quasar | 27810441ae1cf22aff376877945394e6430f4e8a0ce907f809880e173a851d35

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe
Size 6.7MB
Sample240329-ebe95sgh8t
SHA256 27810441ae1cf22aff376877945394e6430f4e8a0ce907f809880e173a851d35
MD5 178ea6b2fe4a5d53f40b4c4ef74f7448
SHA1 27581d9ec136e2cc3de4b5f6ed91cbee3ee86108
SHA512 cfce210fb940b4fb4f58946925d81a14d905644a80113194cb75eed087109f9ebb21da3edfaffeee5ecc56105dfd6eef38bbb3dfb897ecbde85624a29ec4e4ed
SSDEEP 196608:sHtgOOkds8GSt6cg53HRVu7vHDpS1IqBRU7kCs2q:sNa8GSQv53xVu7vHhqBa4Cs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar chrome evasion spyware themida trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Chrome

live.nodenet.ml:8863

Mutex

754ce6d6-f75b-4c6f-964c-3996e749369e

Attributes

encryption_key
8F8DE0B9E0A9CA156684061043456EC2CF7D0A6D
install_name
chrome.exe
log_directory
Logs
reconnect_delay
3000
startup_key
System
subdirectory
chrome

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016cd2-16.dat	family_quasar
behavioral1/memory/1536-31-0x0000000000020000-0x00000000000B0000-memory.dmp	family_quasar
behavioral1/memory/2612-38-0x0000000000310000-0x00000000003A0000-memory.dmp	family_quasar
behavioral1/memory/1532-54-0x00000000012A0000-0x0000000001330000-memory.dmp	family_quasar
behavioral1/memory/1532-56-0x000000001B080000-0x000000001B100000-memory.dmp	family_quasar
behavioral1/memory/1716-80-0x0000000001380000-0x0000000001410000-memory.dmp	family_quasar
behavioral1/memory/1716-82-0x000000001B190000-0x000000001B210000-memory.dmp	family_quasar
behavioral1/memory/872-120-0x000000001B140000-0x000000001B1C0000-memory.dmp	family_quasar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe

Executes dropped EXE 12 IoCs

pid	Process
1536	chrome.exe
2696	S^X.exe
2612	chrome.exe
1532	chrome.exe
1724	chrome.exe
1716	chrome.exe
3020	chrome.exe
2136	chrome.exe
872	chrome.exe
2780	chrome.exe
2196	chrome.exe
1912	chrome.exe

