quasar | 0b61005e0c958ff41b0adced2ebf35b7a35593f1afd324b5c6e5d8d6221e2c06

Analysis

max time kernel
89s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240508-yemceaca6y
SHA256 0b61005e0c958ff41b0adced2ebf35b7a35593f1afd324b5c6e5d8d6221e2c06
MD5 ad3a32913e10a3b7e181b49f262e4629
SHA1 1d64b0c3f44e7252646003c5cb4ece4b9035c780
SHA512 05a4007a0a7047b6f564a783a6369dfbaf76769fcaa5919583f56d37d70e03cca944fff8596a616865527224421a4af3d038b296aed82a0690ae7f0b11e333a0
SSDEEP 49152:fvzlL26AaNeWgPhlmVqvMQ7XSKlPI/TBx2doGdEs2THHB72eh2NT:fvpL26AaNeWgPhlmVqkQ7XSKm/4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.38:4782

Mutex

b664c8e7-d02c-4ac6-bf2d-b7ace8e02be0

Attributes

encryption_key
4DEEA92004D89D0EA15995F87A9D3C8EBF339128
install_name
bf7d283291cd02894s.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4092-1-0x0000000000CD0000-0x0000000000FF4000-memory.dmp	family_quasar
behavioral2/files/0x00080000000235e6-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2552	bf7d283291cd02894s.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1616	schtasks.exe
3552	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	bf7d283291cd02894s.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	Client-built.exe
Token: SeDebugPrivilege	2552	bf7d283291cd02894s.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	bf7d283291cd02894s.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 1616	4092	Client-built.exe	90
PID 4092 wrote to memory of 1616	4092	Client-built.exe	90
PID 4092 wrote to memory of 2552	4092	Client-built.exe	92
PID 4092 wrote to memory of 2552	4092	Client-built.exe	92
PID 2552 wrote to memory of 3552	2552	bf7d283291cd02894s.exe	93
PID 2552 wrote to memory of 3552	2552	bf7d283291cd02894s.exe	93
PID 4820 wrote to memory of 4640	4820	chrome.exe	99
PID 4820 wrote to memory of 4640	4820	chrome.exe	99
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 1248	4820	chrome.exe	100
PID 4820 wrote to memory of 3580	4820	chrome.exe	101
PID 4820 wrote to memory of 3580	4820	chrome.exe	101
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102
PID 4820 wrote to memory of 2656	4820	chrome.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bf7d283291cd02894s.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1616
- C:\Users\Admin\AppData\Roaming\SubDir\bf7d283291cd02894s.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\bf7d283291cd02894s.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bf7d283291cd02894s.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4320,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:3340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff83d7eab58,0x7ff83d7eab68,0x7ff83d7eab78
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:1
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4316 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4628 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:8
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2632 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3640 --field-trial-handle=1824,i,14046811719877515411,956095314859010277,131072 /prefetch:1
  2⤵
  PID:3776

