quasar | hxxp://51[.]79[.]49[.]73/crc/

Resubmissions

04/12/2023, 23:29

231204-3gsz7agb7z10

22/11/2023, 01:10

231122-bjkcaaac8w10

13/06/2023, 19:34

230613-x94phabc4410

13/06/2023, 17:37

230613-v7hm5shf8310

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://51.79.49.73/crc/
Sample231122-bjkcaaac8w

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.109.1:1800

Mutex

551312a4-69e2-49ef-a9fc-324282122b52

Attributes

encryption_key
2C8CD3E5B94023D4196F46D6FC4A100DF5B725FE
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0002000000022afd-60.dat	family_quasar
behavioral1/files/0x0002000000022afd-85.dat	family_quasar
behavioral1/files/0x0002000000022afd-86.dat	family_quasar
behavioral1/memory/2384-87-0x0000000000ED0000-0x00000000011F4000-memory.dmp	family_quasar
behavioral1/files/0x0002000000022afd-120.dat	family_quasar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2384	local.exe
1864	local.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133450890604318164"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2852	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3736	chrome.exe
3736	chrome.exe
1564	chrome.exe
1564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3736	chrome.exe
3736	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeShutdownPrivilege	3736	chrome.exe
Token: SeCreatePagefilePrivilege	3736	chrome.exe
Token: SeDebugPrivilege	2384	local.exe
Token: SeShutdownPrivilege	3736	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
2384	local.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
3736	chrome.exe
2384	local.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1284	3736	chrome.exe	83
PID 3736 wrote to memory of 1284	3736	chrome.exe	83
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 836	3736	chrome.exe	86
PID 3736 wrote to memory of 1780	3736	chrome.exe	87
PID 3736 wrote to memory of 1780	3736	chrome.exe	87
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88
PID 3736 wrote to memory of 2372	3736	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://51.79.49.73/crc/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf2799758,0x7ffdf2799768,0x7ffdf2799778
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:2
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2800 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2792 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5412 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5396 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5380 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5508 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Users\Admin\Downloads\local.exe
  "C:\Users\Admin\Downloads\local.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:8
  2⤵
  PID:496
- C:\Users\Admin\Downloads\local.exe
  "C:\Users\Admin\Downloads\local.exe"
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\rem.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 --field-trial-handle=1876,i,14499189861465516122,2140678412607982819,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 823B
SHA256 2446b7e2e6196a82b97979fdad1cb753e1980ea6377c4a7dd08a8d75a072a377
MD5 e34abb1c0b695e23f2d01cd0456666dc
SHA1 7bb9bb3e2e423e1b73aa5385ad8177a1447024c5
SHA512 8b00c9528b8c88932c2ead8fb9caf565bb6af5ddd96b8ff58224b8c730f89667f5ef3f11d5372b717d0b2d466a1f4ef86def7b8eed9e640b566e41ebee86411a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 08f6b27b8c723fb8f6502748e11128ef8f2d011d68315c9a45a132b63747f2e8
MD5 64e349d85a74ce6edd097084347b7d27
SHA1 6d2f6e0cb877e52ecbd4614152be403ef66a4a44
