quasar | 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aurora.exe
Size

21.3MB
MD5

416de11d210ae0ff50214021ff57b32b
SHA1

3142453c18080b83d8dbdeba89524beea1c94ff3
SHA256

72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
SHA512

e1f061f99e9e4e42c21269a32c9f3cfa711a8a95caf7628637d5606ae7846fc73ae982b0ee78646026c41e5c1e61e21a15829967d2fed534070e3c40e2731e4c
SSDEEP

393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF

Score

10^/10

quasar redline sectoprat xmrig cheat themdas discovery evasion execution infostealer miner persistence rat spyware themida trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

154.81.220.233:28105

Extracted

Family

quasar

Version

1.4.1

Botnet

themdas

auroraforge.art:55326

thesirenmika.com:55713

Mutex

0cbdfe7f-0215-41e8-a7b5-d4fbbc555089

Attributes

encryption_key
A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1
install_name
up2.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1836-61-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1836-62-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1836-58-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1836-57-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1836-63-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe	family_redline
behavioral1/memory/2328-33-0x0000000000970000-0x000000000098E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe	family_sectoprat
behavioral1/memory/2328-33-0x0000000000970000-0x000000000098E000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

Processes:

vlc.exesvchost.exe

description	pid	process	target process
PID 2732 created 1204	2732	vlc.exe	Explorer.EXE
PID 2732 created 1204	2732	vlc.exe	Explorer.EXE
PID 2732 created 1204	2732	vlc.exe	Explorer.EXE
PID 1320 created 1204	1320	svchost.exe	Explorer.EXE
PID 1320 created 1204	1320	svchost.exe	Explorer.EXE
PID 1320 created 1204	1320	svchost.exe	Explorer.EXE
PID 1320 created 1204	1320	svchost.exe	Explorer.EXE

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Aurora.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Aurora.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Aurora.exe

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1320-91-0x000000013FC80000-0x000000014021A000-memory.dmp	xmrig
behavioral1/memory/1152-94-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-96-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-99-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-101-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-103-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-105-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-107-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-109-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-111-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-113-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1152-115-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2748 attrib.exe

pid	process
2748	attrib.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Aurora.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Aurora.exe

Executes dropped EXE 6 IoCs

Processes:

AdobeUpdate.exebuild.exeOneDrive.exevlc.exeMsedge.exesvchost.exe

pid process

2132 AdobeUpdate.exe
2328 build.exe
2784 OneDrive.exe
2732 vlc.exe
2580 Msedge.exe
1320 svchost.exe
Loads dropped DLL 6 IoCs

Processes:

Aurora.execmd.exetaskeng.exe

pid process

2380 Aurora.exe
2380 Aurora.exe
2380 Aurora.exe
2380 Aurora.exe
2572 cmd.exe
1256 taskeng.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2624 icacls.exe

pid	process
2132	AdobeUpdate.exe
2328	build.exe
2784	OneDrive.exe
2732	vlc.exe
2580	Msedge.exe
1320	svchost.exe

pid	process
2624	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2380-49-0x0000000000920000-0x00000000023EA000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AdobeUpdate.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Local\\Msedge.exe"	AdobeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OneDriveUpdate\\OneDrive Updater.exe"	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Aurora.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Aurora.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2920 powershell.exe
2092 powershell.exe
2324 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Aurora.exe

pid	process
2920	powershell.exe
2092	powershell.exe
2324	powershell.exe

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.execmd.exepowercfg.exepowercfg.exepowercfg.execmd.exepowercfg.exe

pid	process
2756	powercfg.exe
2836	powercfg.exe
2824	powercfg.exe
2840	powercfg.exe
2912	cmd.exe
1620	powercfg.exe
2280	powercfg.exe
1800	powercfg.exe
1228	cmd.exe
1200	powercfg.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Aurora.exe

pid process

2380 Aurora.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

OneDrive.exesvchost.exe

description	pid	process	target process
PID 2784 set thread context of 1836	2784	OneDrive.exe	RegAsm.exe
PID 1320 set thread context of 2376	1320	svchost.exe	conhost.exe
PID 1320 set thread context of 1152	1320	svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeschtasks.exeRegAsm.exeAurora.exebuild.exeOneDrive.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aurora.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDrive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.execmd.exePING.EXE

pid process

3068 cmd.exe
2808 cmd.exe
2796 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2796 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1332 schtasks.exe
2412 schtasks.exe
1128 schtasks.exe

pid	process
3068	cmd.exe
2808	cmd.exe
2796	PING.EXE

pid	process
2796	PING.EXE

pid	process
1332	schtasks.exe
2412	schtasks.exe
1128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Aurora.exeOneDrive.exepowershell.exevlc.exepowershell.exesvchost.exepowershell.exesvchost.exe

pid	process
2380	Aurora.exe
2784	OneDrive.exe
2784	OneDrive.exe
2092	powershell.exe
2732	vlc.exe
2732	vlc.exe
2732	vlc.exe
2732	vlc.exe
2324	powershell.exe
2732	vlc.exe
2732	vlc.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
2920	powershell.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

