quasar | 7ed672be4c63c1e9c726843a76a8ba96af26c242742b9feb69e51ac3b681cf6f

Analysis

max time kernel
1794s
max time network
1808s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rat.exe
Size 3.1MB
Sample240221-xjqpyseb28
SHA256 7ed672be4c63c1e9c726843a76a8ba96af26c242742b9feb69e51ac3b681cf6f
MD5 fc85c7753f60a7be64282dc768d82ddb
SHA1 89402d107e7b9060890ea3a6a77eb63792be50f9
SHA512 08acfd1366046675328e00ec5a8e4133879ffefeabfdd6a0bbc3db2a71829d7c1915b166f984b63543eb386f2091ba3c4a5f37556dbfa68b35634365b8084dd1
SSDEEP 49152:avzlL26AaNeWgPhlmVqvMQ7XSKa9/TBxZ/oGdz2THHB72eh2NT:avpL26AaNeWgPhlmVqkQ7XSKY/h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

nayef.ddns.net:4782

Mutex

d4cc8fd4-c53a-41d0-8597-9c4d66a686e4

Attributes

encryption_key
207983DF7933102376491C87A7AF844DA0465E51
install_name
Windows Wireless LAN.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Wireless LAN
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/4164-0-0x00000000004D0000-0x00000000007F4000-memory.dmp	family_quasar
behavioral2/files/0x00060000000231fe-6.dat	family_quasar
behavioral2/files/0x00060000000231fe-8.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4556	Windows Wireless LAN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3156	schtasks.exe
3984	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
2988	msedge.exe
2988	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	rat.exe
Token: SeDebugPrivilege	4556	Windows Wireless LAN.exe
Token: 33	4188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4188	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4556	Windows Wireless LAN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3156	4164	rat.exe	87
PID 4164 wrote to memory of 3156	4164	rat.exe	87
PID 4164 wrote to memory of 4556	4164	rat.exe	88
PID 4164 wrote to memory of 4556	4164	rat.exe	88
PID 4556 wrote to memory of 3984	4556	Windows Wireless LAN.exe	91
PID 4556 wrote to memory of 3984	4556	Windows Wireless LAN.exe	91
PID 4556 wrote to memory of 2988	4556	Windows Wireless LAN.exe	95
PID 4556 wrote to memory of 2988	4556	Windows Wireless LAN.exe	95
PID 2988 wrote to memory of 2296	2988	msedge.exe	96
PID 2988 wrote to memory of 2296	2988	msedge.exe	96
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 2084	2988	msedge.exe	98
PID 2988 wrote to memory of 3892	2988	msedge.exe	97
PID 2988 wrote to memory of 3892	2988	msedge.exe	97
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99
PID 2988 wrote to memory of 3612	2988	msedge.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat.exe
"C:\Users\Admin\AppData\Local\Temp\rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Wireless LAN" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Wireless LAN.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3156
- C:\Users\Admin\AppData\Roaming\SubDir\Windows Wireless LAN.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Windows Wireless LAN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Wireless LAN" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Wireless LAN.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://only-fans.uk/asdd
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb64a946f8,0x7ffb64a94708,0x7ffb64a94718
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3368 /prefetch:8
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4529747897996419559,7784230847024463362,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2736 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13
MD5 3782686f747f4a85739b170a3898b645
SHA1 81ae1c4fd3d1fddb50b3773e66439367788c219c
SHA512 54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8
MD5 58670ac03d80eb4bd1cec7ac5672d2e8
SHA1 276295d2f9e58fb0b8ef03bd9567227fb94e03f7
SHA512 99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 719KB
SHA256 cb8363a3971762ebb8bda85f56f8babbf0b91c1ee0743eea6e0527259dbdf07d
MD5 fbf36325dd3cb8bd19632ee3c7352810
SHA1 f77ec5291a67a652d4d05b20ad7139d8fbbc159e
SHA512 3e12ce3e747f5f7a8262494c091cfbcc6d72b679fb4f6c27b1bf0dee99d83034241bc5d623b2f608eb809b92b713cb4619d383adbc2676eaf9b95a71e26906cc
SSDEEP 12288:o+5VRpRfw53z/xAyjz2dH+YOq/O4t6Gf26lYigaN/L3fpZjyWSVNwM23tR:o+pRfazKy25+2p6Gf2wp3jfvLSnT23tR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 3572f86072ad3e9cb8ee4ec88fad2d50e1882a3287282d5791e2b0b685cfb8d6
