quasar | 4839b5c66226453fa0483645cc8a824964e906c560fa5b2c3804508b1e6e4aa4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
element4.exe
Size 3.1MB
Sample240918-b33b7swcrf
SHA256 4839b5c66226453fa0483645cc8a824964e906c560fa5b2c3804508b1e6e4aa4
MD5 2fc80e11957f3066b37f1b2e5896c251
SHA1 6fb5579da60509a8707ca30a92e14cfa04a16b44
SHA512 a82cdd31c5c0d96317a78436e299643625e0926b667487734308e40e10b08e9abe9dc037e35b40a2da92fa71537e7301a87cf180094aaada24e343a181090e94
SSDEEP 49152:/vyI22SsaNYfdPBldt698dBcjH3TRJ6WbR3LoGdeTHHB72eh2NT:/vf22SsaNYfdPBldt6+dBcjH3TRJ6Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.87:4782

Mutex

98cb7988-a5b2-4ffc-908d-cf481d1236e4

Attributes

encryption_key
48510D41BE835FBFFEDFA315D99E98B86B57AEDA
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3400-1-0x0000000000CA0000-0x0000000000FC4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c8e-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1116	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133710973439276331"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
640	schtasks.exe
4508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1116	Client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	element4.exe
Token: SeDebugPrivilege	1116	Client.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe
Token: SeShutdownPrivilege	2800	chrome.exe
Token: SeCreatePagefilePrivilege	2800	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe
2800	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1116	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 640	3400	element4.exe	86
PID 3400 wrote to memory of 640	3400	element4.exe	86
PID 3400 wrote to memory of 1116	3400	element4.exe	88
PID 3400 wrote to memory of 1116	3400	element4.exe	88
PID 1116 wrote to memory of 4508	1116	Client.exe	92
PID 1116 wrote to memory of 4508	1116	Client.exe	92
PID 2800 wrote to memory of 1600	2800	chrome.exe	111
PID 2800 wrote to memory of 1600	2800	chrome.exe	111
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 1632	2800	chrome.exe	112
PID 2800 wrote to memory of 5104	2800	chrome.exe	113
PID 2800 wrote to memory of 5104	2800	chrome.exe	113
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114
PID 2800 wrote to memory of 1616	2800	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\element4.exe
"C:\Users\Admin\AppData\Local\Temp\element4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:640
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9d4cbcc40,0x7ff9d4cbcc4c,0x7ff9d4cbcc58
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1980,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2308,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2324 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3368,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4640,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4860,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4408,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5064,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4820,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=240,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5100,i,11872754292306899762,4802276314961597003,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3480