OneDrive.exebuild.exeRegAsm.exepowershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2784	OneDrive.exe
Token: SeDebugPrivilege	2328	build.exe
Token: SeDebugPrivilege	1836	RegAsm.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeShutdownPrivilege	2756	powercfg.exe
Token: SeShutdownPrivilege	2836	powercfg.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeShutdownPrivilege	2824	powercfg.exe
Token: SeShutdownPrivilege	2840	powercfg.exe
Token: SeShutdownPrivilege	1200	powercfg.exe
Token: SeShutdownPrivilege	1620	powercfg.exe
Token: SeShutdownPrivilege	2280	powercfg.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeShutdownPrivilege	1800	powercfg.exe
Token: SeLockMemoryPrivilege	1152	svchost.exe
Token: SeLockMemoryPrivilege	1152	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

svchost.exe

pid	process
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

svchost.exe

pid	process
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Aurora.exeAdobeUpdate.execmd.execmd.execmd.exeOneDrive.execmd.exe

description	pid	process	target process
PID 2380 wrote to memory of 2132	2380	Aurora.exe	AdobeUpdate.exe
PID 2380 wrote to memory of 2132	2380	Aurora.exe	AdobeUpdate.exe
PID 2380 wrote to memory of 2132	2380	Aurora.exe	AdobeUpdate.exe
PID 2380 wrote to memory of 2132	2380	Aurora.exe	AdobeUpdate.exe
PID 2380 wrote to memory of 2328	2380	Aurora.exe	build.exe
PID 2380 wrote to memory of 2328	2380	Aurora.exe	build.exe
PID 2380 wrote to memory of 2328	2380	Aurora.exe	build.exe
PID 2380 wrote to memory of 2328	2380	Aurora.exe	build.exe
PID 2132 wrote to memory of 3068	2132	AdobeUpdate.exe	cmd.exe
PID 2132 wrote to memory of 3068	2132	AdobeUpdate.exe	cmd.exe
PID 2132 wrote to memory of 3068	2132	AdobeUpdate.exe	cmd.exe
PID 2380 wrote to memory of 2784	2380	Aurora.exe	OneDrive.exe
PID 2380 wrote to memory of 2784	2380	Aurora.exe	OneDrive.exe
PID 2380 wrote to memory of 2784	2380	Aurora.exe	OneDrive.exe
PID 2380 wrote to memory of 2784	2380	Aurora.exe	OneDrive.exe
PID 3068 wrote to memory of 2808	3068	cmd.exe	cmd.exe
PID 3068 wrote to memory of 2808	3068	cmd.exe	cmd.exe
PID 3068 wrote to memory of 2808	3068	cmd.exe	cmd.exe
PID 2808 wrote to memory of 2796	2808	cmd.exe	PING.EXE
PID 2808 wrote to memory of 2796	2808	cmd.exe	PING.EXE
PID 2808 wrote to memory of 2796	2808	cmd.exe	PING.EXE
PID 2380 wrote to memory of 2732	2380	Aurora.exe	vlc.exe
PID 2380 wrote to memory of 2732	2380	Aurora.exe	vlc.exe
PID 2380 wrote to memory of 2732	2380	Aurora.exe	vlc.exe
PID 2380 wrote to memory of 2732	2380	Aurora.exe	vlc.exe
PID 2808 wrote to memory of 2748	2808	cmd.exe	attrib.exe
PID 2808 wrote to memory of 2748	2808	cmd.exe	attrib.exe
PID 2808 wrote to memory of 2748	2808	cmd.exe	attrib.exe
PID 2808 wrote to memory of 2624	2808	cmd.exe	icacls.exe
PID 2808 wrote to memory of 2624	2808	cmd.exe	icacls.exe
PID 2808 wrote to memory of 2624	2808	cmd.exe	icacls.exe
PID 2808 wrote to memory of 2572	2808	cmd.exe	cmd.exe
PID 2808 wrote to memory of 2572	2808	cmd.exe	cmd.exe
PID 2808 wrote to memory of 2572	2808	cmd.exe	cmd.exe
PID 2572 wrote to memory of 2580	2572	cmd.exe	Msedge.exe
PID 2572 wrote to memory of 2580	2572	cmd.exe	Msedge.exe
PID 2572 wrote to memory of 2580	2572	cmd.exe	Msedge.exe
PID 2784 wrote to memory of 2092	2784	OneDrive.exe	powershell.exe
PID 2784 wrote to memory of 2092	2784	OneDrive.exe	powershell.exe
PID 2784 wrote to memory of 2092	2784	OneDrive.exe	powershell.exe
PID 2784 wrote to memory of 2092	2784	OneDrive.exe	powershell.exe
PID 2784 wrote to memory of 3056	2784	OneDrive.exe	cmd.exe
PID 2784 wrote to memory of 3056	2784	OneDrive.exe	cmd.exe
PID 2784 wrote to memory of 3056	2784	OneDrive.exe	cmd.exe
PID 2784 wrote to memory of 3056	2784	OneDrive.exe	cmd.exe
PID 3056 wrote to memory of 1332	3056	cmd.exe	schtasks.exe
PID 3056 wrote to memory of 1332	3056	cmd.exe	schtasks.exe
PID 3056 wrote to memory of 1332	3056	cmd.exe	schtasks.exe
PID 3056 wrote to memory of 1332	3056	cmd.exe	schtasks.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1444	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe
PID 2784 wrote to memory of 1836	2784	OneDrive.exe	RegAsm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2748 attrib.exe

