quasar | cad0ea7aa29ccb61cd2c595e27921c89e6fed8b0275d86c5560fcde21a1554bc

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aurora.exe
Size

21.3MB
MD5

54b11d48df518b331d6e26e991cb7b07
SHA1

ac4ac7f296744fef3bdba55600e99b7e50196b45
SHA256

cad0ea7aa29ccb61cd2c595e27921c89e6fed8b0275d86c5560fcde21a1554bc
SHA512

bf40e890b14162dbbb170579806a81293040dd7855eabf4cdaa14849aeb3cb5ea9f7b017cec7d9bc5a6f934f4f320e97aecb486eaea1aef8fda6fec0ad507b1b
SSDEEP

393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF

Score

10^/10

quasar redline sectoprat xmrig cheat themdas discovery evasion execution infostealer miner persistence rat spyware themida trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

154.81.220.233:28105

Extracted

Family

quasar

Version

1.4.1

Botnet

themdas

auroraforge.art:55326

thesirenmika.com:55713

Mutex

0cbdfe7f-0215-41e8-a7b5-d4fbbc555089

Attributes

encryption_key
A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1
install_name
up2.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2912-50-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2912-52-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2912-56-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2912-58-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2912-55-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe	family_redline
behavioral1/memory/2492-32-0x00000000009F0000-0x0000000000A0E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe	family_sectoprat
behavioral1/memory/2492-32-0x00000000009F0000-0x0000000000A0E000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

Processes:

vlc.exesvchost.exe

description	pid	process	target process
PID 2780 created 1212	2780	vlc.exe	Explorer.EXE
PID 2780 created 1212	2780	vlc.exe	Explorer.EXE
PID 2780 created 1212	2780	vlc.exe	Explorer.EXE
PID 2228 created 1212	2228	svchost.exe	Explorer.EXE
PID 2228 created 1212	2228	svchost.exe	Explorer.EXE
PID 2228 created 1212	2228	svchost.exe	Explorer.EXE
PID 2228 created 1212	2228	svchost.exe	Explorer.EXE

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Aurora.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Aurora.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Aurora.exe

XMRig Miner payload 11 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2228-85-0x000000013FB10000-0x00000001400AA000-memory.dmp	xmrig
behavioral1/memory/1964-88-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-90-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-93-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-95-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-97-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-99-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-101-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-103-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-105-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/1964-107-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2644 attrib.exe

pid	process
2644	attrib.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Aurora.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Aurora.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Aurora.exe

Executes dropped EXE 6 IoCs

Processes:

AdobeUpdate.exebuild.exeOneDrive.exevlc.exeMsedge.exesvchost.exe

pid process

1688 AdobeUpdate.exe
2492 build.exe
2428 OneDrive.exe
2780 vlc.exe
836 Msedge.exe
2228 svchost.exe
Loads dropped DLL 6 IoCs

Processes:

Aurora.execmd.exetaskeng.exe

pid process

2564 Aurora.exe
2564 Aurora.exe
2564 Aurora.exe
2564 Aurora.exe
2748 cmd.exe
3036 taskeng.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2684 icacls.exe

pid	process
1688	AdobeUpdate.exe
2492	build.exe
2428	OneDrive.exe
2780	vlc.exe
836	Msedge.exe
2228	svchost.exe

pid	process
2684	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2564-41-0x0000000000CC0000-0x000000000278A000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AdobeUpdate.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Local\\Msedge.exe"	AdobeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OneDriveUpdate\\OneDrive Updater.exe"	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Aurora.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Aurora.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1228 powershell.exe
2976 powershell.exe
2500 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Aurora.exe

pid	process
1228	powershell.exe
2976	powershell.exe
2500	powershell.exe

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.execmd.execmd.exepowercfg.exepowercfg.exe

pid	process
1792	powercfg.exe
944	powercfg.exe
1968	powercfg.exe
1620	powercfg.exe
2188	powercfg.exe
952	powercfg.exe
1344	cmd.exe
632	cmd.exe
932	powercfg.exe
1800	powercfg.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Aurora.exe

pid process

2564 Aurora.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

OneDrive.exesvchost.exe

description	pid	process	target process
PID 2428 set thread context of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2228 set thread context of 1816	2228	svchost.exe	conhost.exe
PID 2228 set thread context of 1964	2228	svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Aurora.exebuild.exeOneDrive.exepowershell.execmd.exeschtasks.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aurora.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDrive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXEcmd.execmd.exe

pid process

2856 PING.EXE
2756 cmd.exe
2888 cmd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2856 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2612 schtasks.exe
2452 schtasks.exe
1780 schtasks.exe

pid	process
2856	PING.EXE
2756	cmd.exe
2888	cmd.exe

pid	process
2856	PING.EXE

pid	process
2612	schtasks.exe
2452	schtasks.exe
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Aurora.exeOneDrive.exepowershell.exevlc.exepowershell.exesvchost.exepowershell.exesvchost.exe