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 410116e832de288603f3e0415ddc37f061a83f780d3e293fef55c8173ccdd881
MD5 5f3668fcb55f261dbcfb1ed6431fcbf1
SHA1 22fe68e31f9c7dd968021e376bb930fd1d689f21
SHA512 f257f20af10e841fcf20abf4005409c31ff74fc6b2c94341557c2701118d0aae22629c2f56d6cb88b3798be92df7d651e7f025492daf73a8472f3da8bce5cacf
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 352B
SHA256 bee57728170ca145c2ae0e0a7b9854ca27debc9f71f12dee5598850516001313
MD5 48dd598c64f057c86a7043ecccce7e23
SHA1 5bef66d63cdda5ef817775920163c92f091ac4dd
SHA512 be9179299cc113206037db9e8699c49efbe2d08ae579f057a6789431c8ae6896ad52737c1b44814fd512e6113375c437573cd08fdce363545f0d23dae9759507
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 352B
SHA256 c34ca5b8225579d59db7962a5c89993efe161ccc0b4b3dc1ba6b4c3251733d92
MD5 c894d18820af48b10629f727abf3c5b7
SHA1 cd97a6ee52e9489b43564c1986655c0db66fd008
SHA512 3576bab441bdff8c85d8baafbdf878a110fe1d7b8d49ba8a718c559aceffbf08aa063b9d57a5dbd4e47917c6bfef7c94e12da50cc46cb7952cc632020248a632
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 1f372c2853d0ae3b0194f9ba011517cf0e92a6d1a88e38e59fbda1bc2dbb2f1c
MD5 d491a387c314c389440f5dd6d8b8cf09
SHA1 0d7c4676ac2e93e64db5526ba30dbcb15e008c81
SHA512 cfcdc195f5ff1f10357778b3483b00a94a32108dc02e9818f46bf3fb3b169b91b385b3b723ac89bca0778091a5c44d26f311b7acc4e1184db919ed37e09a0006
SSDEEP 96:8BVTHpXnmMfKIkJwuOEf8iZRy7Dx+6MSmueBIOs+K2MEVhYtjEsXt0/cgVup:8HzpW+aJLf8syh+FRaP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 21eb392dd538f692f9fef5fcddb7eacbab94b3d657640f3a7ec0bfc878efc805
MD5 1db404fa2ff7383d7a8f619f384b05da
SHA1 f938cedb031fd79194931528bbbb34934d413af4
SHA512 e81a5c9ee12ddc4dda291fca6bf28cb5afc84e175a5ea2b3e71cb963db5223ce439ccd0c18f7e3f9201ae74855c1c0dfffcdc5579f7db8378f4703c38ac429f4
SSDEEP 192:8bc2kJHzpW+aJLf8Hyh+FWIhP5tjEsXtScR:8bcHz8Huyq9PtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 8312c8c5d3920ac12ff975c23fcd944e7896c8ac56e4911a067e64007095c043
MD5 4c25a42da39b9e6e53d6d532a729b507
SHA1 614a20a707dd6e8ddb0435fa3ab1e9325f64eaee
SHA512 abf6bf719ee71487f380cc4afad07a97ad2d4d18a60019af1aaf7bb8869b88c23775a325cfff792764f7475a1b5ec8e949c81324e4da5fca503b0140b14a16ea
SSDEEP 6144:05kxp07KhCRtw+grI1Qo5yzkpeXjnJFzXsW6:05k07SCLgEjCkpeXtFbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 255KB
SHA256 eefa9d561d3be3ca1c991e49006e5ca499bd49b0bc1e0d40ca64b34d6765337c
MD5 a0df2c095930b8823bac2d64a2494d33
SHA1 dbdb7b6f2103e670285f23ca5bee0c185078fb4d
SHA512 4530d9a511a15aebfe072ff355af607179825866c334851b975a6cea3bf933cd1ac0417532df869efefc9c4a112fa539f2ecaf1a01e4481fed8a4d6efd6639c9
SSDEEP 6144:w5kxp07KhCRtw+grI1Qo5yzkpeXjnJFzXsW6:w5k07SCLgEjCkpeXtFbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bf7d283291cd02894s.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\bf7d283291cd02894s.exe
Size 3.1MB
SHA256 0b61005e0c958ff41b0adced2ebf35b7a35593f1afd324b5c6e5d8d6221e2c06
MD5 ad3a32913e10a3b7e181b49f262e4629
SHA1 1d64b0c3f44e7252646003c5cb4ece4b9035c780
SHA512 05a4007a0a7047b6f564a783a6369dfbaf76769fcaa5919583f56d37d70e03cca944fff8596a616865527224421a4af3d038b296aed82a0690ae7f0b11e333a0
SSDEEP 49152:fvzlL26AaNeWgPhlmVqvMQ7XSKlPI/TBx2doGdEs2THHB72eh2NT:fvpL26AaNeWgPhlmVqkQ7XSKm/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2552-13-0x000000001C490000-0x000000001C542000-memory.dmp

Download

memory/2552-29-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/2552-39-0x000000001CDC0000-0x000000001D2E8000-memory.dmp

Download

memory/2552-12-0x0000000003270000-0x00000000032C0000-memory.dmp

Download

memory/2552-11-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/2552-10-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/4092-9-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/4092-0-0x00007FF842863000-0x00007FF842865000-memory.dmp

Download

memory/4092-2-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/4092-1-0x0000000000CD0000-0x0000000000FF4000-memory.dmp

Download