pid	process
2748	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
"C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "
4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\system32\cmd.exe
cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"
5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\system32\PING.EXE
ping localhost -n 1
6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2796

C:\Windows\system32\attrib.exe
attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2748

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)
6⤵
- Modifies file permissions
PID:2624

C:\Windows\system32\cmd.exe
cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572

C:\Users\Admin\AppData\Local\Msedge.exe
C:\Users\Admin\AppData\Local\Msedge.exe
7⤵
- Executes dropped EXE
PID:2580

C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
"C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
"C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\SysWOW64\cmd.exe
"cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
4⤵
PID:1444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
"C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2732

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:1228

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"
2⤵
PID:3036

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:2912

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1152

C:\Windows\system32\taskeng.exe
taskeng.exe {87C2F69C-7E69-4AAC-9C52-F131C22E044B} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1256

C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LBD5NQXK2RVQVSFCEU72.temp
Filesize
7KB

MD5
ad71b6b2ec42a95e2a492f3a3fb04cad

SHA1
2679e976741b22beea5076aec5e5ca4ea19b8f54

SHA256
8055c3615fcf921102ec679df3905da9172e0ad311aa0dd0246ed626ecf8f802

SHA512
14f1ca04f68d644e90d83d2841f6d6bf3ba9030b3a75ab107794cf3372c83465db771896d51838e08ba4e6c798ffbc81e45957669d35e98c66e711994ad5e753

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
Filesize
80KB

MD5
65f0a85c4b056d6bcee60c49e2372e35

SHA1
6af820a2030950617bf150777af4a43a06a17184

SHA256
d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e

SHA512
7a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383

Download Submit
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
Filesize
95KB

MD5
c9a9d471428a5f92068c0823e6454254

SHA1
8b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2

SHA256
b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5

SHA512
ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af

Download Submit
\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
Filesize
3.2MB

MD5
3b4f58cd4bca7274be25e885be00798b

SHA1
eb57c281d8324a1079db97c9da43483a65debbed

SHA256
a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80

SHA512
dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121

Download Submit
\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
Filesize
5.6MB

MD5
b9fc8581b52abfc6b563da731438e27d

SHA1
43111fe9b307c850a379fe2d64d279e994680de3

SHA256
e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058

SHA512
c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5

Download Submit
memory/1152-107-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-111-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-101-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-99-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-105-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-109-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-96-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-103-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-94-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-115-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-113-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1152-92-0x00000000000B0000-0x00000000000D0000-memory.dmp

Filesize
128KB

Download
memory/1320-79-0x000000013FC80000-0x000000014021A000-memory.dmp

Filesize
5.6MB

Download
memory/1320-91-0x000000013FC80000-0x000000014021A000-memory.dmp

Filesize
5.6MB

Download
memory/1836-63-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1836-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1836-62-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1836-58-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1836-57-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1836-61-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1836-52-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1836-55-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2324-71-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2324-70-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

Filesize
2.9MB

Download
memory/2328-78-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2328-27-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2328-33-0x0000000000970000-0x000000000098E000-memory.dmp

Filesize
120KB

Download
memory/2376-98-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/2376-93-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/2380-5-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-6-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-12-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-7-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-11-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-4-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-3-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-1-0x0000000075F4E000-0x0000000075F4F000-memory.dmp

Filesize
4KB

Download
memory/2380-48-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-2-0x0000000075F40000-0x0000000075F87000-memory.dmp

Filesize
284KB

Download
memory/2380-0-0x0000000000920000-0x00000000023EA000-memory.dmp

Filesize
26.8MB

Download
memory/2380-49-0x0000000000920000-0x00000000023EA000-memory.dmp

Filesize
26.8MB

Download
memory/2732-74-0x000000013F850000-0x000000013FDEA000-memory.dmp

Filesize
5.6MB

Download
memory/2732-64-0x000000013F850000-0x000000013FDEA000-memory.dmp

Filesize
5.6MB

Download
memory/2784-35-0x0000000000860000-0x0000000000B8E000-memory.dmp

Filesize
3.2MB

Download
memory/2920-85-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2920-86-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download