quasar | d329e37a26e6439fb7207716d740d9c1eee70a7e662a115c0cddcabee8ab8bc3

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Size 781KB
Sample240417-rrw9tabg96
SHA256 63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669
MD5 4848c2aa032ded794410ebc729fc18a2
SHA1 ba4200a24bbd4f70594e72414493a350b4c95608
SHA512 05e9bded510f16f06364ae913f1f494434b1cff4723213dbda1ebdf8da21ffa42764252e129d9e74fe501b5b273884b07213edf81efe24ec14692752f78b714b
SSDEEP 12288:2rD64vvpqDUB/B1idOmEigAqiiqwTFTBK/cOV682wiVZe+0Ks:8DxvuUB7idOmEHNqsxBHOR2rVZAKs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar evasion persistence spyware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/1756-13-0x0000000000400000-0x000000000045C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 9 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Vepre.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4"	Vepre.exe

Quasar RAT 3 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
Key created		\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Root	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
	42	ip-api.com	Process not Found
	52	ip-api.com	Process not Found

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1756-13-0x0000000000400000-0x000000000045C000-memory.dmp	family_quasar

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Vepre.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	Vepre.exe

Executes dropped EXE 2 IoCs

pid	Process
1208	Vepre.exe
5040	Vepre.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Vepre.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe\""	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe\""	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gret\\Vepre.exe\""	Vepre.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gret\\Vepre.exe\""	Vepre.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Vepre.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
39	pastebin.com
40	pastebin.com
51	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	ip-api.com
52	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 1208 set thread context of 5040	1208	Vepre.exe	100

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1876	schtasks.exe
4660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
2356	powershell.exe
2356	powershell.exe
2200	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Token: SeDebugPrivilege	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	5040	Vepre.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5040	Vepre.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1984	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	91
PID 2568 wrote to memory of 1984	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	91
PID 2568 wrote to memory of 1984	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	91
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 2568 wrote to memory of 1756	2568	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	92
PID 1756 wrote to memory of 1876	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	93
PID 1756 wrote to memory of 1876	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	93
PID 1756 wrote to memory of 1876	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	93
PID 1756 wrote to memory of 3052	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	95
PID 1756 wrote to memory of 3052	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	95
PID 1756 wrote to memory of 3052	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	95
PID 1756 wrote to memory of 2356	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	97
PID 1756 wrote to memory of 2356	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	97
PID 1756 wrote to memory of 2356	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	97
PID 1756 wrote to memory of 1208	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	99
PID 1756 wrote to memory of 1208	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	99
PID 1756 wrote to memory of 1208	1756	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe	99
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 1208 wrote to memory of 5040	1208	Vepre.exe	100
PID 5040 wrote to memory of 4660	5040	Vepre.exe	101
PID 5040 wrote to memory of 4660	5040	Vepre.exe	101
PID 5040 wrote to memory of 4660	5040	Vepre.exe	101
PID 5040 wrote to memory of 4408	5040	Vepre.exe	103
PID 5040 wrote to memory of 4408	5040	Vepre.exe	103
PID 5040 wrote to memory of 4408	5040	Vepre.exe	103
PID 5040 wrote to memory of 2200	5040	Vepre.exe	105
PID 5040 wrote to memory of 2200	5040	Vepre.exe	105
PID 5040 wrote to memory of 2200	5040	Vepre.exe	105

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Vepre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe

C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
"C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
  "C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe"
  2⤵
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe
  "C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Modifies security service
  - Quasar RAT
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /delete /tn "iTelemetryLogtte" /f
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Users\Admin\AppData\Roaming\Gret\Vepre.exe
    "C:\Users\Admin\AppData\Roaming\Gret\Vepre.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Users\Admin\AppData\Roaming\Gret\Vepre.exe
      "C:\Users\Admin\AppData\Roaming\Gret\Vepre.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Modifies security service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5040
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\Gret\Vepre.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:4660
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /delete /tn "iTelemetryLogtte" /f
        5⤵
        
        PID:4408
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669.exe.log
Size 1KB
SHA256 451a266b23424f3075e68b990cb90c7c177d48a64688c39ee77a4e9e239cf311
MD5 27b2fec2a6283b09ef15bd709cb96c3d
SHA1 728585dd6390edf7806524dcf4bf18139632a001
SHA512 bb10e90a881b259b1b90e54a1451f660c96e900576000a294cd1311ac5a6d3b3567cc7ad169ed26ff38719d65462ad31b2247e0f80118dd693f45927255de50b
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 34c30495f8988955647f3e3ea0b5e3b9443f8858d7c80131c9a95128908b5dc2
MD5 7d4efd1cb14290b8a18bcc35ed110c53
SHA1 5c74751e60c20514403983f15684c3065d952f3e
SHA512 b762b08d373681e13d2ea8d0c735c8f4b71f2c0facaeaa831a670a7287b166cce4ef3cb0c9941959676f43f5865d8d1896a87c59d752dc861780b500f9df7965
SSDEEP 384:csf+BV9i+kikq3BidJkyC1o9VpmTfK6seYLME/B03SoZ2fYSggjEDk+Q0gdEtkKq:ZfzidoMy5VpmTfNgrqSBWeEDDCe0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_300usk4f.enm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_300usk4f.enm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Vepre.exe

