quasar | 5d381749978407c5259a4da354166ee8a9fb5e934c920d69305f8db93a6c529c

Resubmissions

15/08/2024, 21:32

240815-1dvy9swarg10

15/08/2024, 21:30

240815-1csshszenp10

Analysis

max time kernel
47s
max time network
44s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/08/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240815-1csshszenp
SHA256 5d381749978407c5259a4da354166ee8a9fb5e934c920d69305f8db93a6c529c
MD5 f4295363b8ae6c643d34ca268606bf7a
SHA1 7fa440bc1ecd3ff4cd6a0eda3c9394c7e1630cc0
SHA512 06b07fbaad625e9189d0a78cccb7f7087f40c1d3704e5673b367c07a0b81e1cf8d8405d4c1064d11b1dce85173b5b4a8d379a2d0f17d8f4570abc048b207b7f5
SSDEEP 49152:OvyI22SsaNYfdPBldt698dBcjH+CU1JLLoGd5THHB72eh2NT:Ovf22SsaNYfdPBldt6+dBcjH+Co
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

2601:601:480:5e0::ee14:4782

Mutex

367fc473-e902-4dc9-9702-0593f8980259

Attributes

encryption_key
E8CDDBBA590873BFD4CA899CC44B15C399BC1E2A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/2780-9-0x0000000001100000-0x0000000001424000-memory.dmp	family_quasar
behavioral1/files/0x0008000000016d5d-7.dat	family_quasar
behavioral1/memory/2152-1-0x0000000000100000-0x0000000000424000-memory.dmp	family_quasar
behavioral1/memory/2236-23-0x0000000000360000-0x0000000000684000-memory.dmp	family_quasar
behavioral1/memory/1640-44-0x0000000000310000-0x0000000000634000-memory.dmp	family_quasar
behavioral1/memory/1528-1926-0x0000000000C60000-0x0000000000F84000-memory.dmp	family_quasar