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 451672d8216d34b62b3ee80bd8fd6faeaa7fe86f1e71bddf68b5d7d1dba80e84
MD5 e2abff1736a59ad7037fe5e3f1f7c8c6
SHA1 03a53a6b1c314f9a633356d40496d4e414a85c94
SHA512 a2389c856a056f61f789b4b58af2a4bcd1f91f1b152697696640d53e46c901d5facabca4c1bfc7be801cd15b3e6be5db7bd6a0258141ccae227313c9b616266f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6b37d9ebb66b30fd19213353ee22c67d49b67d38693c9e817ee7d94002fb1225
MD5 a908ef33370d9c6cf96a354bc7954b3b
SHA1 4be3c00bd2460102b23ee142cda1775d564e024f
SHA512 30339790a8f446c67d0c0a8b7dd25e6ec96cc0e584c8a61f9e2542d5f0e78d0f45edc8897c0e169c5eea3ee8ca34962fbdbf83982aefdf73c08050a542d5a505
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 0546babb5ef3b1de120fd057005816614877c8b6367c854c8b30bf6a40352f43
MD5 9f04a0eed608fc36968e5d4f27b0af83
SHA1 dbca020a2940eb572fafcbf0864bd274121a76fd
SHA512 ade7647c57ffe3cf6213638d24e82abaa85e5d70dfff97153ebdffbacefd954988918087211699edc3a145cc61e67a962f138f38265bdb39450f733976edb816
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 667a1bae0cc3640ca6895a518a57a35686b87ae9ef0c9d9dc74f5e7a228cc688
MD5 edc3715a6f21893c28a91cc0caa97fec
SHA1 b70da8c352cd88a8435a0867506dd9daad5cf3c7
SHA512 dd2565dd8bfd6cfcb9f7026c2d97e90fb091e214d1869cc4fe0a00013469b9a97c3fca92ac0389fb7798f16c4ecfcdfce2b6edac5f751a4327400134aa5ca4f9
SSDEEP 192:biC1C4xZcejoHV+FR232UQkw9gbPo6yIsnVdg4:bia1TcGRu2ddE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9189a6b7a9fc7a349c8f6184380129028e296624dbffe39284ec0dbfed79855e
MD5 7cb6376c40ac679e0441fd0504acbe6b
SHA1 aac9cdedf75630e7a0982290eecefad869176076
SHA512 7600f65465a5f3c42277f53dff5ee224ec90df2772637349ef2413cef492a91016754e1f84f295504eecaef5218c1176b3967117f74d2bb1a1c5b31ee96e30fb
SSDEEP 192:biC1C4xZVejoHV+FRp2UQkwYgbPo6yIsnVdg4:bia1wcGRp2d4E4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 71460fb8527e0484c8bf76024fbe66c72069f174a1db2e9505694cabd659fab1
MD5 d548d67fa1da45b46b7ac4b82ea1e9b6
SHA1 2e948699ff21c02c16bc9d7e23b49c6758a87f31
SHA512 af4f3087aab011ff5a18bac0557e404c4b60269c734875302a63e3776c8c803740ccbfd292924baa5397fc65806a3c6e8c92e7962659e6e9a0eee977543bfb27
SSDEEP 192:biC1C4xZHejoHV+FR32UQkwUgbPo6yIsnVdg4:bia1ecGR32d0E4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ac7af94e00ee56bd68e3414526d72dbedaca5824a146b7fd710f6544ad3a5bf3
MD5 59074139324fa8517e1e0f271017f395
SHA1 9fcd6ebe74e55ac2f5d02ed2a55fce4b8afba813
SHA512 4928f57af9e6ea7538ae273c6bfeb98cdbb6c880a6158eba209a8a33c02f2ea82b543eb7adf39f73bf9ce6daaaa2ad026a90809a164af1ecb1e4767bd67aba0b
SSDEEP 192:biC1C4xZXejoHV+FRp2UQkwYgbPo6yIsnVdg4:bia1ecGRp2d4E4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 56fd5979423ba774a412081655db4b8607eedc83f81d134d3f72099974e467ed
MD5 447cd5d2d50d831cb7619235db8797d7
SHA1 34023a93192674bb4df48c6a9b1f8fa3940032d7
SHA512 1d0a592e062c990d374b5bbf709b2efc651549084580ec275a58d16cd7da1a7d047090901bc40a118401e80ea0482d72d80bf8dd6bd5619222109ca7f241306d
SSDEEP 192:biC1C4xZhejoHV+FR32UQkwUgbPo6yIsnVdg4:bia1EcGR32d0E4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ef539cb6404835775e4d11faf8e4be48fd372d9a334f4eb7ca0ee2488a74ebf3
MD5 27cb03f14c5be1bcbdeeec32b308bf82
SHA1 30a6bc1cbae4c3d6d67991b6d2a6fa2f260dbb32
SHA512 7b4d45bc8de9c15682f50f6ac1668e0e24ac67fd188be9a7b66cdd8e41193075233245774b3e58cbd7fa6af00946ba98c915e23c897cb86a35e5019c583d39e7
SSDEEP 192:biC1C4xZbejoHV+FR232UQkw9gbPo6yIsnVdg4:bia1qcGRu2ddE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 23fecf48b950cc57d028c053b57fd1e59fc346d753edc58fa214795f581ab1d4
MD5 6e2294a93a7698ae182d1c3d08f3889d
SHA1 b8138bdc1891a410dcdc4f37b32c97e71231ac97
SHA512 2260f04651e0e51adae650d2dee1337172921cdcf1eb33ae0163ba8e2f4cdd9bbc82a9499c07edc3a658219fdfc1e05cfee9217f67e2f2ac10fb91fa797f4396