Path C:\Users\Admin\AppData\Roaming\Gret\Vepre.exe
Size 781KB
SHA256 63bd1085581bf0a8f7c9b01eb5d3a2d551fcc671a3916064891ea85c00d24669
MD5 4848c2aa032ded794410ebc729fc18a2
SHA1 ba4200a24bbd4f70594e72414493a350b4c95608
SHA512 05e9bded510f16f06364ae913f1f494434b1cff4723213dbda1ebdf8da21ffa42764252e129d9e74fe501b5b273884b07213edf81efe24ec14692752f78b714b
SSDEEP 12288:2rD64vvpqDUB/B1idOmEigAqiiqwTFTBK/cOV682wiVZe+0Ks:8DxvuUB7idOmEHNqsxBHOR2rVZAKs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1208-83-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1208-78-0x0000000005750000-0x0000000005760000-memory.dmp

Download

memory/1208-77-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1208-76-0x0000000005750000-0x0000000005760000-memory.dmp

Download

memory/1208-74-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1756-20-0x0000000006CE0000-0x0000000006D46000-memory.dmp

Download

memory/1756-21-0x0000000006FD0000-0x0000000006FE2000-memory.dmp

Download

memory/1756-22-0x0000000007030000-0x000000000706C000-memory.dmp

Download

memory/1756-13-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1756-75-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1756-16-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/1756-18-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/2200-115-0x0000000007F30000-0x0000000007F41000-memory.dmp

Download

memory/2200-114-0x0000000007C90000-0x0000000007D33000-memory.dmp

Download

memory/2200-116-0x0000000007F70000-0x0000000007F84000-memory.dmp

Download

memory/2200-118-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2200-104-0x000000006FDC0000-0x000000006FE0C000-memory.dmp

Download

memory/2200-103-0x000000007F7F0000-0x000000007F800000-memory.dmp

Download

memory/2200-102-0x0000000003070000-0x0000000003080000-memory.dmp

Download

memory/2200-101-0x0000000006AF0000-0x0000000006B3C000-memory.dmp

Download

memory/2200-99-0x0000000006460000-0x00000000067B4000-memory.dmp

Download

memory/2200-88-0x0000000003070000-0x0000000003080000-memory.dmp

Download

memory/2200-89-0x0000000003070000-0x0000000003080000-memory.dmp

Download

memory/2200-87-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2356-59-0x0000000007560000-0x000000000756A000-memory.dmp

Download

memory/2356-28-0x00000000052F0000-0x0000000005918000-memory.dmp

Download

memory/2356-42-0x0000000006220000-0x000000000626C000-memory.dmp

Download

memory/2356-43-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/2356-44-0x00000000073F0000-0x0000000007422000-memory.dmp

Download

memory/2356-45-0x000000006FD90000-0x000000006FDDC000-memory.dmp

Download

memory/2356-55-0x0000000006780000-0x000000000679E000-memory.dmp

Download

memory/2356-56-0x0000000007430000-0x00000000074D3000-memory.dmp

Download

memory/2356-57-0x0000000007B60000-0x00000000081DA000-memory.dmp

Download

memory/2356-58-0x0000000007500000-0x000000000751A000-memory.dmp

Download

memory/2356-25-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2356-60-0x0000000007770000-0x0000000007806000-memory.dmp

Download

memory/2356-61-0x00000000076F0000-0x0000000007701000-memory.dmp

Download

memory/2356-62-0x0000000007720000-0x000000000772E000-memory.dmp

Download

memory/2356-63-0x0000000007730000-0x0000000007744000-memory.dmp

Download

memory/2356-64-0x0000000007830000-0x000000000784A000-memory.dmp

Download

memory/2356-65-0x0000000007810000-0x0000000007818000-memory.dmp

Download

memory/2356-68-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2356-24-0x00000000028C0000-0x00000000028F6000-memory.dmp

Download

memory/2356-26-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/2356-40-0x0000000005C00000-0x0000000005F54000-memory.dmp

Download

memory/2356-27-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/2356-41-0x00000000061E0000-0x00000000061FE000-memory.dmp

Download

memory/2356-29-0x0000000005950000-0x0000000005972000-memory.dmp

Download

memory/2356-30-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/2568-0-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2568-8-0x0000000004C10000-0x0000000004C20000-memory.dmp

Download

memory/2568-2-0x0000000004EE0000-0x0000000005484000-memory.dmp

Download

memory/2568-9-0x0000000004C00000-0x0000000004C0A000-memory.dmp

Download

memory/2568-12-0x0000000008AF0000-0x0000000008B8C000-memory.dmp

Download

memory/2568-4-0x0000000004C10000-0x0000000004C20000-memory.dmp

Download

memory/2568-10-0x0000000004E10000-0x0000000004E1C000-memory.dmp

Download

memory/2568-7-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/2568-6-0x0000000004BE0000-0x0000000004BFA000-memory.dmp

Download

memory/2568-1-0x00000000000C0000-0x000000000018A000-memory.dmp

Download

memory/2568-5-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Download

memory/2568-11-0x00000000061B0000-0x0000000006246000-memory.dmp

Download

memory/2568-3-0x0000000004A20000-0x0000000004AB2000-memory.dmp

Download

memory/2568-17-0x00000000749A0000-0x0000000075150000-memory.dmp

Download

memory/5040-84-0x0000000005470000-0x0000000005480000-memory.dmp

Download

memory/5040-82-0x00000000749A0000-0x0000000075150000-memory.dmp

Download