pid	process
2564	Aurora.exe
2428	OneDrive.exe
2428	OneDrive.exe
1228	powershell.exe
2780	vlc.exe
2780	vlc.exe
2780	vlc.exe
2780	vlc.exe
2976	powershell.exe
2780	vlc.exe
2780	vlc.exe
2228	svchost.exe
2228	svchost.exe
2228	svchost.exe
2228	svchost.exe
2500	powershell.exe
2228	svchost.exe
2228	svchost.exe
2228	svchost.exe
2228	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460

pid	process
460

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

build.exeOneDrive.exeRegAsm.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2492	build.exe
Token: SeDebugPrivilege	2428	OneDrive.exe
Token: SeDebugPrivilege	2912	RegAsm.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeShutdownPrivilege	1792	powercfg.exe
Token: SeShutdownPrivilege	944	powercfg.exe
Token: SeShutdownPrivilege	1968	powercfg.exe
Token: SeShutdownPrivilege	1620	powercfg.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeShutdownPrivilege	932	powercfg.exe
Token: SeShutdownPrivilege	2188	powercfg.exe
Token: SeShutdownPrivilege	1800	powercfg.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeShutdownPrivilege	952	powercfg.exe
Token: SeLockMemoryPrivilege	1964	svchost.exe
Token: SeLockMemoryPrivilege	1964	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

svchost.exe

pid	process
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

svchost.exe

pid	process
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Aurora.exeAdobeUpdate.execmd.execmd.exeOneDrive.execmd.execmd.exe

description	pid	process	target process
PID 2564 wrote to memory of 1688	2564	Aurora.exe	AdobeUpdate.exe
PID 2564 wrote to memory of 1688	2564	Aurora.exe	AdobeUpdate.exe
PID 2564 wrote to memory of 1688	2564	Aurora.exe	AdobeUpdate.exe
PID 2564 wrote to memory of 1688	2564	Aurora.exe	AdobeUpdate.exe
PID 2564 wrote to memory of 2492	2564	Aurora.exe	build.exe
PID 2564 wrote to memory of 2492	2564	Aurora.exe	build.exe
PID 2564 wrote to memory of 2492	2564	Aurora.exe	build.exe
PID 2564 wrote to memory of 2492	2564	Aurora.exe	build.exe
PID 1688 wrote to memory of 2756	1688	AdobeUpdate.exe	cmd.exe
PID 1688 wrote to memory of 2756	1688	AdobeUpdate.exe	cmd.exe
PID 1688 wrote to memory of 2756	1688	AdobeUpdate.exe	cmd.exe
PID 2564 wrote to memory of 2428	2564	Aurora.exe	OneDrive.exe
PID 2564 wrote to memory of 2428	2564	Aurora.exe	OneDrive.exe
PID 2564 wrote to memory of 2428	2564	Aurora.exe	OneDrive.exe
PID 2564 wrote to memory of 2428	2564	Aurora.exe	OneDrive.exe
PID 2564 wrote to memory of 2780	2564	Aurora.exe	vlc.exe
PID 2564 wrote to memory of 2780	2564	Aurora.exe	vlc.exe
PID 2564 wrote to memory of 2780	2564	Aurora.exe	vlc.exe
PID 2564 wrote to memory of 2780	2564	Aurora.exe	vlc.exe
PID 2756 wrote to memory of 2888	2756	cmd.exe	cmd.exe
PID 2756 wrote to memory of 2888	2756	cmd.exe	cmd.exe
PID 2756 wrote to memory of 2888	2756	cmd.exe	cmd.exe
PID 2888 wrote to memory of 2856	2888	cmd.exe	PING.EXE
PID 2888 wrote to memory of 2856	2888	cmd.exe	PING.EXE
PID 2888 wrote to memory of 2856	2888	cmd.exe	PING.EXE
PID 2888 wrote to memory of 2644	2888	cmd.exe	attrib.exe
PID 2888 wrote to memory of 2644	2888	cmd.exe	attrib.exe
PID 2888 wrote to memory of 2644	2888	cmd.exe	attrib.exe
PID 2888 wrote to memory of 2684	2888	cmd.exe	icacls.exe
PID 2888 wrote to memory of 2684	2888	cmd.exe	icacls.exe
PID 2888 wrote to memory of 2684	2888	cmd.exe	icacls.exe
PID 2888 wrote to memory of 2748	2888	cmd.exe	cmd.exe
PID 2888 wrote to memory of 2748	2888	cmd.exe	cmd.exe
PID 2888 wrote to memory of 2748	2888	cmd.exe	cmd.exe
PID 2428 wrote to memory of 1228	2428	OneDrive.exe	powershell.exe
PID 2428 wrote to memory of 1228	2428	OneDrive.exe	powershell.exe
PID 2428 wrote to memory of 1228	2428	OneDrive.exe	powershell.exe
PID 2428 wrote to memory of 1228	2428	OneDrive.exe	powershell.exe
PID 2428 wrote to memory of 2300	2428	OneDrive.exe	cmd.exe
PID 2428 wrote to memory of 2300	2428	OneDrive.exe	cmd.exe
PID 2428 wrote to memory of 2300	2428	OneDrive.exe	cmd.exe
PID 2428 wrote to memory of 2300	2428	OneDrive.exe	cmd.exe
PID 2748 wrote to memory of 836	2748	cmd.exe	Msedge.exe
PID 2748 wrote to memory of 836	2748	cmd.exe	Msedge.exe
PID 2748 wrote to memory of 836	2748	cmd.exe	Msedge.exe
PID 2300 wrote to memory of 2612	2300	cmd.exe	schtasks.exe
PID 2300 wrote to memory of 2612	2300	cmd.exe	schtasks.exe
PID 2300 wrote to memory of 2612	2300	cmd.exe	schtasks.exe
PID 2300 wrote to memory of 2612	2300	cmd.exe	schtasks.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 1664	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe
PID 2428 wrote to memory of 2912	2428	OneDrive.exe	RegAsm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2644 attrib.exe

