Analysis
-
max time kernel
1799s -
max time network
1806s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
28-05-2024 21:06
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240426-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
fd874e0d6811bcbd5feb812040853642
-
SHA1
7213c686b0e8cbb6527077eaeb3291791a8f06ba
-
SHA256
b2a5bbacabfa8f6cd6c24f87a5825a8231cce32086d369be612c6b7bdf658dad
-
SHA512
3c8265e9d981b0d5ebbd1157b79afb3b31f57f6083f2c5ce6d4658718b5d79faf4358936af76aa4a4e1e94f7803ef6c77e07e782333d9d7003d42ea1de2ffa34
-
SSDEEP
49152:bvxI22SsaNYfdPBldt698dBcjHLYqQJmzaloGdbhTHHB72eh2NT:bvi22SsaNYfdPBldt6+dBcjHkqQ3
Malware Config
Extracted
quasar
1.4.1
SeroXen
operations-wagner.gl.at.ply.gg:50199
164b6496-cf32-4fdd-b70d-de29665c8286
-
encryption_key
A88D7FED7F655EBDC4F99C21BAE5EC62300AADC7
-
install_name
$sxr-insta.exe
-
log_directory
$sxr-logs
-
reconnect_delay
1000
-
startup_key
$sxr-mstha
-
subdirectory
$sxr-start
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4160-1-0x00000000008B0000-0x0000000000BD4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe family_quasar -
Executes dropped EXE 2 IoCs
Processes:
$sxr-insta.exe$sxr-insta.exepid process 1620 $sxr-insta.exe 3228 $sxr-insta.exe -
Drops file in Windows directory 3 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\2717123927\1590785016.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4864 schtasks.exe 4284 schtasks.exe 4688 schtasks.exe 2676 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings firefox.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
taskmgr.exepid process 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
Client-built.exe$sxr-insta.exefirefox.exeClient-built.exe$sxr-insta.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4160 Client-built.exe Token: SeDebugPrivilege 1620 $sxr-insta.exe Token: SeDebugPrivilege 4352 firefox.exe Token: SeDebugPrivilege 4352 firefox.exe Token: SeDebugPrivilege 2588 Client-built.exe Token: SeDebugPrivilege 3228 $sxr-insta.exe Token: SeDebugPrivilege 4352 firefox.exe Token: SeDebugPrivilege 4352 firefox.exe Token: SeDebugPrivilege 4352 firefox.exe Token: SeDebugPrivilege 4824 taskmgr.exe Token: SeSystemProfilePrivilege 4824 taskmgr.exe Token: SeCreateGlobalPrivilege 4824 taskmgr.exe Token: 33 4824 taskmgr.exe Token: SeIncBasePriorityPrivilege 4824 taskmgr.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
Processes:
firefox.exetaskmgr.exepid process 4352 firefox.exe 4352 firefox.exe 4352 firefox.exe 4352 firefox.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
Processes:
firefox.exetaskmgr.exepid process 4352 firefox.exe 4352 firefox.exe 4352 firefox.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe 4824 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
$sxr-insta.exefirefox.exe$sxr-insta.exepid process 1620 $sxr-insta.exe 4352 firefox.exe 3228 $sxr-insta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Client-built.exe$sxr-insta.exefirefox.exefirefox.exedescription pid process target process PID 4160 wrote to memory of 4864 4160 Client-built.exe schtasks.exe PID 4160 wrote to memory of 4864 4160 Client-built.exe schtasks.exe PID 4160 wrote to memory of 1620 4160 Client-built.exe $sxr-insta.exe PID 4160 wrote to memory of 1620 4160 Client-built.exe $sxr-insta.exe PID 1620 wrote to memory of 4284 1620 $sxr-insta.exe schtasks.exe PID 1620 wrote to memory of 4284 1620 $sxr-insta.exe schtasks.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4848 wrote to memory of 4352 4848 firefox.exe firefox.exe PID 4352 wrote to memory of 2304 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2304 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe PID 4352 wrote to memory of 2420 4352 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "$sxr-mstha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe"C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "$sxr-mstha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "$sxr-mstha" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CgzMrTSnVQRP.bat" "3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.0.1103360498\639028104" -parentBuildID 20221007134813 -prefsHandle 1728 -prefMapHandle 1716 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c95e1604-b40b-4520-9ead-4b905c166abd} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 1808 13c3c6d9a58 