Executes dropped EXE 5 IoCs

pid	Process
2780	Client.exe
2236	Client.exe
1000	Client.exe
1640	Client.exe
1528	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
888	PING.EXE
2612	PING.EXE
2124	PING.EXE
2024	PING.EXE
2320	PING.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06c608e5aefda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000088513efcb943361398e4a16c030108934fa1fa31b64f066b98f7fda280fad2c6000000000e8000000002000020000000602d4307fbd8db06774dbe0660e886af2d802ecd4038a9660f314a102a534f5620000000acf7e08223aa30408a9a53b6e12b175b8b5a8d81ae3ef002d566b08d917a61e3400000007df3ff88423fda39c2b798acdb8bccc85828986070bfdc60a61482e6ca175877af6d629b09ea013fd05f7e6546e81b617086f2b6cf778670912c01f2c4f25992	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4B8F5C1-5B4D-11EF-AB3C-C2666C5B6023} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000004256094c6931d7f93dfa1d2dd04101cbe548830dc5b26f00566445b4e67b4b16000000000e8000000002000020000000e9b5deed14e6b86ea2a7169e31bc42c3f8cf13da7f713643bfe6b7e3909350a090000000be813e8f399b5ba6be4d519589207c315d47987fdf97f2d9aff13d83bc10d509c0ea1a78a38c7a2222f47b54de808780611f85c687e05637a87a38bf3c65d4543508b949bff6c40eebea14c49f610371f0f44d2ced9a01cf941c21d26fbacf1cfbc06654f3a6b9ad34572a141201687c715b94f280f61476869c09983d794ecd190eabc830a240048d0d6f08ce0c8ffd400000005985b5aedc4cfc5511e55d7d28c749ac4d13670556f30500cc45be8c3783ec07fb818c0b5babeb4e68514236342c66791d0142ef5dbebe124087b10a27fad460	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "21"	IEXPLORE.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
2612	PING.EXE
2124	PING.EXE
2024	PING.EXE
2320	PING.EXE
888	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
788	schtasks.exe
2732	schtasks.exe
2648	schtasks.exe
2344	schtasks.exe
852	schtasks.exe
2168	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	Client-built.exe
Token: SeDebugPrivilege	2780	Client.exe
Token: SeDebugPrivilege	2236	Client.exe
Token: SeDebugPrivilege	1000	Client.exe
Token: SeDebugPrivilege	1640	Client.exe
Token: SeDebugPrivilege	1528	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2780	Client.exe
1924	iexplore.exe
1924	iexplore.exe
536	IEXPLORE.EXE
536	IEXPLORE.EXE
1924	iexplore.exe
536	IEXPLORE.EXE
536	IEXPLORE.EXE
536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2648	2152	Client-built.exe	30
PID 2152 wrote to memory of 2648	2152	Client-built.exe	30
PID 2152 wrote to memory of 2648	2152	Client-built.exe	30
PID 2152 wrote to memory of 2780	2152	Client-built.exe	32
PID 2152 wrote to memory of 2780	2152	Client-built.exe	32
PID 2152 wrote to memory of 2780	2152	Client-built.exe	32
PID 2780 wrote to memory of 2732	2780	Client.exe	33
PID 2780 wrote to memory of 2732	2780	Client.exe	33
PID 2780 wrote to memory of 2732	2780	Client.exe	33
PID 2780 wrote to memory of 2540	2780	Client.exe	35
PID 2780 wrote to memory of 2540	2780	Client.exe	35
PID 2780 wrote to memory of 2540	2780	Client.exe	35
PID 2540 wrote to memory of 2604	2540	cmd.exe	37
PID 2540 wrote to memory of 2604	2540	cmd.exe	37
PID 2540 wrote to memory of 2604	2540	cmd.exe	37
PID 2540 wrote to memory of 2612	2540	cmd.exe	38
PID 2540 wrote to memory of 2612	2540	cmd.exe	38
PID 2540 wrote to memory of 2612	2540	cmd.exe	38
PID 2540 wrote to memory of 2236	2540	cmd.exe	39
PID 2540 wrote to memory of 2236	2540	cmd.exe	39
PID 2540 wrote to memory of 2236	2540	cmd.exe	39
PID 2236 wrote to memory of 2344	2236	Client.exe	40
PID 2236 wrote to memory of 2344	2236	Client.exe	40
PID 2236 wrote to memory of 2344	2236	Client.exe	40
PID 2236 wrote to memory of 2972	2236	Client.exe	42
PID 2236 wrote to memory of 2972	2236	Client.exe	42
PID 2236 wrote to memory of 2972	2236	Client.exe	42
PID 2972 wrote to memory of 588	2972	cmd.exe	44
PID 2972 wrote to memory of 588	2972	cmd.exe	44
PID 2972 wrote to memory of 588	2972	cmd.exe	44
PID 2972 wrote to memory of 2124	2972	cmd.exe	45
PID 2972 wrote to memory of 2124	2972	cmd.exe	45
PID 2972 wrote to memory of 2124	2972	cmd.exe	45
PID 2972 wrote to memory of 1000	2972	cmd.exe	46
PID 2972 wrote to memory of 1000	2972	cmd.exe	46
PID 2972 wrote to memory of 1000	2972	cmd.exe	46
PID 1000 wrote to memory of 852	1000	Client.exe	47
PID 1000 wrote to memory of 852	1000	Client.exe	47
PID 1000 wrote to memory of 852	1000	Client.exe	47
PID 1000 wrote to memory of 2908	1000	Client.exe	49
PID 1000 wrote to memory of 2908	1000	Client.exe	49
PID 1000 wrote to memory of 2908	1000	Client.exe	49
PID 2908 wrote to memory of 1144	2908	cmd.exe	51
PID 2908 wrote to memory of 1144	2908	cmd.exe	51
PID 2908 wrote to memory of 1144	2908	cmd.exe	51
PID 2908 wrote to memory of 2024	2908	cmd.exe	52
PID 2908 wrote to memory of 2024	2908	cmd.exe	52
PID 2908 wrote to memory of 2024	2908	cmd.exe	52
PID 2908 wrote to memory of 1640	2908	cmd.exe	54
PID 2908 wrote to memory of 1640	2908	cmd.exe	54
PID 2908 wrote to memory of 1640	2908	cmd.exe	54
PID 1924 wrote to memory of 536	1924	iexplore.exe	55
PID 1924 wrote to memory of 536	1924	iexplore.exe	55
PID 1924 wrote to memory of 536	1924	iexplore.exe	55
PID 1924 wrote to memory of 536	1924	iexplore.exe	55
PID 1640 wrote to memory of 2168	1640	Client.exe	56
PID 1640 wrote to memory of 2168	1640	Client.exe	56
PID 1640 wrote to memory of 2168	1640	Client.exe	56
PID 1640 wrote to memory of 1196	1640	Client.exe	58
PID 1640 wrote to memory of 1196	1640	Client.exe	58
PID 1640 wrote to memory of 1196	1640	Client.exe	58
PID 1196 wrote to memory of 776	1196	cmd.exe	60
PID 1196 wrote to memory of 776	1196	cmd.exe	60
PID 1196 wrote to memory of 776	1196	cmd.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2648
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FvFmppbBd8fi.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2604
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2612
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2344
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\5sBHFV51z7AD.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:588
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2124
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NuEMhz4QtJDa.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1144
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2024
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2168
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4sMOYc1AuC4h.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2320
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:788
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\hSQvNSTSjsEi.bat" "
        11⤵
        
        PID:892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1572
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6B2043001D270792DFFD725518EAFE2C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C
Size 579B
SHA256 31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
MD5 f55da450a5fb287e1e0f0dcc965756ca
SHA1 7e04de896a3e666d00e687d33ffad93be83d349e
SHA512 19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630
MD5 SHA1 SHA512

Submit Download

6B2043001D270792DFFD725518EAFE2C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
Size 252B
SHA256 1d3d820de9016c9f0fc3d49961c220df83b663e06a8be3a75b947a7ee3d84932
MD5 395e2cc71cfa9cca6389d794b5abe45a
SHA1 4ea522d0a82fc9c4907392028143af861cf2795e
SHA512 78cb9669042e29da77b710f66433f50c3e9bf9f098efa1c0396ac4936ddcc1c2949003ebfe58f9282b82f984d7ce18c66e2690046da4fb5710497ef3e66f9f96
MD5 SHA1 SHA512

Submit Download