Analysis
-
max time kernel
116s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 18:47
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
quasar
1.4.1
Opera
192.168.2.115:1162
38ed98b5-964f-4a70-a34b-b5a280e2a008
-
encryption_key
7A857EF3A3EB39AF399F1F3800FB9F842DC83C9E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1
-
startup_key
MicrosoftUpdate
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Downloads\Unconfirmed 832763.crdownload family_quasar behavioral1/memory/4532-214-0x0000000000DD0000-0x00000000010F4000-memory.dmp family_quasar -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Zen9andCelex.exepid process 4532 Zen9andCelex.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 832763.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exetaskmgr.exepid process 4792 msedge.exe 4792 msedge.exe 1472 msedge.exe 1472 msedge.exe 2124 identity_helper.exe 2124 identity_helper.exe 2868 msedge.exe 2868 msedge.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Zen9andCelex.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4532 Zen9andCelex.exe Token: SeDebugPrivilege 5740 taskmgr.exe Token: SeSystemProfilePrivilege 5740 taskmgr.exe Token: SeCreateGlobalPrivilege 5740 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exeZen9andCelex.exetaskmgr.exepid process 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 4532 Zen9andCelex.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exeZen9andCelex.exetaskmgr.exepid process 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 4532 Zen9andCelex.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe 5740 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Zen9andCelex.exepid process 4532 Zen9andCelex.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1472 wrote to memory of 3816 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 3816 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 1808 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 4792 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 4792 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe PID 1472 wrote to memory of 684 1472 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/discord1ggWUFGKADF/Celex/blob/main/Zen9andCelex.exe1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a4f46f8,0x7fff5a4f4708,0x7fff5a4f47182⤵PID:3816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:532
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:3492
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:1504
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:2780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:2836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:1916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:1744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:3408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6356 /prefetch:82⤵PID:1496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,165243194671687563,10156514763309702071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Users\Admin\Downloads\Zen9andCelex.exe"C:\Users\Admin\Downloads\Zen9andCelex.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4532 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:5144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1588
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1680
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\271c61d8-4c9f-42f1-9b07-c84b67a4872e.tmpFilesize
1KB
MD5fbe8e7d099ca597652666697ccaf6667
SHA1fdf49eddbee73aa8533ec22c95173968e1d3ba12
SHA25663bb7c0723f21e282857b50498be89ce67ec7a31238397fa74cf41a07f09c243
SHA512a27a884ae1e72c6bec679a499e97ec0305d1c9c29591b1e14ae5d6502c68995be4642e427e2be608f597e3856986ead94a6d6b31918d3a04ac46c17bc201a059
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD57317f5ba8c0bbd4658ce3a7af4756c20
SHA13779243255bbeb5b9d142a9d4905496e8397ea7c
SHA256dc428cfe383263940008eece9d99c2476a0627b6855764bfe3ceae605ee0ff53
SHA5121ee3d2ac6a0fe338cc4b57643b49d5a700fbb000132d0595ea0b91a68332e38d4c49c6f915a0846d25bf5ea909e72c23f40089684834f5a23ccb70c88853dc4d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