pid	process
2644	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2564

C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
"C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "
4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\system32\cmd.exe
cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"
5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\system32\PING.EXE
ping localhost -n 1
6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2856

C:\Windows\system32\attrib.exe
attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2644

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)
6⤵
- Modifies file permissions
PID:2684

C:\Windows\system32\cmd.exe
cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Msedge.exe
C:\Users\Admin\AppData\Local\Msedge.exe
7⤵
- Executes dropped EXE
PID:836

C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
"C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
"C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\SysWOW64\cmd.exe
"cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
4⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
"C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2780

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:1344

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"
2⤵
PID:2200

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:632

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1964

C:\Windows\system32\taskeng.exe
taskeng.exe {3852F004-611B-47DB-9F3F-5D813D753CFB} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:3036

C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HI05FPAEKR8GVDUFADRJ.temp
Filesize
7KB

MD5
56a3c8d6d56a2b35a3cfe7674ce80cfd

SHA1
8dba97edd6051301cb07f29de58ea8eafa607b9e

SHA256
1e0e90ab41e50295400604bd724cc17f6ea29e7dab13363540adea621f96331f

SHA512
34620a71e97e02233be6a68690ce14989229891895922f573dc2e06438540f3003d5fc4aafef436ef30b4380a3522518c71761ebbfee823676e8b477aa5a7e68

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
Filesize
80KB

MD5
65f0a85c4b056d6bcee60c49e2372e35

SHA1
6af820a2030950617bf150777af4a43a06a17184

SHA256
d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e

SHA512
7a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383

Download Submit
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
Filesize
95KB

MD5
c9a9d471428a5f92068c0823e6454254

SHA1
8b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2

SHA256
b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5

SHA512
ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af

Download Submit
\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
Filesize
3.2MB

MD5
3b4f58cd4bca7274be25e885be00798b

SHA1
eb57c281d8324a1079db97c9da43483a65debbed

SHA256
a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80

SHA512
dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121

Download Submit
\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
Filesize
5.6MB

MD5
b9fc8581b52abfc6b563da731438e27d

SHA1
43111fe9b307c850a379fe2d64d279e994680de3

SHA256
e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058

SHA512
c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5

Download Submit
memory/1816-92-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/1816-87-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/1964-88-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-97-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-86-0x00000000000B0000-0x00000000000D0000-memory.dmp

Filesize
128KB

Download
memory/1964-90-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-93-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-107-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-105-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-103-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-101-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-95-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1964-99-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2228-73-0x000000013FB10000-0x00000001400AA000-memory.dmp

Filesize
5.6MB

Download
memory/2228-85-0x000000013FB10000-0x00000001400AA000-memory.dmp

Filesize
5.6MB

Download
memory/2428-33-0x0000000000340000-0x000000000066E000-memory.dmp

Filesize
3.2MB

Download
memory/2492-32-0x00000000009F0000-0x0000000000A0E000-memory.dmp

Filesize
120KB

Download
memory/2500-79-0x000000001B0B0000-0x000000001B392000-memory.dmp

Filesize
2.9MB

Download
memory/2500-80-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2564-1-0x00000000755CE000-0x00000000755CF000-memory.dmp

Filesize
4KB

Download
memory/2564-35-0x00000000755C0000-0x0000000075607000-memory.dmp

Filesize
284KB

Download
memory/2564-2-0x00000000755C0000-0x0000000075607000-memory.dmp

Filesize
284KB

Download
memory/2564-41-0x0000000000CC0000-0x000000000278A000-memory.dmp

Filesize
26.8MB

Download
memory/2564-7-0x00000000755C0000-0x0000000075607000-memory.dmp

Filesize
284KB

Download
memory/2564-3-0x00000000755C0000-0x0000000075607000-memory.dmp

Filesize
284KB

Download
memory/2564-0-0x0000000000CC0000-0x000000000278A000-memory.dmp

Filesize
26.8MB

Download
memory/2780-69-0x000000013FFF0000-0x000000014058A000-memory.dmp

Filesize
5.6MB

Download
memory/2780-59-0x000000013FFF0000-0x000000014058A000-memory.dmp

Filesize
5.6MB

Download
memory/2912-48-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2912-54-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2912-55-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2912-58-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2912-56-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2912-52-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2912-46-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2912-50-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2976-66-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2976-65-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download