Loads dropped DLL 3 IoCs

pid	Process
2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe
2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe
2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0009000000016cc1-6.dat	themida
behavioral1/memory/2232-9-0x00000000729C0000-0x0000000072FC8000-memory.dmp	themida
behavioral1/memory/2232-10-0x00000000729C0000-0x0000000072FC8000-memory.dmp	themida
behavioral1/memory/2232-12-0x00000000729C0000-0x0000000072FC8000-memory.dmp	themida
behavioral1/memory/2232-27-0x00000000729C0000-0x0000000072FC8000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1048	schtasks.exe
1420	schtasks.exe
2832	schtasks.exe
2644	schtasks.exe
2884	schtasks.exe
2152	schtasks.exe
3000	schtasks.exe
2764	schtasks.exe
2628	schtasks.exe
1672	schtasks.exe
1164	schtasks.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
2500	PING.EXE
2696	PING.EXE
320	PING.EXE
2224	PING.EXE
1484	PING.EXE
2720	PING.EXE
832	PING.EXE
2312	PING.EXE
1744	PING.EXE
1428	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	chrome.exe
Token: SeDebugPrivilege	2612	chrome.exe
Token: SeDebugPrivilege	2696	S^X.exe
Token: SeDebugPrivilege	1532	chrome.exe
Token: SeDebugPrivilege	1724	chrome.exe
Token: SeDebugPrivilege	1716	chrome.exe
Token: SeDebugPrivilege	3020	chrome.exe
Token: SeDebugPrivilege	2136	chrome.exe
Token: SeDebugPrivilege	872	chrome.exe
Token: SeDebugPrivilege	2780	chrome.exe
Token: SeDebugPrivilege	2196	chrome.exe
Token: SeDebugPrivilege	1912	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2612	chrome.exe
1532	chrome.exe
1724	chrome.exe
1716	chrome.exe
3020	chrome.exe
2136	chrome.exe
872	chrome.exe
2780	chrome.exe
2196	chrome.exe
1912	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1536	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1536	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1536	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1536	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2696	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	29
PID 2232 wrote to memory of 2696	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	29
PID 2232 wrote to memory of 2696	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	29
PID 2232 wrote to memory of 2696	2232	178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe	29
PID 1536 wrote to memory of 2644	1536	chrome.exe	30
PID 1536 wrote to memory of 2644	1536	chrome.exe	30
PID 1536 wrote to memory of 2644	1536	chrome.exe	30
PID 1536 wrote to memory of 2612	1536	chrome.exe	32
PID 1536 wrote to memory of 2612	1536	chrome.exe	32
PID 1536 wrote to memory of 2612	1536	chrome.exe	32
PID 2612 wrote to memory of 2628	2612	chrome.exe	33
PID 2612 wrote to memory of 2628	2612	chrome.exe	33
PID 2612 wrote to memory of 2628	2612	chrome.exe	33
PID 2612 wrote to memory of 588	2612	chrome.exe	35
PID 2612 wrote to memory of 588	2612	chrome.exe	35
PID 2612 wrote to memory of 588	2612	chrome.exe	35
PID 588 wrote to memory of 112	588	cmd.exe	37
PID 588 wrote to memory of 112	588	cmd.exe	37
PID 588 wrote to memory of 112	588	cmd.exe	37
PID 588 wrote to memory of 1484	588	cmd.exe	38
PID 588 wrote to memory of 1484	588	cmd.exe	38
PID 588 wrote to memory of 1484	588	cmd.exe	38
PID 588 wrote to memory of 1532	588	cmd.exe	39
PID 588 wrote to memory of 1532	588	cmd.exe	39
PID 588 wrote to memory of 1532	588	cmd.exe	39
PID 1532 wrote to memory of 1672	1532	chrome.exe	40
PID 1532 wrote to memory of 1672	1532	chrome.exe	40
PID 1532 wrote to memory of 1672	1532	chrome.exe	40
PID 1532 wrote to memory of 2740	1532	chrome.exe	42
PID 1532 wrote to memory of 2740	1532	chrome.exe	42
PID 1532 wrote to memory of 2740	1532	chrome.exe	42
PID 2740 wrote to memory of 304	2740	cmd.exe	44
PID 2740 wrote to memory of 304	2740	cmd.exe	44
PID 2740 wrote to memory of 304	2740	cmd.exe	44
PID 2740 wrote to memory of 2720	2740	cmd.exe	45
PID 2740 wrote to memory of 2720	2740	cmd.exe	45
PID 2740 wrote to memory of 2720	2740	cmd.exe	45
PID 2740 wrote to memory of 1724	2740	cmd.exe	48
PID 2740 wrote to memory of 1724	2740	cmd.exe	48
PID 2740 wrote to memory of 1724	2740	cmd.exe	48
PID 1724 wrote to memory of 1164	1724	chrome.exe	49
PID 1724 wrote to memory of 1164	1724	chrome.exe	49
PID 1724 wrote to memory of 1164	1724	chrome.exe	49
PID 1724 wrote to memory of 3032	1724	chrome.exe	51
PID 1724 wrote to memory of 3032	1724	chrome.exe	51
PID 1724 wrote to memory of 3032	1724	chrome.exe	51
PID 3032 wrote to memory of 2892	3032	cmd.exe	53
PID 3032 wrote to memory of 2892	3032	cmd.exe	53
PID 3032 wrote to memory of 2892	3032	cmd.exe	53
PID 3032 wrote to memory of 832	3032	cmd.exe	54
PID 3032 wrote to memory of 832	3032	cmd.exe	54
PID 3032 wrote to memory of 832	3032	cmd.exe	54
PID 3032 wrote to memory of 1716	3032	cmd.exe	55
PID 3032 wrote to memory of 1716	3032	cmd.exe	55
PID 3032 wrote to memory of 1716	3032	cmd.exe	55
PID 1716 wrote to memory of 2884	1716	chrome.exe	56
PID 1716 wrote to memory of 2884	1716	chrome.exe	56
PID 1716 wrote to memory of 2884	1716	chrome.exe	56
PID 1716 wrote to memory of 1228	1716	chrome.exe	58
PID 1716 wrote to memory of 1228	1716	chrome.exe	58

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\178ea6b2fe4a5d53f40b4c4ef74f7448_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Roaming\chrome.exe
  "C:\Users\Admin\AppData\Roaming\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2644
- - C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
    "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2628
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sSbfmiDMShKN.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:112
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:1484
    - - C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:1672
      - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FG7H5zxVqj8G.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1164
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ltaHeOFkLIvr.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:832
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        10⤵
        Creates scheduled task(s)
        
