quasar | 05a36bafce14b5f23f9a1a92d97e1a795eb2f79ee76c57c81a5dcc9b6e709467

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 3.1MB
Sample240503-3dk56sbd68
SHA256 05a36bafce14b5f23f9a1a92d97e1a795eb2f79ee76c57c81a5dcc9b6e709467
MD5 23659f75083c817326e723f93dc82605
SHA1 d85f9e6b63b051c82708a71f96892aa26e89f0a3
SHA512 e96420c18c2366e3d46feea23186775d9de37d6b0b0770ec03b51fb86a8abf2b931757069b6030880dd7bf905a207386b9ba996fd1fe5c5b5a792149e0f8c128
SSDEEP 49152:fv+lL26AaNeWgPhlmVqvMQ7XSKnYRJ6VbR3LoGdqjTHHB72eh2NT:fvuL26AaNeWgPhlmVqkQ7XSKnYRJ6n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

98.239.92.121:4782
192.168.1.12:4782

Mutex

15238486-bf41-43e5-9f35-44a0f5145609

Attributes

encryption_key
43F524566962F46500ADB67A91EE294B50862AB9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral2/memory/1940-1-0x0000000000B60000-0x0000000000E84000-memory.dmp	family_quasar
behavioral2/files/0x00070000000233ea-6.dat	family_quasar
behavioral2/files/0x0008000000023381-84.dat	family_quasar
behavioral2/memory/1480-105-0x0000000000860000-0x0000000000B84000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4928	Client.exe
1480	p7fa4060.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3116	schtasks.exe
3536	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133592523286474661"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	chrome.exe
1456	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4928	Client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	test.exe
Token: SeDebugPrivilege	4928	Client.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeDebugPrivilege	1480	p7fa4060.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4928	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3116	1940	test.exe	86
PID 1940 wrote to memory of 3116	1940	test.exe	86
PID 1940 wrote to memory of 4928	1940	test.exe	88
PID 1940 wrote to memory of 4928	1940	test.exe	88
PID 4928 wrote to memory of 3536	4928	Client.exe	89
PID 4928 wrote to memory of 3536	4928	Client.exe	89
PID 1456 wrote to memory of 2840	1456	chrome.exe	104
PID 1456 wrote to memory of 2840	1456	chrome.exe	104
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 428	1456	chrome.exe	105
PID 1456 wrote to memory of 2132	1456	chrome.exe	106
PID 1456 wrote to memory of 2132	1456	chrome.exe	106
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107
PID 1456 wrote to memory of 2436	1456	chrome.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3116
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff83960ab58,0x7ff83960ab68,0x7ff83960ab78
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:2
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3152 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4092 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4084 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4708 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4992 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5140 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5180 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4768 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5280 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:1076
- C:\Users\Admin\Downloads\p7fa4060.exe
  "C:\Users\Admin\Downloads\p7fa4060.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5156 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5588 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3132 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4364 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4212 --field-trial-handle=1848,i,3387760104000582095,7457100260626954475,131072 /prefetch:8
  2⤵
  PID:1472