MD5 007e032bfd806470a174d29793a926c1
SHA1 03962be6b9a9c751167d0b16e20dc3e5945f08fc
SHA512 d5bb245262dcb5484f498275b977026175e8273a9b471d4681b0e6e6660d7b355adafe44bcfb5a13015af48e716d3493928328c624128f34d1196523b541540e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 70c52f2fcb23ded20bebba85effce533946cac36cf8145a8b422d24e7d786ca1
MD5 ecf6a8a4876521b218866612ecb1685c
SHA1 3ecaa5c0d7b961fc9ab15fcf19121a8db90b5554
SHA512 ea8d10ff8d481438c5d34bc8f61b24cdf9579fe78e4c3a6ec916c76abe8db3cee55d90db09f09884ddf17dec1c9188642a560928fc08558730201046e5d500ce
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 49d39219aa473fd339c4176619e01feff4e1096eef85744fd5b85bdc77459a0c
MD5 fec281b6a66cf59f84a5b4b5fbb28f28
SHA1 b96cc38a6eeb64b833ae82a30141521e8391a0b2
SHA512 7f38bdcb9b3487b8826773fd925f30d65540692ba738523c2e9d2fe969609893ad3b52ea43b86c892a9272da17721f9db9cdd63793eaef5521955f48c43a45ce
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 14ab65057e18115f7ee1fe61ca671fcdcf761be717d9e6540bb0d2a398ee6443
MD5 1606c898e636c8601cc242602f4d9cb2
SHA1 84c5a440871387ce709dd53c2a4539aafccc3ffa
SHA512 55b67078c479b6e733ad8e9da8b796c8fb1cc910e45e0aaf826116e3ef9f1d707b9934d5f565f1cd367edb84452e635f0c204fb0599a7a3b66705cb56749bfd3
SSDEEP 96:n+bkP5O61p3GgqwpvWMoiVmdeHlfbO9M0k1UWQyV+VD7ziEwb:n+bkPA6n3iGWMXlcM0k1rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 34d5c78d6547f7a808821447429013e2b7c136ee7b920ada37d07adea31c1cc6
MD5 4a27289d68d521ce002c80371f56adb7
SHA1 5dffb83cfdebfa08fb8dd412f17809eb4ed816fe
SHA512 252cd4f11d52286f8ec309bf1e2f3bc287a77a677adb79a3b2939ada7baf81f8d29495a64cf2d62a26a94a629657c1b17f31a023a3395ba2bd25353dda634e0e
SSDEEP 192:n+bkPi6nbyidWMYulbGkgVV62lwM0k1rg:n+b+i6bHW0bSwM0k+
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0c07495b0e7dfe700fcff7993936bbf84e7982c868adefa118f7f02a0ccd214d
MD5 eeaf922a6fb8d2f8a690be931837203d
SHA1 856a978787afd06ebd49b36c4a3cebcb16613762
SHA512 6a72b9f9d310d81c44597e166b2fa41fb98d4b237679c3652d097748b155cd66c0389727fa41ca46b28918c49e0b692ef1e3992326d69133356326bb8e5195d7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQk7e2RUoyCQ9bq+9xUX1MX:A9iIxuERzA83h09RZxYQETyCX+9E1MeU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Wireless LAN.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Windows Wireless LAN.exe
Size 3.1MB
SHA256 6ff8492e3fd3b5ae51727614dbf4a4253028128764191972b78fb0fd3f1edb95
MD5 69ffcb718695dfdf4f676b0554808040
SHA1 97f3514953953e6146f3725e9b41e33a8aca4f05
SHA512 d93d22a2af5dec747dc3ce8e3d87cd2d6e3ba2d43b52c3882d211b90082e1a60faf020ebba4c01fcfa3f1b229478e72d2afd111e19dc6684efac8ba2813709b5
SSDEEP 49152:avzlL26AaNeWgPhlmVqvMQ7XSKa9/TBxZ/oGdz2THHB72eh2NTI:avpL26AaNeWgPhlmVqkQ7XSKY/hE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Wireless LAN.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Windows Wireless LAN.exe
Size 3.1MB
SHA256 7ed672be4c63c1e9c726843a76a8ba96af26c242742b9feb69e51ac3b681cf6f
MD5 fc85c7753f60a7be64282dc768d82ddb
SHA1 89402d107e7b9060890ea3a6a77eb63792be50f9
SHA512 08acfd1366046675328e00ec5a8e4133879ffefeabfdd6a0bbc3db2a71829d7c1915b166f984b63543eb386f2091ba3c4a5f37556dbfa68b35634365b8084dd1
SSDEEP 49152:avzlL26AaNeWgPhlmVqvMQ7XSKa9/TBxZ/oGdz2THHB72eh2NT:avpL26AaNeWgPhlmVqkQ7XSKY/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4164-0-0x00000000004D0000-0x00000000007F4000-memory.dmp

Download

memory/4164-10-0x00007FFB6A180000-0x00007FFB6AC41000-memory.dmp

Download

memory/4164-2-0x000000001B450000-0x000000001B460000-memory.dmp

Download

memory/4164-1-0x00007FFB6A180000-0x00007FFB6AC41000-memory.dmp

Download

memory/4556-9-0x00007FFB6A180000-0x00007FFB6AC41000-memory.dmp

Download

memory/4556-18-0x00007FFB6A180000-0x00007FFB6AC41000-memory.dmp

Download

memory/4556-16-0x000000001C8C0000-0x000000001C9C2000-memory.dmp

Download

memory/4556-15-0x000000001C340000-0x000000001C37C000-memory.dmp

Download

memory/4556-14-0x000000001C280000-0x000000001C292000-memory.dmp

Download

memory/4556-13-0x000000001C3C0000-0x000000001C472000-memory.dmp

Download

memory/4556-12-0x000000001C2B0000-0x000000001C300000-memory.dmp

Download

memory/4556-11-0x000000001B850000-0x000000001B860000-memory.dmp

Download