SSDEEP 192:biC1C4xZ4ejoHV+FRp2UQkwYgbPo6yIsnVdg4:bia1XcGRp2d4E4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 9c1b37c17a170a3f9c8388bcc4580aaf94c5012ba90d724785794563b863d540
MD5 507bb5e5ab4c19920120a0af6430e6c9
SHA1 51b79441ab386c183b85a56215f7d182eb05eb41
SHA512 b123076982994cff77fd68d57011ec24861ea725d0148953888d45279e24c726116bb8c5aac207dbe924cbba69dd0e46778da5df7b29f08e8d28d25cb9acf80f
SSDEEP 384:PLWs7pLhLc+eXaX8W1kXqKf/pUZNCgVLH2HfS3qrUl5HGg3BiqA4:PCs7pLhLnII8W1kXqKf/pUZNCgVLH2Hu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 112KB
SHA256 bbaf96cc4108847b118eae8966325af898770d4cf0ec1b063ec1c16bc9174ee8
MD5 56b298294a9b8a43369bbbabca3c50f4
SHA1 d417e87f6b6e4c252c521bd242fd5ce914457490
SHA512 0abce02acd9b93239dcb5a7d96be1c1b94b466e0d654fc9d12906c57b6db22d6411e3cee4f4b84dd311338a0c31b56441465b2d0fe4eeba26e26627a402217ea
SSDEEP 3072:OlVWxOXrD910n9i2rliNxLCxXSLtv2xE/fngUJC:OlVrNAiNxLWSLhzHfJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 222KB
SHA256 a637b6d6f7d461344679782ce4f450f74fe7cc4786ba7e5fa0585e46bd018186
MD5 8b60b45e2f3acadadac20ed8e706b1fc
SHA1 3ca24985984b8dc0c3aa3e7bff39e5ed7c8a5e8e
SHA512 1b8f131392ec4eb0091e1404e1330250021b2245aee3f43bb2d1f53041030c136ec27a2c3f627ad9a3c53218bcfd3c6cc88ebabc54cecff12a5a441e42e583eb
SSDEEP 3072:NlzBB7yWBbHS8Rf4Ug3GCaF+2fek969rGrWxOXrD910n9i2rliNxLCxXSLtv2xE4:NlzBlyu7Svkxp66rrNAiNxLWSLhzHfJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 222KB
SHA256 b82503f4b280182fbd98e10cc2a07ba470f70a51e2bd5f177a6567994fcbcfef
MD5 f86f8acd691913c2d51ea975b1134e58
SHA1 98b5b04e38c383b1e76fab5ce00556f919934902
SHA512 dc6393b37eb9a788fb311803eec1e92d99d0ad32988b3823aace364423256b20ed1dc64e0ffd6cc310e79cb7b5f94401bb0cf07f670752735a9ebfb657e310d6
SSDEEP 3072:WlzBB7yWBbHS8Rf4Ug3GCaF+2fek969rGrWxOXrD910n9i2rliNxLCxXSLtv2xE4:WlzBlyu7Svkxp66rrNAiNxLWSLhzHfJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 480cff5041942adf566b7db2a6f425d86ef3e3a09f221ea99f930f264b85524e
MD5 d8c5a4948f9eb6cab11be864bde6bc53
SHA1 30b3cfbfa98f613cf197735641d9f4ec068b523b
SHA512 b19487e4a8387faba31c36a217e2dd8d49001213d6fec2ad23473a342e232da28e146a5ce88da1366326be7e795b11a2ec8ca1019879870e8733909b3de45996
SSDEEP 6144:Wlx0Vx47ujwirBlyu7Svkxp66rrNAiNxLWSLhzHfJa:O4xaWmeLfrrNAiHLJLdHfJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 222KB
SHA256 c23d212b95e96eb54cacfdd78d530f91409a242708f9006c96d0ec9f41d79416
MD5 183f21cac329623ae32a1aae115549dd
SHA1 1153d1cdf16284d66259631eb2c1d166b1e184c3
SHA512 7352992a9207554423c61e0a846afefaa01986cc7cb6875fc47357f595ac826b5cfce7cdf3945da1d6101f2ed6a5ca2576741019df2b79dde2665b752769a656
SSDEEP 6144:Wl6nBlyu7Svkxp66rrNAiNxLWSLhzHfJa:OMmeLfrrNAiHLJLdHfJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 4839b5c66226453fa0483645cc8a824964e906c560fa5b2c3804508b1e6e4aa4
MD5 2fc80e11957f3066b37f1b2e5896c251
SHA1 6fb5579da60509a8707ca30a92e14cfa04a16b44
SHA512 a82cdd31c5c0d96317a78436e299643625e0926b667487734308e40e10b08e9abe9dc037e35b40a2da92fa71537e7301a87cf180094aaada24e343a181090e94
SSDEEP 49152:/vyI22SsaNYfdPBldt698dBcjH3TRJ6WbR3LoGdeTHHB72eh2NT:/vf22SsaNYfdPBldt6+dBcjH3TRJ6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-12-0x000000001B230000-0x000000001B280000-memory.dmp

Download

memory/1116-52-0x000000001C2A0000-0x000000001C7C8000-memory.dmp

Download

memory/1116-14-0x00007FF9DC840000-0x00007FF9DD301000-memory.dmp

Download

memory/1116-13-0x000000001B970000-0x000000001BA22000-memory.dmp

Download

memory/1116-11-0x00007FF9DC840000-0x00007FF9DD301000-memory.dmp

Download

memory/1116-9-0x00007FF9DC840000-0x00007FF9DD301000-memory.dmp

Download

memory/3400-0-0x00007FF9DC843000-0x00007FF9DC845000-memory.dmp

Download

memory/3400-10-0x00007FF9DC840000-0x00007FF9DD301000-memory.dmp

Download

memory/3400-2-0x00007FF9DC840000-0x00007FF9DD301000-memory.dmp

Download

memory/3400-1-0x0000000000CA0000-0x0000000000FC4000-memory.dmp

Download