SHA512 c1ff2844567cf56deffb198b872adb5bdde0101241a609c26ec25176e198b203df40df09bb32b56721182757f6e911a86af483548e939be5b8760cbef8e02215
SSDEEP 96:1WkMXhYnHv3KI4D8iZRy7Di+6Msmde7kyMFLOq0v4VjVhYtjEsXt0/cg2Vup:1ZMxwP3a8syy+FKky0VotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b48ad8c9d44d45f6902a4f64e30eba9708891e7a024bb328492827d53c35816b
MD5 37519cfbd678137f187c22a28dd748aa
SHA1 bfe5026b6b7239330e419be287e0e9b128beabf4
SHA512 4b1e2683ceca21095bc96e9d367cabc1752e5e456d2603c0fcb32a31a9cddf4a34e82aa8fd322d6dd8a321f567dddd562a81ed81a3e27b9cd504eed223f64165
SSDEEP 96:1WqMXhYnHv3KI4D8iZRy7Di+6Msmde7kyMFSIOq0v4VjVhYtjEsXt0/cg2Vup:1bMxwP3a8syy+FKkyNaVotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 d0528ca6d4554197c14c7c059be9c680db334aa196afec4046a4fd6375a92b05
MD5 e538c198e19ababaa09e3d2975dc4b70
SHA1 32cd5fcdf86c1bd0b848c0c3ad38076ec3b8fb00
SHA512 5eddbe01e1ef360643f71d183c4066d84ed9daf49ed4bf8a400017bd136db93383506ae1d2c7d8d24d7042151b3173bf52431f6058c7891650553d23eb405378
SSDEEP 96:1WdMXhYnHv3KI4D8iZRy7Di+6MsmdeTkqMHcvOq0v4VjVhYtjEsXt0/cg2Vup:1YMxwP3a8syy+F+kq1JVotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf905712-3705-4426-8554-4d7542a3bfde.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cf905712-3705-4426-8554-4d7542a3bfde.tmp
Size 6KB
SHA256 c07b6107f95192dcce7f12b8451d4669c34d61e0496c6bb88df449a108c3ee3f
MD5 6d53753266f64ba55e2156e6b0e4f163
SHA1 ff235acc7e68ce0853e52a12252c4ea3034e9d6d
SHA512 ffeb8cdc858a1660b386c38bfcc99e875c4622fd7662ce2719bf1dc76c070f9f4555aeb9f504baf23e26c5abce3d8f0f99f3460f21bbcb4e8418514f4b8c6f92
SSDEEP 96:1WTMXhYnHv3KI4G8iZRy7Di+6Msmde+kt1tOq0v4VjVhYtjEsXt0/cg2Vup:1yMxwP3H8syy+FPktdVotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 109KB
SHA256 0eb184db5fd3e248c7c790c007818d7d67f69b1b624ededaf1c4ec67ff8bfb7d
MD5 b377eb90ee97b08ff6c689bbae0205be
SHA1 ce17cfe6044c23ae7c1b077543ad4750e5d5739c
SHA512 3611df2074cbf8aa42971334a2946bdb0b625828381194ba34e9b3d9d20ea0449b4cbfd130a8cc07a56189c1771dd9723331bd27b1ff4f4efb308b1c2b695250
SSDEEP 3072:7/v+x+aZbVQsBd1VQOBXu0QdoaxxXWaEoE+Mq+Iruj/oH4+6o:7vwJZbVQsBpXTQT3Wa43O3H4Jo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 103KB
SHA256 58e09fa94aee0729f1be27dd9eefe7d70c748a6aa2ff2583f4d39a7785e15553
MD5 1afedde931763e824d803504e158460e
SHA1 b05c26a52bab28d3fbd2eaa3e2184fabeff2e45a
SHA512 cf02ab61692c7ee818163f7b5a10ed3b923e18ba11475575fa9ee523329bf6ed6f311d6254887c6c2ece94ca21ec84a8e1667c958c6a88b80d088ba0bae19d72
SSDEEP 384:iFrE+YOH9/pH0eWc+7H5/+pfreIzEK0VZ0xqhNL1BSOYb+FVrul9DYkGbx15zN+S:r+Yz87kCNKZhAe+02KaO9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 110KB
SHA256 de8fabe921242e2f3db283a08ea4f76b75532e9e4ea2a295b7a1abd4eb220a77
MD5 850130aa18d1404d6aad11ab2d9bd90a
SHA1 3e60a83e19ad15f8e4e9fb3e6b5694fbf858c9d8
SHA512 e2a5480c4a6dbb240f643a9e2cc7c81716452ae0ccc630d76bbc4595da935b09f679149488bc7a07098a258f02516ebb2fb149abe94c3940580f6c8a7a21f091
SSDEEP 384:YFrE+YOH9/pHBgUeWc+7H5/+pfreIzEK0VZ0xqhgTL1BSOYbTgFVru+l9DaDkGbc:l+YaZ87jYCjzAZhA6+02KHO9R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5837c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5837c4.TMP
Size 97KB
SHA256 26ea572db6dfe2228fb4a12734e3f6eea8ae0e36c73224f13707c84169e77696
MD5 12c86d9fb1fd681b2789895a5c856042
SHA1 daa6b9b1b146a5282d2d31621672ff34e19d9afa
SHA512 e20fa3a9a54e31ee078c849be091600f0cefd0f15f414f98e3431701bc8b1c673c3861368c81472fa9635a8552d513e2938f07938b84c722bbc9c1385e32b9b1
SSDEEP 384:BFrE+YOH9/pH0eWc+7H5/+pfreIzEFVZ0xqhNL1YOYbeVrul9DYkGbx15zN+CXlC:0+Yz87+CNHNhpg+02KaO9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