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6536bf49144efa0ea5e0d6f3fdb6b17f50780bae8c467c5c01e4e2a7d33a15bb
MD5 3994862c3bc1edeafe2dc6317e8c3fab
SHA1 79e7ca7786fb2ba52d2057df88bb16760f6e67ca
SHA512 5c03534312504d6ce2ffdb9edfa57a6bd4e3733877a0c277959f7a685fd8614b9e32275ef3e949d35e5ff6b150fb78dd6eaf1c9d8890e10020b73c30cd31e060
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 4c3cd2430ac15705e3006b07c99f1a28ad3b25eb88a0c9554913592dafcbb948
MD5 6b02190b194d492f93b99e3c93289f18
SHA1 924fea590ac4878e603a457c9efe05dc0ef799ee
SHA512 33f7be326adb71b31f60c21a1466edd1a0aed702cc3e372e76e0a81fb77dbcf931c68ba4c3bc4e54bc11448bf4b4fa09a64e25ed1f4968935cf8aafcc2637797
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 5856719ea8ab113ac4dc3e8b385bacb9ef25b69368b419dcbc43cb462a629aef
MD5 4981ba10fd437ebe3dddb0a3ec028b6c
SHA1 893706da101ae083bf4f8ebf5518b0d5ca6762b0
SHA512 0939bd1ac93e58d456091606662816676a34f8166a1f20d87daf489fb07dd6a7aae07e1bce4b2c625238c01c3cac9d985b88fe0f0e0cb1c5c356979b0d3f2792
SSDEEP 96:/flVAsNXdGiKIkJ6V4g8iZRy7Dx+6MSmuej51QO6wZCqzxk2MEVhYtjEsXt0/cgS:/7vNNbaJs4g8syh+FT5pSP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 1106893ea3fe96c24bfda2060228a5153b1c2aa5b9c0201f60211b465b0ce644
MD5 5f9111d1003398316a067f4b5fa83c17
SHA1 6352e3be3d5cb6ce8570ba209f05747ca8c8ded6
SHA512 e743c937492c44f43c1a0acfe82bbc1fd67d88dd56884e2b801498a087d88921d25293d4945f3e037e49b79a2b9d05b15ae8df083130ce80b1d0a52e2eb06103
SSDEEP 96:/flVAFNXdGiKIkJ6V4g8iZRy7Dx+6MSmueUIOJZCqzxk2MEVhYtjEsXt0/cgVup:/7iNNbaJs4g8syh+FkNSP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 6ad99db936168434a6fafa06fe3a2f18ccf3f47a581a1ef1c69d81408fe727f1
MD5 39606e912f8f988781672bc8d872dee9
SHA1 1648062aadbe02239fca69ab3e9501be6bd22c5c
SHA512 427a811f3fed5babb3b2dded1f82a7551044b5286215c2472b95fc5af6cebdba9a438b7353b97c96ec298bb9c55b21efd8cb612c9ca39c9bd23b715b53541be8
SSDEEP 96:/flVAsNXdGiKIkJ6V4g8iZRy7Dx+6MSmueUIOJZCqzxk2MEVhYtjEsXt0/cgVup:/7vNNbaJs4g8syh+FkNSP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 4a43b643210a69d5dc2fe4cf90645b0f9a1ff808dbed9bfa66f64dca94e0a73d
MD5 ad0c2b37a0c0f5d504a1c687b43e39a2
SHA1 8eefb65d79b4cc6568c873eb63179a698e111aa5
SHA512 38ad71f01b1bd871d329cd9da0f820b56cf2530852da20b6a5f6b489a78f03a57c046e4d18795a4c0d845414e6c242e9765a42fedd25504bf09b182d1d9407d6
SSDEEP 384:NZbi7pLhLcEvm4Xsk1kXqKf/pUZNCgVLH2Hf91QrU4ZHGuXe:Nti7pLhLZ+Csk1kXqKf/pUZNCgVLH2HJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2ebad03-2e6b-4020-9add-837c741dd1e1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c2ebad03-2e6b-4020-9add-837c741dd1e1.tmp
Size 255KB
SHA256 4ac03e52a90d8a316d8bebfc03f3e7470f50eadb2a1a47725f550358ae3744d9
MD5 c8e456b1adab7300b57821320bfd8862
SHA1 9151c963de2965f26aa94997c550bcf081d94a77
SHA512 6429f1d89a98266fc29baecef62a5681647518d67fa83d1230a1aac9145f2c92f911e9a1b3b02ce0b0b7d52c0f2c368148eea2ebbf817f271af6225c6b84a501
SSDEEP 6144:AAcs4/+O1HHrvvswvF9te35nfC5mgMatph:AAb4/RV3PvFu35tgMyph
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 05a36bafce14b5f23f9a1a92d97e1a795eb2f79ee76c57c81a5dcc9b6e709467
MD5 23659f75083c817326e723f93dc82605
SHA1 d85f9e6b63b051c82708a71f96892aa26e89f0a3
SHA512 e96420c18c2366e3d46feea23186775d9de37d6b0b0770ec03b51fb86a8abf2b931757069b6030880dd7bf905a207386b9ba996fd1fe5c5b5a792149e0f8c128
SSDEEP 49152:fv+lL26AaNeWgPhlmVqvMQ7XSKnYRJ6VbR3LoGdqjTHHB72eh2NT:fvuL26AaNeWgPhlmVqkQ7XSKnYRJ6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 364645.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 364645.crdownload
Size 4KB
SHA256 039c2a96bb34ddb303ca12b0a815330e3da7e474a202bf352fbb8cabd80e70e5
MD5 ffd18d12b1d72fdc93b30523e9db1b69
SHA1 024d8e815146053fbb27010c0a26b2d82e470126
SHA512 78aa5f6b3b6a1a1ca499a151982fbaed05fe37e2bcc2688adb958677c0c6c274100dfd7778a5e25a8d96d5ebae7df1ed195c63059b1f870284c91b4854e41311
SSDEEP 96:0ACXIL8+fGr8OP9VtxLUB5UZZVbl7ZOxMGETgSI1CuFpr/JCwN0TmrOcfkSo:0dILC5VR70MTTMFn/JCwN06acfs
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7fa4060.exe.crdownload

Path C:\Users\Admin\Downloads\p7fa4060.exe.crdownload
Size 3.1MB
SHA256 b939c5f9d377861a4d2edf3b2366b7996b359d5f3a1fb6479c353cd9f689f47f
MD5 e7aed9a491433614e6f8fc5a9398e77c
SHA1 586edfc5c20a76ed14e2f6454b4b608d1688006e
SHA512 2c2cbf9d4dc0336e346dd87600a92c63a967e5f2d94d9a1127c4f725a75d77d7553aa23c3788d0eb747a5e1bcbd719909d856a04490875ab03308b386ec38e04
SSDEEP 49152:PvyI22SsaNYfdPBldt698dBcjHPSRJ6XbR3LoGdMTHHB72eh2NT:Pvf22SsaNYfdPBldt6+dBcjHPSRJ6p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-105-0x0000000000860000-0x0000000000B84000-memory.dmp

Download

memory/1940-0-0x00007FF83E493000-0x00007FF83E495000-memory.dmp

Download

memory/1940-9-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp

Download

memory/1940-2-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp

Download

memory/1940-1-0x0000000000B60000-0x0000000000E84000-memory.dmp

Download

memory/4928-46-0x000000001D020000-0x000000001D548000-memory.dmp

Download

memory/4928-15-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp

Download

memory/4928-14-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp

Download

memory/4928-13-0x000000001C6F0000-0x000000001C7A2000-memory.dmp

Download

memory/4928-12-0x0000000003490000-0x00000000034E0000-memory.dmp

Download

memory/4928-11-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp

Download

memory/4928-10-0x00007FF83E490000-0x00007FF83EF51000-memory.dmp

Download