071429e0220ea863f0fd0b3

Download Submit
memory/4100-123-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-122-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-126-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-127-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-128-0x000002C540DA0000-0x000002C5410CE000-memory.dmp

Filesize
3.2MB

Download
memory/4100-124-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-119-0x000002C523740000-0x000002C523878000-memory.dmp

Filesize
1.2MB

Download
memory/4100-125-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-121-0x000002C53DE30000-0x000002C53DE40000-memory.dmp

Filesize
64KB

Download
memory/4100-120-0x000002C5254B0000-0x000002C5254C6000-memory.dmp

Filesize
88KB

Download
memory/4100-353-0x000002C5400E0000-0x000002C5400F8000-memory.dmp

Filesize
96KB

Download
memory/4100-354-0x000002C540D00000-0x000002C540D50000-memory.dmp

Filesize
320KB

Download
memory/4100-355-0x000002C542950000-0x000002C542A02000-memory.dmp

Filesize
712KB

Download
memory/4100-356-0x000002C5401F0000-0x000002C54023C000-memory.dmp

Filesize
304KB

Download