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.1.159005698\1724290675" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94d87e90-5755-48d5-8750-e8f90f3a8f6d} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 2164 13c3126fe58 socket3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.2.1421802989\1545706809" -childID 1 -isForBrowser -prefsHandle 2796 -prefMapHandle 2960 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a26862f9-7aed-4e0c-ab28-ab2c492265b1} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 2936 13c4039be58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.3.1675247287\1400340357" -childID 2 -isForBrowser -prefsHandle 3512 -prefMapHandle 3508 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c0a2503-f692-4a62-8a83-1fe1b6c67340} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 3524 13c31262558 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.4.406623235\1568921450" -childID 3 -isForBrowser -prefsHandle 4128 -prefMapHandle 4124 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b050b77-257b-4321-baa9-9c1f18303525} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 4140 13c415e3958 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.5.1463670531\1038112726" -childID 4 -isForBrowser -prefsHandle 4780 -prefMapHandle 4764 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c534e03-e71b-4e52-a722-58dd486264bc} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 4796 13c404fa458 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.6.861429777\1283476299" -childID 5 -isForBrowser -prefsHandle 4676 -prefMapHandle 4756 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afbae485-cfe1-4547-92b2-1cf6de7c0221} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 2640 13c4282b658 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4352.7.78232840\227443290" -childID 6 -isForBrowser -prefsHandle 5064 -prefMapHandle 5068 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7953a9c-25d1-46a0-8b5b-18da29b906b9} 4352 "\\.\pipe\gecko-crash-server-pipe.4352" 5156 13c4282a758 tab3⤵
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "$sxr-mstha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe"C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "$sxr-mstha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$sxr-insta.exe.logFilesize
2KB
MD571fc2b19e7adb85782c0b0ed44f7a807
SHA1dbecfb69a62ca0a5ddc35de8c831ad06ad08ce87
SHA256b5f0ce93c91f69185cfb6881a7cf9874d1293290a71e920c073dac459fb82dc5
SHA5127ca2f01b9102eca636c95bca31c95e2afa27f8d9db1518e2663511f790e1ced0eef407a45db2322e10a327b98ac1a59b3491680ebe697dd18b63f832f0c25c80
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.logFilesize
1KB
MD5d63ff49d7c92016feb39812e4db10419
SHA12307d5e35ca9864ffefc93acf8573ea995ba189b
SHA256375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
SHA51200f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\41eh5pdr.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649Filesize
13KB
MD5c781f6b1749a658bcbf369ce7a445ac4
SHA19bd8dd42d0655259ab8e9302e89414062cd38994
SHA2564b4dd924387ca7c9972c219af4f2043981f1d521e6f51e3647f50991c17a8a35
SHA512b7fd28ed64146fcd3c95c6075e766008e29b88e2f748b41fee211d02577b608028af699e8d7b1e30a991ada92b6a53ee60a2bff4468f71bbe8da595240deafeb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\41eh5pdr.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftlFilesize
7KB
MD5c460716b62456449360b23cf5663f275
SHA106573a83d88286153066bae7062cc9300e567d92
SHA2560ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
SHA512476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
-
C:\Users\Admin\AppData\Local\Temp\CgzMrTSnVQRP.batFilesize
219B
MD55101381a6dfdbabbfe113a45b6ec3779
SHA18d8ae590170debe6f8d572cdac8a3bbba4cb01bd
SHA2568b58b855f27a47abed90bd44b19e4fc0e1b89bb9fc51c9cd29f2bda930356902
SHA512f7ebfc380ce725cfe5b0e7b13c2639384b58486f9f384e42339ae1654045484d6cb2b216d5b4271e25c1d18a20b92442c7a2d085db5327cc13e85b3a5b724818
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\$sxr-start\$sxr-insta.exeFilesize
3.1MB
MD5fd874e0d6811bcbd5feb812040853642
SHA17213c686b0e8cbb6527077eaeb3291791a8f06ba
SHA256b2a5bbacabfa8f6cd6c24f87a5825a8231cce32086d369be612c6b7bdf658dad
SHA5123c8265e9d981b0d5ebbd1157b79afb3b31f57f6083f2c5ce6d4658718b5d79faf4358936af76aa4a4e1e94f7803ef6c77e07e782333d9d7003d42ea1de2ffa34
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\db\data.safe.binFilesize
