Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2024 08:04
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
quasar
1.4.1
Office04
10.0.0.91:4782
9ed05a87-25fb-402e-a6a4-b613c5088d3d
-
encryption_key
1E317FE2D0D84B0CA0BFA596778B8CC9702863D6
-
install_name
HwidChecker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Downloads\Unconfirmed 488056.crdownload family_quasar behavioral1/memory/2020-196-0x00000000005D0000-0x00000000008F4000-memory.dmp family_quasar -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
HwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exepid process 2020 HwidChecker.exe 1540 HwidChecker.exe 2600 HwidChecker.exe 4444 HwidChecker.exe 4520 HwidChecker.exe 748 HwidChecker.exe 2168 HwidChecker.exe 1164 HwidChecker.exe 2084 HwidChecker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
OpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exeHwidChecker.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 488056.crdownload:SmartScreen msedge.exe File created C:\Users\Admin\AppData\Roaming\SubDir\HwidChecker.exe\:SmartScreen:$DATA HwidChecker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4856 schtasks.exe 4000 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exepid process 2296 msedge.exe 2296 msedge.exe 3372 msedge.exe 3372 msedge.exe 3064 identity_helper.exe 3064 identity_helper.exe 3928 msedge.exe 3928 msedge.exe 368 msedge.exe 368 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
HwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exeHwidChecker.exedescription pid process Token: SeDebugPrivilege 2020 HwidChecker.exe Token: SeDebugPrivilege 1540 HwidChecker.exe Token: SeDebugPrivilege 2600 HwidChecker.exe Token: SeDebugPrivilege 4444 HwidChecker.exe Token: SeDebugPrivilege 4520 HwidChecker.exe Token: SeDebugPrivilege 748 HwidChecker.exe Token: SeDebugPrivilege 2168 HwidChecker.exe Token: SeDebugPrivilege 1164 HwidChecker.exe Token: SeDebugPrivilege 2084 HwidChecker.exe Token: SeDebugPrivilege 4912 HwidChecker.exe Token: SeDebugPrivilege 4576 HwidChecker.exe Token: SeDebugPrivilege 3456 HwidChecker.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
Processes:
msedge.exepid process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of SendNotifyMessage 26 IoCs
Processes:
msedge.exepid process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
HwidChecker.exeOpenWith.exepid process 1540 HwidChecker.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe 2208 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3372 wrote to memory of 328 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 328 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1680 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 2296 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 2296 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4920 3372 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Zezment/HwidChecker/blob/main/HwidChecker.exe1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72da46f8,0x7ffe72da4708,0x7ffe72da47182⤵PID:328
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:22⤵PID:1680
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:4920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:3004
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:3200
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5512 /prefetch:82⤵PID:740
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:2824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6116 /prefetch:82⤵PID:3904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵PID:1000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928 -
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\HwidChecker.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4856 -
C:\Users\Admin\AppData\Roaming\SubDir\HwidChecker.exe"C:\Users\Admin\AppData\Roaming\SubDir\HwidChecker.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\HwidChecker.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:4000 -
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444 -
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:2580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:4400
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:12⤵PID:3928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:12⤵PID:4092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵PID:3300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,8585217668758521397,4345814092375594707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5788 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2740