        PID:2884
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\aMImPVBKj4e7.bat" "
        10⤵
        
        PID:1228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:2312
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        12⤵
        Creates scheduled task(s)
        
        PID:2152
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\i9PjtF0jNAHi.bat" "
        12⤵
        
        PID:2928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2496
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:2500
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        14⤵
        Creates scheduled task(s)
        
        PID:3000
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\F24yB1n8Xa01.bat" "
        14⤵
        
        PID:2848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2676
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:1744
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        16⤵
        Creates scheduled task(s)
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YNMUGfZ9SbvV.bat" "
        16⤵
        
        PID:2632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:2696
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        18⤵
        Creates scheduled task(s)
        
        PID:1420
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zaTW6bGGh9Tl.bat" "
        18⤵
        
        PID:1664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:572
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:320
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2196
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        20⤵
        Creates scheduled task(s)
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IkhsgShrvKnN.bat" "
        20⤵
        
        PID:1784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:2224
        
        C:\Users\Admin\AppData\Roaming\chrome\chrome.exe
        
        "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\chrome\chrome.exe" /rl HIGHEST /f
        22⤵
        Creates scheduled task(s)
        
        PID:2832
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\yquUkxXdIidD.bat" "
        22⤵
        
        PID:948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:1428
- C:\Users\Admin\AppData\Local\Temp\S^X.exe
  "C:\Users\Admin\AppData\Local\Temp\S^X.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F24yB1n8Xa01.bat

Path C:\Users\Admin\AppData\Local\Temp\F24yB1n8Xa01.bat
Size 207B
SHA256 91627f8c2bd24c3562f0a013005c274681c813dff4b3dd6811b8684f2ffec890
MD5 ab77fb52046716e16454963886d61c22
SHA1 511c8310edd425a5fb8170dd93dbb402e982e315
SHA512 cc8f6fbe7631b9c6c2e53b51232db8949ebac0fc82c8a0a4ea3d7a6ac60b1d0238b73dbccb90d12e2323b76155a22f95a7a2c3fb39ab3bf3d8ed00b3521933fc
MD5 SHA1 SHA512

Submit Download

FG7H5zxVqj8G.bat

Path C:\Users\Admin\AppData\Local\Temp\FG7H5zxVqj8G.bat
Size 207B
SHA256 ecf9b84a0e1de74193c179313e6ef27c48334946e88bb81305f9b483863ae534
MD5 49e3e01055cf2de5c68940895802500c
SHA1 9daeed1374aa11a7b2c6ccfe143f99410d41c0b1
SHA512 879d27bd94355ea952fe68a2426b2003065b9dd7e86b9409462c2cf93f026682cf164526f382ff19db3d8c4c137c67b238ee2919acc4139f14827696ab52309e
MD5 SHA1 SHA512

Submit Download

IkhsgShrvKnN.bat

Path C:\Users\Admin\AppData\Local\Temp\IkhsgShrvKnN.bat
Size 207B
SHA256 ef441da1c75422bfd4ab99a060ef49d000f97304a4ea3f61d45569337b3fe2c5
MD5 153e296052da5104b4ece578768b85e2
SHA1 57ddc8d3d94ee6f981a63572868d7a5f541d03e7
SHA512 b34b53cb24f0b0ff465cf850e8a030d10e1bab46642904c8fff4903d2dba52250c0dcdcec537f0758691f568f570cc7de17298a7af89699cc102ed77342ae43f
MD5 SHA1 SHA512

Submit Download

YNMUGfZ9SbvV.bat

Path C:\Users\Admin\AppData\Local\Temp\YNMUGfZ9SbvV.bat
Size 207B
SHA256 88289c227846ca4350508af895b3633407f3e95111d7f8a6b350ca42f5502c70
MD5 74175e05e8887663da6043a09174e4d2
SHA1 53183b302ea9451b57808b55b7cdb642acb7b47e
SHA512 c659291f3df45326f7254dc12ffcddd816ae5ffb8d609d8c8e38c0951f46adbe0164a475be6b6f3f8c989533b52ef03ed1c107a73129eeae00c2553d99ee438d
MD5 SHA1 SHA512