2KB
MD5f37b9609cb13b7c92633a65b04f100a0
SHA1ae87d4a60464b7f31c50138efeb2d177103b4551
SHA2560cd975805e6b7d4d2761d54ee8a141aa7a5fd61d926e28cde931348bc18f693a
SHA5124cf8f765410b0c3e1698ea279daac82bcdf534ef357fefa2e524fc3ab9e294e6346e1964820ffb99f4ea26a43fd458974ed815b357ad3ec87760c32163ead7a3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\12145c3c-ccc6-44ea-bb45-8b7b3a2b6c37Filesize
10KB
MD5e11f62cc27360bb12c7e368c433641e7
SHA122c434c79f9412491d848c1b02f073905cea04a2
SHA2563eba3ef1cf01ae761be607e110514c5e5bbcd01ce135c9ee60c47ead38916832
SHA512438a37c7de62ed58efebc4fde4062c99ec4a378b2a3c9cd41d74bb711582d8c1b9724ae04cc27f0539ccd0b1ad9ac914802774362f6c595ec0313a9c9faf5880
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\datareporting\glean\pending_pings\75623c09-e7dc-4b77-9d3f-bb03a25fe062Filesize
746B
MD5874bce7a58d1221dd5d3fd16a04999d1
SHA1f270feebf65f1f0334bea690f83fa87e0df5a18d
SHA256791c97070f72a9d328968d3dcfcca10218315b26a520945d981da81d0677ea50
SHA512d8d3b1c7572a1ab0ec93490fd237efde9997f60edb24f958f5b2ed3ab650131aa057e067bdbaeec188f67289a4ee66d9d6a1eba5143c69b0890b634657e39506
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.jsFilesize
6KB
MD57bf947e15d268f2fc6b4cafc68db8c16
SHA192cf3fe718f3532c6a9e183049d437dc601b8233
SHA256018696dfdf561c5d40b18f66c089ff4230d3dc521c43e863946ee7cee0d9ba63
SHA512c2c0b66359a3ba70c59478122381737f2e9148b4d5af992086abcd13c7f404fe64bc2f44ba41911b1341ca5f414e2ce01fec31405e2b627f5f996cb2cc7f67b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs-1.jsFilesize
8KB
MD52ace2c7cf1feaed21873f4bfbb3eddb4
SHA106f3cc8e0eb30a7249913f2283f67ffc4bad3d31
SHA256ce6c8b8340c831bad5931bdba3e69c677139d7e34d1a28b1682122f133d026be
SHA512c7af24ab98c8e2d18d8cf135c5fb1a030fede55de42f97f82bf5c3447e54cf253778f99f94e6c78ba21e626472673967d7c01059d189bed15b1872c3ab858838
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionCheckpoints.json.tmpFilesize
288B
MD5648ea624280e409ac3a7f120b5e9000e
SHA1168bd9dd85eb0603e0db6bef23a0df64f916bf83
SHA256ea208bf36fe4e150165db9ff5972004c6f468114058d6dbe5d0350f85e8fc08a
SHA51249520e85cd86cdb0b9fcefecaabc99ba3915ed5ce0b622ffe752de94df6d1fbf3f2fbae13ee18397b32477aadfb23280e42be6f92ec1c74feb4f246c60eb7e32
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD508e5bf55d10d86edba4492c761389307
SHA1f5d83e89b0f802511480a26e7df2a3b8809c1a5a
SHA2569e7cece6862890cf2195290a347cabf87d5839e2d7ea11f53a6401ffd825064b
SHA5122bc5eef28a27fcea6c28e74158734797bf68ab58ab323b3e12dab4a3bda4b810559f597706c77f8d57391f3cbce24b8caae6ccf1cc72dcb682bafaa457c4932c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\sessionstore.jsonlz4Filesize
951B
MD55ec5985ef9667e20b1ff2362ca68c377
SHA1d08fc7399bf8f5a32ba607da94d9ed87017d46d9
SHA2562a773ad16531f4b03da97c3b0c4f4cf7ab40263a1619f15b303f3a3490d29107
SHA5124e062a3affe0d76155d0eaa23c6eb19ef6412a605434d46a7616520d4a8edf2d3791b73dbbd31af5c690f17352db29a80996a944256e886df87ef35c4ec7d3a5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
7.9MB
MD564c5d7a026e83164797ac57b63a24a33
SHA14e4a49f9f87a3b078a4f2a394b05ee4dad48bd48
SHA2560f5205af4f06e40ac662f5304d4217930f92ecb1b667a1ff7dd667853dbdbe5e
SHA5125d7b25c394e91fa9ca5674a2404132637398464edd87793005dc1dad83ecec6bfc6ab0acbcb7c22386fc41309d62d514c4b8286e32a8bdd37a26aa41e92ea512
-
memory/1620-17-0x000000001C640000-0x000000001C67E000-memory.dmpFilesize
248KB
-
memory/1620-12-0x000000001C270000-0x000000001C2C0000-memory.dmpFilesize
320KB
-
memory/1620-11-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmpFilesize
9.9MB
-
memory/1620-13-0x000000001C380000-0x000000001C432000-memory.dmpFilesize
712KB
-
memory/1620-18-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmpFilesize
9.9MB
-
memory/1620-325-0x000000001E120000-0x000000001E646000-memory.dmpFilesize
5.1MB
-
memory/1620-16-0x000000001C320000-0x000000001C332000-memory.dmpFilesize
72KB
-
memory/1620-9-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmpFilesize
9.9MB
-
memory/1620-2325-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmpFilesize
9.9MB
-
memory/4160-0-0x00007FF8C1D43000-0x00007FF8C1D44000-memory.dmpFilesize
4KB
-
memory/4160-1-0x00000000008B0000-0x0000000000BD4000-memory.dmpFilesize
3.1MB
-
memory/4160-2-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmpFilesize
9.9MB
-
memory/4160-10-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmpFilesize
9.9MB