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4068
-
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
C:\Users\Admin\Downloads\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\HwidChecker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2208 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\README.md2⤵PID:4488
-
C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\HwidChecker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\HwidChecker.exe"C:\Users\Admin\Downloads\HwidChecker-main\HwidChecker-main\HwidChecker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD53042c26d64ef06b2a7d8721ddc35a3a5
SHA17c63080b7fd6177912322d7a48aa67b416083fed
SHA25687c3238ab4b83a99b3c0bacec325d80fa7e3c747fadd6151c9f9e73987f5f8e4
SHA512bc529100011401ff314268e7a0102c66cb9bf91c0d3e330daa49b5696217a97ae148dac97c6f4ae71c5f3298475c448bcc447740714e904c149c191f2a4b1007
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5a8af3a279bc4f6d2c83645e000e49229
SHA1652d3c9e799da4bfa081bce6f1d4f711ef5342f6
SHA2568773d36e6093c92eace24a5ba314a1e5798edc096421410d5477fc9a1d169c4e
SHA512db5bd6f7e1d5d3781199514f7d7b45657a0977e3115d45e9ea9187e4fc3a30c761447571a2c07445c18b521678b42ba3882724a9d7de426001ebfd701e92a34a
-
Filesize
579B
MD5a7d1701142cca705f833d70023ef4e1e
SHA11b76853132abfcddb4fefac42bf9df5d013c9815
SHA2566c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7
SHA512806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0
-
Filesize
6KB
MD522fec6719603c6e58e463096d6ea1a25
SHA172ec4657dd4e9a5324c90667185cc39989337caf
SHA256c0c47a9b5c1fe921b66db17a685e6d4f2913467b12b22329def03c80c6108428
SHA5122b5d07af37ab63f92ab5c0c290be350ba71c8842f8f4385b747a70e41e9ebd2e7d6f35f4e3b6bc6320c9d3b6461806b6a7948cd6af3b347d35c90bdb7b5bc7ba
-
Filesize
6KB
MD5c676e5365ad039eab9193cf3ae410376
SHA1a6b6f6609099f282edd7b7a79cc9975c0b6eb6f1
SHA256a9aa178ab110d6dba3082ef9951bd0ef193f78cfef76ae120434a3b52b0ffb2f
SHA512bca06fa0b91942f1496f5006c7933d6ea7aaa7e41c8d6c6609e39af742b99507f604226e507cf9fd4ed98b87a921c4bfe63ca6fd176af7f565024eb6add70e70
-
Filesize
1KB
MD5502460275c7d2938014c808f4ed4f404
SHA11c8d989c62bdf316928e18d6e81df7cccf1228ac
SHA256632e6fadf6790242161fe0ddab9d935e481d81c2e9aa0342d46071a2f49fbc84
SHA5121a0d41ad096e7e98075d98d65b39d6411dfb3522744c7683aa3dd53cfeb6257cbbf8733de8758ae324b8ab754e108a7e36e0d831b5fb50e9ddd3a2f9bdbfbe5b
-
Filesize
1KB
MD53f4119c08c90141e9a84e8b2cccc4743
SHA181abd369fb7d6038c243970a50905f012e8088f8
SHA256a2bce38fa2ef13ecd1cc176c91c75dccac55938bb0cdc1ef182a3a53e926a425
SHA51284f41d85e4bbd4ea085b90e56284cf69c413bd7548c9a21bfcaedfe71d2b1198e89617669604e48dc9338d77321e1a8887d094f17e9823e5e870767ed3ec3016
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51756a914c10751b47bdc696ef9ad9e15
SHA1ea2e05e71d9198f95c012cb1c0016ce39b38716f
SHA2560bc8b4826cdb41e7c87a37e315f9be630bfc6661cdfd80b886b8192bc9040c85
SHA5128919a36165d551a6f045b0c5f562dd7d31338aa2996d1ec83723f0c189d3f6a4c4d56acfbc77334fa07fd78957a478121e654cb843c3e846450ea874da1367b3
-
Filesize
10KB
MD5a6f1e4d76520d54bf1dffffd20689355
SHA1edcd3a9fb06c6011bfc3eacd85b16d38fc55582e
SHA256254444ed4961f8a0cb8a7632e39cddc75c577da3c580a420fb262c5611ce1918
SHA512edc6077f0eaec01fee4d9ac7908c4b635f702708b9ec97c5ef0e6ac0c7cfb676d9e780b77d71f081b5caa890d4f59126e994ab5e3cf14ab8c1723cf52205cf61
-
Filesize
11KB
MD53277f2e283617c58ca3f228cdfe7cc52
SHA15b2d597dd6c6e7ae5001426042322eb5fbb69b39
SHA256330ff4d4c35c05ec7c6228cf3c23d8d47fb65d803115ee32c7ee1c01b51b3e4e
SHA5120a829e0fc7c550aab3f8bd4306d47e8e453b32554ad6c82d01b73381bc84fe5ffd16c2b2c0302ad47722d2408c23a11e8a082c14f4d524cd99b255f4828f679c
-
Filesize
1.2MB
MD556e8327d7854a0a1237cdda713299773
SHA1228ec634250a41884cb0633d7c2983e51b14b82f
SHA2560c9fa005f4e94bf7572c9e2e4fd98cbbe508d7a9ca4092705f37ba0204c910cd
SHA5128cfb21f5434e889bc5fdcef333c42e708dc57aa7f4b11264dd28548598ba9d86f40986e13122f9bb57fe75b828de442acac0c40e98b8d001183a1b10a4d3b43a
-
Filesize
3.1MB
MD5b6f7686e5d162b9ad7fc3c829c98f2e8
SHA19262f36af2986a6c8459b91a76064b1a86f66550
SHA2563aad476bc33ebbca38d7def91669e379a3563aaa7f5beddf9cfa0994946a2294
SHA512506691916a3fd10b0470069e1afaaf18473cfd9025fd3c2b3359bb780ac36250142bc02237778bb2a58d534f31b97c7423d2b98797565a275e3ccc1fb14f57ad
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e