quasar | hxxps://gofile[.]io/d/8XPtY5

Analysis

max time kernel
553s
max time network
570s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-09-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/8XPtY5

Score

10^/10

quasar kakaa3123 defense_evasion discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

kakaa3123

192.168.2.20:4782

Mutex

4ff78f1c-5300-448a-97ab-142b1e64569e

Attributes

encryption_key
FEA9E0C3CFDA046F3213398E2016024F95FA226E
install_name
Horizon.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002ab2f-161.dat	family_quasar
behavioral1/memory/5148-197-0x00000000007D0000-0x0000000000AF4000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
5148	Client-built.exe
5272	Horizon.exe
4376	Client-built.exe
3612	Client-built.exe
2764	Client-built.exe
5128	Client-built.exe
2200	Client-built.exe
1352	Client-built.exe
3264	Client-built.exe
2760	Client-built.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	Horizon.exe
File created	C:\Windows\system32\SubDir\Horizon.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Horizon.exe	Client-built.exe
File created	C:\Windows\System32\SubDir\Horizon.exe\:SmartScreen:$DATA	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Horizon.exe	Horizon.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 282865.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5924	schtasks.exe
3928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
5276	msedge.exe
5276	msedge.exe
572	msedge.exe
572	msedge.exe
2800	identity_helper.exe
2800	identity_helper.exe
1500	msedge.exe
1500	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	Client-built.exe
Token: SeDebugPrivilege	5272	Horizon.exe
Token: SeDebugPrivilege	4376	Client-built.exe
Token: SeDebugPrivilege	3612	Client-built.exe
Token: SeDebugPrivilege	2764	Client-built.exe
Token: SeDebugPrivilege	5128	Client-built.exe
Token: SeDebugPrivilege	2200	Client-built.exe
Token: SeDebugPrivilege	1352	Client-built.exe
Token: SeDebugPrivilege	3264	Client-built.exe
Token: SeDebugPrivilege	2760	Client-built.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5272	Horizon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5276 wrote to memory of 5348	5276	msedge.exe	79
PID 5276 wrote to memory of 5348	5276	msedge.exe	79
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 5692	5276	msedge.exe	80
PID 5276 wrote to memory of 2256	5276	msedge.exe	81
PID 5276 wrote to memory of 2256	5276	msedge.exe	81
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82
PID 5276 wrote to memory of 5360	5276	msedge.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/8XPtY5
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa5ca33cb8,0x7ffa5ca33cc8,0x7ffa5ca33cd8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5148
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Horizon.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3928
- - C:\Windows\system32\SubDir\Horizon.exe
    "C:\Windows\system32\SubDir\Horizon.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5272
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Horizon.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12104519861128543486,16259848979987949884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2412

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c32b6fc873c040253034fe4bf5037bd0

SHA1
fc58579eb5bf46c8d5246a45abae3566898c2e27

SHA256
8d59014ec29aebf56b641a018b29b6c64e33764d7a2262283ce51319071f930c

SHA512
e8ba0e9e78bc58b3d6d671a1e693cbe81745f000daaf281cc6aa6c591ae261b981f704e3dcb32f0fef87424aab0f42e4cfe40e445d8ef5a529c7bfda8ac510f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f74f80cd052dc4903da98dd6916f375d

SHA1
3e3512884ee41291824b30b256670b3d0a1c8d40

SHA256
d9589878daebff7c0991b2007a7af982f4760512545b4e331708f3f3308447ac

SHA512
bd186699a85c91cda88df15ebee640f99b55ff168e228dd0de8d7416d62de1bcb57e88beb3b12ce74a54a9c7491934ef3dd5fdd6b92ab5c909f129b419d96b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2f16949607102c8f0e37abb60ac77165

SHA1
89c0078ecfdc0aa4997a9faf93fa4e751dcde91c

SHA256
4adf1f023338909410f3c6526ccdaae91b9a9a17a9adb5afb1a5b339a3bcb07a

SHA512
b2ea1948c25750c4a451a3b3d5e8ece89cd0ba3cfca2e54c15cf000248c29ec9e607a32106b695af7ae59044539666a300c24d26c8b81d1723e13565f61511bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
80a309c621e867de09946d291687d1d3

SHA1
d7f155baddb91b1c5ef5b5ff4a368acf9fd1a298

SHA256
0b08b17ae9ecfb58947f3003ad7e241711a5b584ecee380619ba906b72c6a590

SHA512
ab60f17ecc8cbe576376c42e00e6c6b75090334baefad866cdd2ab2d01eecf2ffadf512ef9f18bb8ce0c297adb0f99a1256b2adda28ceb78c33a80d1b52645fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
540a14a7ea94fe1f222db10afd6efccf