local.exe

Path C:\Users\Admin\Downloads\local.exe
Size 3.1MB
SHA256 58e825e9ba90117d194b592dca90ec50ca4cd171457b9afc69e210fd6e48bfe2
MD5 1335ea3b575ea12970ae595a60441d26
SHA1 189ee218a95b4a8203f8edb63e50b16fb3a81000
SHA512 136275b1f517f8e0e957d9c643c3b8a7bc8329b97d183e6f88fab10270922ab93efbc850a26e81f227998e759ba9ba4b994de260de929d5515c2c5b7527806bf
SSDEEP 49152:DvbI22SsaNYfdPBldt698dBcjHbswTbRvILoGd1ZTHHB72eh2NT:Dvk22SsaNYfdPBldt6+dBcjHbsw9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

local.exe

Path C:\Users\Admin\Downloads\local.exe
Size 3.1MB
SHA256 58e825e9ba90117d194b592dca90ec50ca4cd171457b9afc69e210fd6e48bfe2
MD5 1335ea3b575ea12970ae595a60441d26
SHA1 189ee218a95b4a8203f8edb63e50b16fb3a81000
SHA512 136275b1f517f8e0e957d9c643c3b8a7bc8329b97d183e6f88fab10270922ab93efbc850a26e81f227998e759ba9ba4b994de260de929d5515c2c5b7527806bf
SSDEEP 49152:DvbI22SsaNYfdPBldt698dBcjHbswTbRvILoGd1ZTHHB72eh2NT:Dvk22SsaNYfdPBldt6+dBcjHbsw9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

local.exe

Path C:\Users\Admin\Downloads\local.exe
Size 3.1MB
SHA256 58e825e9ba90117d194b592dca90ec50ca4cd171457b9afc69e210fd6e48bfe2
MD5 1335ea3b575ea12970ae595a60441d26
SHA1 189ee218a95b4a8203f8edb63e50b16fb3a81000
SHA512 136275b1f517f8e0e957d9c643c3b8a7bc8329b97d183e6f88fab10270922ab93efbc850a26e81f227998e759ba9ba4b994de260de929d5515c2c5b7527806bf
SSDEEP 49152:DvbI22SsaNYfdPBldt698dBcjHbswTbRvILoGd1ZTHHB72eh2NT:Dvk22SsaNYfdPBldt6+dBcjHbsw9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

local.exe

Path C:\Users\Admin\Downloads\local.exe
Size 3.1MB
SHA256 58e825e9ba90117d194b592dca90ec50ca4cd171457b9afc69e210fd6e48bfe2
MD5 1335ea3b575ea12970ae595a60441d26
SHA1 189ee218a95b4a8203f8edb63e50b16fb3a81000
SHA512 136275b1f517f8e0e957d9c643c3b8a7bc8329b97d183e6f88fab10270922ab93efbc850a26e81f227998e759ba9ba4b994de260de929d5515c2c5b7527806bf
SSDEEP 49152:DvbI22SsaNYfdPBldt698dBcjHbswTbRvILoGd1ZTHHB72eh2NT:Dvk22SsaNYfdPBldt6+dBcjHbsw9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

rem.txt

Path C:\Users\Admin\Downloads\rem.txt
Size 430KB
SHA256 d670ba9371ef60b5110813f593c9296b05bb8be9fdd9e0e51ef52045f42ca19e
MD5 ccac2c67464e07a7e2e312dda2dc0911
SHA1 33389a2e74593ae684d1fcd6429638154b47b92a
SHA512 7f68eadc043587656ef8e4c03df760b72f0396bd0032b747eea1676f827816f50d7572de5e673f31fa8309867a6496af6d149af86feca5ba64d8a7ec019c28cc
SSDEEP 12288:yqIGDSgpO30pZvjPxLR6E6J0YLs/M1WyaM00:VIOpO30zvRR6dJ0O/WB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

rem.txt.crdownload

Path C:\Users\Admin\Downloads\rem.txt.crdownload
Size 430KB
SHA256 d670ba9371ef60b5110813f593c9296b05bb8be9fdd9e0e51ef52045f42ca19e
MD5 ccac2c67464e07a7e2e312dda2dc0911
SHA1 33389a2e74593ae684d1fcd6429638154b47b92a
SHA512 7f68eadc043587656ef8e4c03df760b72f0396bd0032b747eea1676f827816f50d7572de5e673f31fa8309867a6496af6d149af86feca5ba64d8a7ec019c28cc
SSDEEP 12288:yqIGDSgpO30pZvjPxLR6E6J0YLs/M1WyaM00:VIOpO30zvRR6dJ0O/WB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1864-123-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Download

memory/1864-121-0x00007FFDDEE30000-0x00007FFDDF8F1000-memory.dmp

Download

memory/1864-125-0x00007FFDDEE30000-0x00007FFDDF8F1000-memory.dmp

Download

memory/2384-87-0x0000000000ED0000-0x00000000011F4000-memory.dmp

Download

memory/2384-122-0x00007FFDDEE30000-0x00007FFDDF8F1000-memory.dmp

Download

memory/2384-88-0x00007FFDDEE30000-0x00007FFDDF8F1000-memory.dmp

Download

memory/2384-128-0x000000001BD80000-0x000000001BD90000-memory.dmp

Download

memory/2384-91-0x000000001C920000-0x000000001C9D2000-memory.dmp

Download

memory/2384-90-0x000000001C810000-0x000000001C860000-memory.dmp

Download

memory/2384-89-0x000000001BD80000-0x000000001BD90000-memory.dmp

Download