Submit Download

aMImPVBKj4e7.bat

Path C:\Users\Admin\AppData\Local\Temp\aMImPVBKj4e7.bat
Size 207B
SHA256 66d6eaac2188eba2850c9acea011dca6c815baf2effd52cd12a748a6940b6a57
MD5 ee8d59c9a0d15c368114ee64d89e73d7
SHA1 d0277889fe92e1f4d6c7edee8b56955b9df5b609
SHA512 71de0e228da3fa8723e3e12c8f795f8e7157878b1d9917bbbb0c5a6fa8fa68673aa4fb0191bff10756c40c94da693bdab0c90e2a4636eb6c821c95dee75c0100
MD5 SHA1 SHA512

Submit Download

i9PjtF0jNAHi.bat

Path C:\Users\Admin\AppData\Local\Temp\i9PjtF0jNAHi.bat
Size 207B
SHA256 0adde0da4f8874ff3ba68878fb7ee07b8124ff1af60b1096934b217c5b8630a5
MD5 60d59b56c5ae8650f33a4691e2da6b56
SHA1 4f35a3d667146bb1800752f8aab9c8bac52a8600
SHA512 161337a0f2589db27c39701d4f31cb9e2a07c7fa705406ce94fa3e015984b345960c416db02bed323a8583ac2549b4d4c9e486e02577ad7df18146ca13e43ed2
MD5 SHA1 SHA512

Submit Download

ltaHeOFkLIvr.bat

Path C:\Users\Admin\AppData\Local\Temp\ltaHeOFkLIvr.bat
Size 207B
SHA256 77d1c4be87d2c3074269ce34335847a8196d71057bdbcce11c0bf84cbc5c6874
MD5 f9ba2ef4be2b31d9e248671ffc74efb1
SHA1 b3012ae762bf39c1836ed235c44755fc777c67c5
SHA512 dd87e650fd28eae7e4c32c00aa2785e37875182481e50ffe4d65c1f8b04fd62b2c7cff1454a3a13d063ac3b68bbb86889071a4ee18e8f6d6f32e565396e64a30
MD5 SHA1 SHA512

Submit Download

sSbfmiDMShKN.bat

Path C:\Users\Admin\AppData\Local\Temp\sSbfmiDMShKN.bat
Size 207B
SHA256 c2b10e1d969a39ad6e2d0fb428b2f01b18785f4350782f1d3841645d4cb3ac05
MD5 97a4397a44ff879c1c86da6bc203c429
SHA1 b824a8c76e80ae2a061cdbcb3db8c66ae5f786b6
SHA512 c16d5bff4613f7eda574b780d6c310f70cf2d6e08b194e9b67adead8cb10f05410d9a807134aa7da3fc1cd25fe141623abdfd441730d82cb3aa11b15d2b96be7
MD5 SHA1 SHA512

Submit Download

yquUkxXdIidD.bat

Path C:\Users\Admin\AppData\Local\Temp\yquUkxXdIidD.bat
Size 207B
SHA256 6a445abcd6239cbf08df069008234d7ce56ade6b7d8ba2db714762d3ffbfb064
MD5 4450073d54cf840fc164a93b3793b240
SHA1 c6649aa1514f2c131fc7a0ab3b807ccb87ed7aa6
SHA512 253de18446930c6c0deb7edd446e43908b91fd5451b29e360d64d47c9c588b1fee99799d41f32ebd95f76b7ac97d0ab5b7215175d2e47107088996087efced79
MD5 SHA1 SHA512

Submit Download

zaTW6bGGh9Tl.bat

Path C:\Users\Admin\AppData\Local\Temp\zaTW6bGGh9Tl.bat
Size 207B
SHA256 ae8c6e85795bf10ba283117fd2bcd2f725542a0e4e7aaf8a354ea315ddc85f9d
MD5 1a336faa5aee7b3c957b2e1b4d883c67
SHA1 443c8eef93b6a6e02ddb8e771cb9c64ac7ccd1c7
SHA512 81316d7c86ba1c6ae8c268e8a37904ca6472262a890d8f6bd3c81df6ad4cc78900bdee6de508009caab1b23504c99a01ce6282591aac7fd45a596bd68f131476
MD5 SHA1 SHA512

Submit Download

AgileDotNetRT.dll

Path \Users\Admin\AppData\Local\Temp\9597a42a-4c71-48eb-9cb7-e4568a3181fa\AgileDotNetRT.dll
Size 2.2MB
SHA256 091ab8a1acdab40c544bd1e5c91a96881acc318cac4df5235e1b5673f5489280
MD5 2d86c4ad18524003d56c1cb27c549ba8
SHA1 123007f9337364e044b87deacf6793c2027c8f47
SHA512 0dd5204733b3c20932aeea2cebf0ca1eeca70e4b3b3b8932d78d952a8f762f0b96ebdbdaf217e95889c02ec6a39b8f9919fd4c0cba56bb629256e71fa61faa3c
SSDEEP 49152:jmbD2q6AkulEhYwJJD0fNaD/snQLWLhNE8iQdUd:yaJElE1D00D/8QLWLhNE2Ud
MD5 SHA1 SHA512 SSDEEP