SHA1
a7db363b3f2c6ea17185c85a1c4e80b951dfc543

SHA256
ce4badd5317194fd0f333aa2c16ff81be14f4c4bbabb90e33ecd05940541cc52

SHA512
7c9c03faf0339c871d37f9ac9cfa4dfecf39d1278550a422e1fd092cd2cef6577df766a3efb4fc2ec02eaef293d8932bdb30ba8fea76b101b4bdebef8046c203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9284310c6ac7319b5e624cba82fb2a2

SHA1
97e8940f72962aaabdc87255e6472a7d8a85cea1

SHA256
47636ba754989577dd4813d4681c1ee4d81ee413e06d12a104e605ad9618fc4c

SHA512
47268c46fc050df0a945885f5df8f7426056861ae00440cd2fc9faccec3d27ee3a0c599eda485ab0b8254d73718de40b91b716e0edb9de8c7be3c0bd2a4cab32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d98c3d67c5320417b0abdfb32480120d

SHA1
6dbb35a2661b5a2c5f6f804943384ccbeac7325c

SHA256
e58f65d10841e9e4abca6773b064b7a5e1b9ed529e6bcc9d11fcb35623fd44e0

SHA512
ecfaa26fb466a6d8acc4d05358233d456306ce1762d718d2a82f36525b1c5c7e68458dc49e33609845d949e90f57a7221ae7b1546abcf1e673b3595486debd4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
5c3d7765ba43bd1edee4b831682a4b15

SHA1
85b74a85860b724221380ac36104c4cee5ed4b38

SHA256
c5f1bd264450e4e5abbc92baa64264e8621ffc3dc7ffe360145958651635b186

SHA512
9e6977b042efa5eb699dcd81cb8246309dc51e89b4e90ad752d4dbafba629c2f55813da36959e4489cae1f738f28c9e1bb976bc030b34e0c956a7656defeadf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
4780649e4d39ca5dfe73228c6f5a1450

SHA1
795b6ab2549fcdf97561983a202798bf2c4f5346

SHA256
18fea3a12c5fb8a087712960d5c1d9a5a4904936c1c0cbe8784ce482a7c2946b

SHA512
5688c84830220a9463562e2f26c9e4bb1e5ef318550cfefe2c257e2cd6ae71bda8982062d7de788d66bf5aed8e0c22a6380d51e6357cf7ba9772a5f556974917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583786.TMP

Filesize
362B

MD5
6652e8dad5e7dcec9ba13315de4bce56

SHA1
57f442d7e40086aef09d62a8e884b003b6b0e151

SHA256
a7446b025d3efd95d1d15284243961e0753c73e2dc1edadcab915047d1bf8d36

SHA512
c740bb2cc970dc04575c218c95576bd5817444a07606fca1b7cc40edb76b54895ad539de22d4f52b221442d1d43a9488b1767b02b4b69e16c4a1110615a5c115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c67919f937a2f5e6eca6666cb7d20595

SHA1
b3c757e2f26cd495e1ebc9e58838eda6c7712676

SHA256
ca89a8d3a6bc03a2b3c22685b86cc8cc4e9e192c600c659b17203b09b36c8dc5

SHA512
093ac1cc59d8defb8bc6ce0c2dbceef21e2d323c2b401f640a63cf26bc2704d090579f5f33798770463a630597e4682747ca1e14a62c07107cba8f4ea6861f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62f190c392dc33370ae7aaef881d2932

SHA1
d9574f3ff1f4e0a616d977319ec6e42593af419e

SHA256
24bd63f7c9ccc3fdb756cbaad2cf542fe025dd6eda0b4c3526ee00aa31158f5b

SHA512
313f1e04a80084e733a4870488883ab30fb8c2570b2c56138561f82b332d720ec76032967f8086819f1b18b34c0b1203e159b409fa6b381d3f60a8f0a2ccd3f0

Download Submit
C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 282865.crdownload

Filesize
3.1MB

MD5
a252cba8fb38a64cb86d93c0344039fa

SHA1
cdf4fcb104123730d40018bd69fcbc30d2ea329c

SHA256
5392b6fdf61e362395749116a8bcc5f8227a56dc32e91348a1354a96a47b6a64

SHA512
c8f61b4ee865258dccb581f9e9c777b885ad233bcdfb5988299e03d98ff41bb0f2342a6ae4e819c8e5ea9a01f3f19308a404de8b2dc314741f1795bc22b9aace

Download Submit
memory/5148-197-0x00000000007D0000-0x0000000000AF4000-memory.dmp

Filesize
3.1MB

Download
memory/5272-205-0x000000001C690000-0x000000001C6E0000-memory.dmp

Filesize
320KB

Download
memory/5272-206-0x000000001C7A0000-0x000000001C852000-memory.dmp

Filesize
712KB

Download