quasar | hxxps://ufile[.]io/wkeh1k9i

Resubmissions

01/05/2024, 05:16

240501-fycyzagg9t 10

01/05/2024, 05:15

240501-fx27gaba52 1

Analysis

max time kernel
275s
max time network
270s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
01/05/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ufile.io/wkeh1k9i

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

127.0.0.1:4782

Mutex

6ba175b7-be3b-481b-bf72-0c6eba70670b

Attributes

encryption_key
54B051581559365794B4CE1FC54BF790B05F342A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001b00000002ac89-442.dat	family_quasar
behavioral1/memory/884-527-0x0000000000A30000-0x0000000000D54000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
884	Client-built.exe
780	Client.exe
4368	Client-built.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3876	schtasks.exe
1344	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1856190483-1022094809-400023910-1000\{1818F72D-DE6B-4381-9E33-EE5FB1D8CA24}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 564490.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\SubDir\Client.exe\:SmartScreen:$DATA	Client-built.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
4288	msedge.exe
4288	msedge.exe
3176	msedge.exe
3176	msedge.exe
1076	msedge.exe
1076	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
2632	msedge.exe
2632	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	Client-built.exe
Token: SeDebugPrivilege	780	Client.exe
Token: SeDebugPrivilege	4368	Client-built.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
780	Client.exe
996	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1920	4288	msedge.exe	80
PID 4288 wrote to memory of 1920	4288	msedge.exe	80
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 4584	4288	msedge.exe	81
PID 4288 wrote to memory of 1484	4288	msedge.exe	82
PID 4288 wrote to memory of 1484	4288	msedge.exe	82
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83
PID 4288 wrote to memory of 2940	4288	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ufile.io/wkeh1k9i
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81ad13cb8,0x7ff81ad13cc8,0x7ff81ad13cd8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7244 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7468 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3876
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:780
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,1389620528913959119,11032690180199083864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1704

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0354ef8afd53bc4c27ab99144970a9c9

SHA1
7105316ebb6a50dc71cc5402c64bba847a7c95ae

SHA256
acef151efdca7eef151e0cc9e45d5945737c4ab7cd8493e3dd9acb49d8df6020

SHA512
af6d8f1010ab8181c6cbe4c64a0d72c20ddfc56257cb862570c410546ddc52d2f1a67e58b93e7548573091b0e7173f230868c28bc6ed0abb8116f850f7122893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0f25425fcda7474bc74cf6b914ce2262

SHA1
541620b08eedb97ada0840960b2c59391ba9a530

SHA256
b170ac8e893bcbc87746d28c5068393019160b9f798db01d364812cac69f1cbe

SHA512
f4c7257d8729f6d6338872ca36ed128349944c9efe8989dee267230e5ebae8675a3fba3ac3038a88d5b70977b767eee0c2423481c526ade354fb335592d80b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e3222aa101f211abb283f223496e5730

SHA1
66c63ab5efc3492d756f8dfdde476611e3800bb3

SHA256
ec6f8c406094fa7ba520b629118b64259ee0f1a5a4d0a49e6568fa3c454f4bf1

SHA512
e97f8cbd62b3258fd2ddd57e7e6ce09287da3b1ecb3293af91f96bec9e47a2c7f7fd78c4b4216b58d9b6118349dacfc0944e25feb12f12222f4bb640dc563a45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2085423e07c67b34704f55c46d4c4670

SHA1
2f740243e1a13799862bb43ce86afcdfc14dbf48

SHA256
4dd27f7bd9b6dee116e85360d64513deb19269b6d2c9bf5877e3b74aa3ecd75a

SHA512
cb75cd4650524847525f558f82e4aadabb32f307d382d1c5bf74ca536cbf265f71833964ce8db9bb224b6d02278a583996751667f306ed531a812be3b73d92d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
061d2d795202521aa74659bc6e1c8e6e