Submit Download

S^X.exe

Path \Users\Admin\AppData\Local\Temp\S^X.exe
Size 789KB
SHA256 94594fa46d0bd28c02365f0a32ec3a662b25df95f3f3e8e2a952c18a23895b12
MD5 e2437ac017506bbde9a81fb1f618457b
SHA1 adef2615312b31e041ccf700b3982dd50b686c7f
SHA512 9169f8be39b8fede38f7fce5a2e64d42630857e0ebd37f921c68ccf0bf0a8816f1682ba4659d22ad43413d99de62a59b2494494701404b44aa41c4d6bdc1e019
SSDEEP 6144:o1V/Sd16RD2ReKo4mtylsFn3hwEP/boCewxiZMi6sHW8VMuLdujv8YoyIY:o1V/Sd16R/K2VnxbXb0ZzJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Roaming\chrome.exe
Size 554KB
SHA256 db92bc93c4836e5db7564cb101233e0c169d3fd5aa6b231538080061ec385be8
MD5 2589204aeb19a1d261d5823ca05dd542
SHA1 292de66a43c8ddfab44cd16020434a7349e546a4
SHA512 cafad1246160eb9843ebeb0de5f9cf17a89341d8c91940644d3fe294dd04ad29d579382f1b97bf7ad29b4be053e11febfc189dd7e12dd22dd27f892cb945572c
SSDEEP 6144:3TEgdc0YdX7IxUpGREWXk9QZGU4Q1fv27cEBSb8F9WJw/NcTR37DwNaSr:3TEgdfYGxUTiKxVUJwlcd7DwNaSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/872-119-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/872-120-0x000000001B140000-0x000000001B1C0000-memory.dmp

Download

memory/872-131-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/1532-56-0x000000001B080000-0x000000001B100000-memory.dmp

Download

memory/1532-54-0x00000000012A0000-0x0000000001330000-memory.dmp

Download

memory/1532-65-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/1532-55-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/1536-33-0x000000001AED0000-0x000000001AF50000-memory.dmp

Download

memory/1536-31-0x0000000000020000-0x00000000000B0000-memory.dmp

Download

memory/1536-32-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/1536-40-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/1716-92-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/1716-80-0x0000000001380000-0x0000000001410000-memory.dmp

Download

memory/1716-81-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/1716-82-0x000000001B190000-0x000000001B210000-memory.dmp

Download

memory/1724-68-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/1724-78-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/1912-157-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/1912-167-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/2136-117-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/2136-106-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/2196-145-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/2196-155-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/2232-10-0x00000000729C0000-0x0000000072FC8000-memory.dmp

Download

memory/2232-2-0x0000000000A60000-0x0000000000AA0000-memory.dmp

Download

memory/2232-1-0x0000000074820000-0x0000000074DCB000-memory.dmp

Download

memory/2232-9-0x00000000729C0000-0x0000000072FC8000-memory.dmp

Download

memory/2232-11-0x00000000776D0000-0x00000000776D2000-memory.dmp

Download

memory/2232-28-0x0000000074820000-0x0000000074DCB000-memory.dmp

Download

memory/2232-27-0x00000000729C0000-0x0000000072FC8000-memory.dmp

Download

memory/2232-0-0x0000000074820000-0x0000000074DCB000-memory.dmp

Download

memory/2232-13-0x00000000746A0000-0x00000000746FB000-memory.dmp

Download

memory/2232-12-0x00000000729C0000-0x0000000072FC8000-memory.dmp

Download

memory/2612-38-0x0000000000310000-0x00000000003A0000-memory.dmp

Download

memory/2612-50-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/2612-39-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/2696-30-0x0000000072130000-0x000000007281E000-memory.dmp

Download

memory/2696-52-0x0000000072130000-0x000000007281E000-memory.dmp

Download

memory/2696-41-0x00000000048C0000-0x0000000004900000-memory.dmp

Download

memory/2696-29-0x00000000009A0000-0x0000000000A6C000-memory.dmp

Download

memory/2780-133-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/2780-143-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Download

memory/3020-104-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

memory/3020-94-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads