Analysis
-
max time kernel
1783s -
max time network
1796s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01-06-2024 15:00
Static task
static1
General
-
Target
Update.exe
-
Size
20.4MB
-
MD5
88246c2a001042481486e559a6d10d91
-
SHA1
e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
-
SHA256
4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
-
SHA512
f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
-
SSDEEP
393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o
Malware Config
Extracted
quasar
1.4.1
EmmasSub
85.23.24.170:4782
85.23.109.34:4782
82.128.254.93:4782
f82c7021-f558-4f6f-bbb3-fbe420c708e5
-
encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
-
install_name
RuntimeBroker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
WindowsSecureManager
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\MyFolder\RunMe.exe family_quasar behavioral1/memory/3420-276-0x0000000000F00000-0x0000000001224000-memory.dmp family_quasar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 3 IoCs
Processes:
Update.tmpRunMe.exeRuntimeBroker.exepid process 32 Update.tmp 3420 RunMe.exe 4668 RuntimeBroker.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
RunMe.exeRuntimeBroker.exedescription ioc process File created C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe RunMe.exe File opened for modification C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe RunMe.exe File opened for modification C:\Windows\system32\WindowsSecureManager RunMe.exe File opened for modification C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe RuntimeBroker.exe File opened for modification C:\Windows\system32\WindowsSecureManager RuntimeBroker.exe -
Drops file in Program Files directory 8 IoCs
Processes:
Update.tmpdescription ioc process File created C:\Program Files (x86)\MyFolder\is-5UJ2B.tmp Update.tmp File created C:\Program Files (x86)\MyFolder\is-EKVP7.tmp Update.tmp File opened for modification C:\Program Files (x86)\MyFolder\unins000.dat Update.tmp File opened for modification C:\Program Files (x86)\MyFolder\RunMe.exe Update.tmp File opened for modification C:\Program Files (x86)\MyFolder\creal.exe Update.tmp File created C:\Program Files (x86)\MyFolder\unins000.dat Update.tmp File created C:\Program Files (x86)\MyFolder\is-9K8PM.tmp Update.tmp File created C:\Program Files (x86)\MyFolder\is-TITSE.tmp Update.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 216 schtasks.exe 3772 schtasks.exe -
Modifies registry class 19 IoCs
Processes:
Update.tmpdescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.myp Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0" Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\TstFile.myp Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File" Update.tmp Key created \REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open Update.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\"" Update.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes Update.tmp -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Update.tmppowershell.exepid process 32 Update.tmp 32 Update.tmp 656 powershell.exe 656 powershell.exe 656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRunMe.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 656 powershell.exe Token: SeDebugPrivilege 3420 RunMe.exe Token: SeDebugPrivilege 4668 RuntimeBroker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Update.tmppid process 32 Update.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RuntimeBroker.exepid process 4668 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Update.exeUpdate.tmpcmd.exeRunMe.exeRuntimeBroker.exedescription pid process target process PID 3328 wrote to memory of 32 3328 Update.exe Update.tmp PID 3328 wrote to memory of 32 3328 Update.exe Update.tmp PID 3328 wrote to memory of 32 3328 Update.exe Update.tmp PID 32 wrote to memory of 3700 32 Update.tmp cmd.exe PID 32 wrote to memory of 3700 32 Update.tmp cmd.exe PID 32 wrote to memory of 3700 32 Update.tmp cmd.exe PID 3700 wrote to memory of 656 3700 cmd.exe powershell.exe PID 3700 wrote to memory of 656 3700 cmd.exe powershell.exe PID 3700 wrote to memory of 656 3700 cmd.exe powershell.exe PID 32 wrote to memory of 3420 32 Update.tmp RunMe.exe PID 32 wrote to memory of 3420 32 Update.tmp RunMe.exe PID 3420 wrote to memory of 216 3420 RunMe.exe schtasks.exe PID 3420 wrote to memory of 216 3420 RunMe.exe schtasks.exe PID 3420 wrote to memory of 4668 3420 RunMe.exe RuntimeBroker.exe PID 3420 wrote to memory of 4668 3420 RunMe.exe RuntimeBroker.exe PID 4668 wrote to memory of 3772 4668 RuntimeBroker.exe schtasks.exe PID 4668 wrote to memory of 3772 4668 RuntimeBroker.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update.exe"C:\Users\Admin\AppData\Local\Temp\Update.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KHADG.tmp\Update.tmp"C:\Users\Admin\AppData\Local\Temp\is-KHADG.tmp\Update.tmp" /SL5="$70214,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\MyFolder\RunMe.exe"C:\Program Files (x86)\MyFolder\RunMe.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\MyFolder\RunMe.exeFilesize
3.1MB
MD5392a6ea0718747e4ad443f730047715b
SHA1808d682efeb32bd7f98e49b7b99350683162059e
SHA25636be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257
SHA512b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4
-
C:\Program Files (x86)\MyFolder\me.batFilesize
130B
MD50829830a1636e2958b07fc827cb5d3d7
SHA16051bfbf49df5f44c41f20104a079a8d0f7acb94
SHA256b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b
SHA512ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3cvahu4s.gco.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\is-KHADG.tmp\Update.tmpFilesize
3.1MB
MD56a4ac87c4331dc724e6fea16e0ab4b7e
SHA13dcab7b5fc73352c01eb24e827626670fa323cec
SHA2563b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66
SHA512dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6
-
memory/32-285-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/32-6-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/32-272-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/656-26-0x0000000007AD0000-0x0000000007AF2000-memory.dmpFilesize
136KB
-
memory/656-56-0x0000000009DA0000-0x0000000009E45000-memory.dmpFilesize
660KB
-
memory/656-27-0x00000000083D0000-0x0000000008436000-memory.dmpFilesize
408KB
-
memory/656-29-0x00000000084B0000-0x0000000008800000-memory.dmpFilesize
3.3MB
-
memory/656-30-0x0000000008270000-0x000000000828C000-memory.dmpFilesize
112KB
-
memory/656-31-0x00000000088C0000-0x000000000890B000-memory.dmpFilesize
300KB
-
memory/656-32-0x0000000008BC0000-0x0000000008C36000-memory.dmpFilesize
472KB
-
memory/656-24-0x00000000053D0000-0x0000000005406000-memory.dmpFilesize
216KB
-
memory/656-49-0x0000000009C70000-0x0000000009CA3000-memory.dmpFilesize
204KB
-
memory/656-50-0x000000006F6D0000-0x000000006F71B000-memory.dmpFilesize
300KB
-
memory/656-51-0x0000000009C30000-0x0000000009C4E000-memory.dmpFilesize
120KB
-
memory/656-28-0x0000000008440000-0x00000000084A6000-memory.dmpFilesize
408KB
-
memory/656-57-0x0000000009FB0000-0x000000000A044000-memory.dmpFilesize
592KB
-
memory/656-250-0x0000000009F10000-0x0000000009F2A000-memory.dmpFilesize
104KB
-
memory/656-255-0x0000000009EF0000-0x0000000009EF8000-memory.dmpFilesize
32KB
-
memory/656-25-0x0000000007BC0000-0x00000000081E8000-memory.dmpFilesize
6.2MB
-
memory/3328-271-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3328-0-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3328-2-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/3328-286-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3420-276-0x0000000000F00000-0x0000000001224000-memory.dmpFilesize
3.1MB
-
memory/4668-287-0x000000001BD90000-0x000000001BDE0000-memory.dmpFilesize
320KB
-
memory/4668-288-0x000000001C6C0000-0x000000001C772000-memory.dmpFilesize
712KB