SHA1
379e8fae32f7d826a1a139493486bbe1a5cd8e99

SHA256
64965f9ac119260f260e6f9b118c31ef713e09d9192c2746b7caf288bdc246c1

SHA512
b401ee6e0fb2753a3cf1e17b034ef2e2090197b4ef91865e9a0748598965b42395b9f991013c157a56369f518baa70e348e111d80fbd72b273ae4b36b590bad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ac87a852959fdfd3790c894303c3275

SHA1
e36f55c8e31de29a373fbb28437ca7ddd934f452

SHA256
2aac0e578a5bf736f2ec0e06f8176e8caaf2fe7a59e0907d36b9f682083b5558

SHA512
5a8c805db43f3b8413be8a8a6731473e5f9c5b6f8af50a4be3aa6de77d4e722c070963160d583eb016d4ecd1df51f49e554a02166436c2d2e93e2c45f83c898e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
808490c486144d7efc184e878e34c590

SHA1
dbf585de56f8352e2130533616ed2c0211c12a31

SHA256
1818bf6d508e83419264810fa36d4e676acb6f62837eb1e7083225bb4ed95692

SHA512
d0b053c1b19d1705f2c3ed0bcaa7133433f92adae1401181e7789965d664a6bce5d182530a2c225a4cd339c317fb986e6221746002ae6d7483d0622174fcf246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9794cc9d5a20e29cd476dd3d0470b64

SHA1
4bbc604d319ee5d01f203d03a99614b33229d429

SHA256
9dd49d6502f65d22dce7e6c5090036dd63cdeb5307a8729d041aa798fd7d008f

SHA512
cccb170fb4d506f1120ff327f68969a19a0464a81cbf769e38571426b548c90dc5924a9a67fad195b0d8a469f67319439ad61a10b5112890db614dcf42f26398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2069881ffcaed24a9e56b5236b0cd724

SHA1
eaaef45d950b1f00903d796664e14a5ce4c76166

SHA256
0613a3d242ab890380ee42f6b255eaa6df2007b4094985e0a8fd744cfdfc234d

SHA512
6a97a57c7899d2fcdcfc69a60f5e62db6d606064fbecd48f7842cd0f7ad3b197ddf37cfd513becf62e0b452e2b9b5f28d8b40b3deb2a6e96adc5aaaf5bea7d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
bbc42e17eb4be0d2b9af3b6a64e40779

SHA1
515f38ff2ed6ec177dd54775f30aa5f2b4b7d625

SHA256
0619453a9c104456f444dfd49d061243c1730fdb5a79dd26439125fb442f5c38

SHA512
ffc2108166eee2ce4bc6afa5859ca725fd90a0f6b52f1f43ebbc8a7a0fe18790e0c5fac61414ea93535d6a9a25875214238370cd45810bd6cb3f36a489a5c8b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f5e9.TMP

Filesize
48B

MD5
608f045fc10e068ec635feb559e0bf05

SHA1
43ed67476b0f61140619e349ebc967660babd01c

SHA256
61bee752adcca573c60f6dafa1d709fad21254312c57453dc14b6b5a74e17a99

SHA512
ce0b327aa4f100e7880c0ffb6a0db1cedd1ef4062128742e815cdd818dfc1c2db10d0fd9afa89a4525a3f993c5c0ddd75509e6baa212166696812cc708944f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dff3d31e1137ba8f204079931eaebb32

SHA1
b2f08c85945992db61cdfe9f9bab4ad719d8ea70

SHA256
60f1aabc2dd472fd6c8b178e804e36088de09e55ef4d3bccd6abe88abb3d1def

SHA512
5b9bfa5425915d5f3c78b3eeacd5eb2223986763e7817b859024ad90ef3df3a835e374fd3636603dc4b7e93865cdfb7519afdd53208ff5681e59be96e1fc7378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0a012b1f5109cf47b569bfac97e85814

SHA1
c33be7d59b2d084e8566211e31c176f72d868f3c

SHA256
fbfa193678b7f5d0a940c57a06c70e8beaabd3e7bd46685a7d0af51fc3d30646

SHA512
699238a9358d921b5733cfb6d1f0585a722fd2968ae88d8577c20b32a90d13fb38d78acae7264ade39a46ef9bf4e2926699ebc7cf6b229859f71d43090d73042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ef9004f91977b94e73031fef594c3ba5