579B
MD5a7d1701142cca705f833d70023ef4e1e
SHA11b76853132abfcddb4fefac42bf9df5d013c9815
SHA2566c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7
SHA512806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55722305bb5da80c9226939e17ff0c557
SHA14d09a7a629f770e31d4297b91f6dc40cc1e68cdc
SHA256a31e4f2dd27926651a9fcdec34f159a91e37c556982996cec5c14ba771a988cd
SHA51264306e39afbe2b9142eefd7d15946c28d6197882c696c7b36a7fa8ebf8e64656532d8ed056ffdcedd59505e72f6c65d6d3ce6fecfb6b4b91bef1f276e0ac813e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5a807230ec58b1e97ed383176dd0747ae
SHA13fc9525374205ae8588f59992bc0353aa0c2bc8b
SHA2562a96bc4862ae972d1b838e64e144a940a4b4e6fd38ebc65bf6cda1d239a3592b
SHA512f1672bfd304d4a9d20d827f11b5dff7dde390d20cf4b125f45e8331271fcfe53557f29462a1b5758e2768d7d5eb0403c932d85e4318ee090a967097ad243b52b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5bf86f1405159428f2a958f4176f7385d
SHA1ee4ab1425bcaf654506a98ca3abb18b8a58ee099
SHA256629df5f11e56519b783b106a465a9adfe6cfccd2b043ab20c38597d65a23251d
SHA512718e5dfbe5b6262cd9054b1c74391a678b1b3e366c5673df330da2e03f25d5e38fede3428d87b333fc69ff930b799cf9122b32b51602eaf2b5f36c558d43ded8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57aae6.TMPFilesize
874B
MD54fc3787a03f869018af956f2bd0446dd
SHA186ec1ec731548e23b869687515190dcd4c0be7ed
SHA256a7b534013f05b40cf0d1e04f80ab18d030442c4565bb2dc2ef0646687d80b819
SHA51237dacd190cf9d71e38687a3914c65437928e816b9f91dc100a7b6595c8ab9456423f1111a41c99fee87bda86a726346a0c46a85541feafdbc8add1bb0694de0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5e06cd78487b24a8e05528a4332aa4b52
SHA184380286dd6d68f50ef2858726fb4b8a45dae35d
SHA256f9377abe21d89e2bec44239c9780b37ebf504e199324b6869a19118812d66d33
SHA5121f5da31d13e5e11c9bcf2c8e06e2b3121081af89c1b059aae0d1be5a58ded51a2742584c1c59957f526b098bc77803945bb39437ee7e661029b3b94cee692003
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD518a564546edd0478f6e1ff6928b55a0e
SHA13ef0c4ceac8c3979a087d5a9c16048aeeaca384b
SHA2566637516fe0e6b3c051f86c367d19971ccc4a0b73901fb3cc19010aa2e510c69b
SHA5127c1a1fb6c8676b34082a0988fc268d6d5b5f0292d037fdea432574c747398558fd9209edcd137b1e06ff789094b26154f437ae245562803df6ec1692f9ced3e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5f5743f5d36cc0869d76d3765c09e8736
SHA1ef41d800cabf8b4d53f356f692f4e42863614944
SHA2560e8b3bfb1e486bfae665f8c7311d714330591e36a77c51bc26514fff914f2e4f
SHA51282c42e77532147ec75156736810b5a25f08b9c719e35e96a9a6e04b565f1ec46ad9e08fdf9e59cddb5f0281f3325fa0212ce67b8258da9bb9c6aae39549cea0e
-
C:\Users\Admin\Downloads\Unconfirmed 832763.crdownloadFilesize
3.1MB
MD596d698f131fe740efa699cd0c0fc4762
SHA18605eb6b29c20a7fc6207fa24ee51e364628c2f9
SHA2567d05a8be6d0d83691c91b84edf7ad9b3e2cdc376857925ebea91fd917520cc1a
SHA5126a7f69056a6f83f57757846e2586d23ccba08e1551fce3f56cf96a0ed71161f0f26a0bc792b9811224c3bfdd483a124dee008db13b8fb1105906552b8efd9d17
-
\??\pipe\LOCAL\crashpad_1472_BIFUDVRPBVZEVGWEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4532-216-0x000000001CA10000-0x000000001CAC2000-memory.dmpFilesize
712KB
-
memory/4532-217-0x000000001D100000-0x000000001D628000-memory.dmpFilesize
5.2MB
-
memory/4532-214-0x0000000000DD0000-0x00000000010F4000-memory.dmpFilesize
3.1MB
-
memory/4532-215-0x000000001C900000-0x000000001C950000-memory.dmpFilesize
320KB
-
memory/5740-279-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-275-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-280-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-270-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-278-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-277-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-276-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-274-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-269-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB
-
memory/5740-268-0x000001A73EAD0000-0x000001A73EAD1000-memory.dmpFilesize
4KB