SHA1
285559f0e6e54fd1b99f7da3aaa7cbd02b8ec588

SHA256
b46f3add0bb175923cd69e9bca30a417459d6e0381aa0b79e6ed67db472563cf

SHA512
3d98a05d7c86b6ea59a08fef5b07d0d92c78f72827d90ac506d9cc90fd776f8195774b975d1f49a6103b580e38b919a2b9e58f7bcc73f0efb1484a10329aaa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d031.TMP

Filesize
2KB

MD5
72e87382a2da3fcf9c20d65f24ca38e2

SHA1
b22f0702c8c5489e0018e89c2a260e7a384fc568

SHA256
77b44668041d876228cb71abd76e511559f7c0428e30407f186548e55fed0e2a

SHA512
604cce900d39bb2ce1e9058e293d41b4ea3434a0a99a4da090ca35310d445f7220ad547047303fa4cf314be9cc3497d8c49bd89efb11b1415a3385ea1b6c3a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e75d9cdc4dd67901be90e34d881eb2a4

SHA1
6c68339bd68bae854c30b85d682878dfc14a828a

SHA256
f2d7b8f07c816171f1cd197cb8d04eaa6cfb609410965fcf5944d43d17c87fb3

SHA512
1df101efb05be988a98ef75decd0fcceba27156ba4f68ce315a7da10320e06c4d034535e5856a0a934a4af4ff2f31f1a419e26e2abd07c5f628334c7f679ce0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5244a13c8fe33dae4735fba52e6a6d48

SHA1
5166358ec1ff93555a2de9b7b12ac45b243993d7

SHA256
3c724d6cc2f73c501594e031f05b5cbcadb3203218b93c57c6d767ea7e35136d

SHA512
5ca445e49a58d80c379fa74235231192eb6a5275b24d56df5bffc3fb51eb54b41743bdb61f385d2b7855088cb796a2a50510222d48e56e0c15c715c1b8c23763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83b7fcb8c5422154d72b0a03d54feb94

SHA1
98b2cdf07f849b157b8ed2bc4eede6dd3d409f90

SHA256
378c77e54de1e9cd2b3f7f3b840feb70fc21c52ea9226d77b25da0af8bd0088f

SHA512
95d2f7ab92632f075182787c4f1f7023733eff06ff06fe29590beff286e6346598255cfa2b077a8c9d3f656b1722f8beeced1199b79cd828f512477c261439ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
6519b69aeadb8f25058aed2681fbd97f

SHA1
f21546b140466c5d52d38b02e7dfe62b6765b40e

SHA256
45914858706e80a162abdfc7b47fa3c896f79f3a7b4b9e5ad4899b77dac7792b

SHA512
acc0dd275ca3789ef9682bfdb40f08ea3769589ed95e4c1fc8db16e4525012166950cef0cb25210137df8a40556187ed5e473f3b1ecaa3d2be1f991b5caa622b

Download Submit
C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 564490.crdownload

Filesize
3.1MB

MD5
4460b38dc9a85fbebccf97374cdf9a93

SHA1
269959009e20a0a0a705402435677437dde60871

SHA256
5b17f61d5d33a6284f6c4154dd19c60508c8c70954aa51ed201152a0f720fc86

SHA512
d50f9b4d2905aa524ffa19ab54f7ca5e528f3e0a73b7e555436f06739cfbdd664e0ad3c2b808739e62aedbf19685cb6367dfb8b28e8dcc840fc289d1444ad134

Download Submit
memory/780-539-0x000000001C050000-0x000000001C102000-memory.dmp

Filesize
712KB

Download
memory/780-538-0x000000001B6C0000-0x000000001B710000-memory.dmp

Filesize
320KB

Download
memory/884-527-0x0000000000A30000-0x0000000000D54000-memory.dmp

Filesize
3.1MB

Download