quasar | 3b3900adf2232fb5a995c9f6884feededfbe4a862a076ac3af936e4b5a858887

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

96dbf079644fad007ddee4a898bdb096
SHA1

3eec62ed768ce4a1181f00a0dd6cca3564e1f9f1
SHA256

3b3900adf2232fb5a995c9f6884feededfbe4a862a076ac3af936e4b5a858887
SHA512

356a13c7ab5bb02ee79a2ff9525f0f8ca832302fba37cf140af8264d31933a00745b59d7f742a42ef0576964f6e112580430996ac068f63c4112907c69471385
SSDEEP

49152:KvDI22SsaNYfdPBldt698dBcjHEpSu1J/goGdXTHHB72eh2NT:Kv822SsaNYfdPBldt6+dBcjHEpSJ

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.0.102:4782

Mutex

a84f48f3-00c9-414a-a093-49d616e432d3

Attributes

encryption_key
D440572F816847D4B5AD6EAA65627B5DFFF00151
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2208-1-0x0000000000810000-0x0000000000B34000-memory.dmp	family_quasar
behavioral2/files/0x000c000000023b61-6.dat	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid	Process
4856	Client.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchProtocolHost.exeSearchFilterHost.exeSearchIndexer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039bcf31d1c2ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001364be1e1c2ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008645fd1d1c2ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000699fb91e1c2ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ce3fa1d1c2ddb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a421b81d1c2ddb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000201ff61d1c2ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004231281e1c2ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9cb441e1c2ddb01	SearchProtocolHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
1440	schtasks.exe
1868	schtasks.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

Client-built.exeClient.exeSearchIndexer.exe

description	pid	Process
Token: SeDebugPrivilege	2208	Client-built.exe
Token: SeDebugPrivilege	4856	Client.exe
Token: 33	4788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid	Process
4856	Client.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Client-built.exeClient.exeSearchIndexer.exe

description	pid	Process	procid_target
PID 2208 wrote to memory of 1868	2208	Client-built.exe	86
PID 2208 wrote to memory of 1868	2208	Client-built.exe	86
PID 2208 wrote to memory of 4856	2208	Client-built.exe	88
PID 2208 wrote to memory of 4856	2208	Client-built.exe	88
PID 4856 wrote to memory of 1440	4856	Client.exe	89
PID 4856 wrote to memory of 1440	4856	Client.exe	89
PID 4788 wrote to memory of 2376	4788	SearchIndexer.exe	108
PID 4788 wrote to memory of 2376	4788	SearchIndexer.exe	108
PID 4788 wrote to memory of 4568	4788	SearchIndexer.exe	109
PID 4788 wrote to memory of 4568	4788	SearchIndexer.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1868
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2376
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
96dbf079644fad007ddee4a898bdb096

SHA1
3eec62ed768ce4a1181f00a0dd6cca3564e1f9f1

SHA256
3b3900adf2232fb5a995c9f6884feededfbe4a862a076ac3af936e4b5a858887

SHA512
356a13c7ab5bb02ee79a2ff9525f0f8ca832302fba37cf140af8264d31933a00745b59d7f742a42ef0576964f6e112580430996ac068f63c4112907c69471385

Download Submit
memory/2208-0-0x00007FFEAA393000-0x00007FFEAA395000-memory.dmp

Filesize
8KB

Download
memory/2208-1-0x0000000000810000-0x0000000000B34000-memory.dmp

Filesize
3.1MB

Download
memory/2208-2-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

Filesize
10.8MB

Download
memory/2208-10-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

Filesize
10.8MB

Download
memory/4568-73-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-66-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-78-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-79-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-80-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-81-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-82-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-83-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-84-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-77-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-55-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-56-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-57-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-60-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-59-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-58-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-62-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-63-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-65-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-74-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-64-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-69-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-70-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-68-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-67-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-61-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-71-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-72-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-75-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4568-76-0x000002002C0F0000-0x000002002C100000-memory.dmp

Filesize
64KB

Download
memory/4788-53-0x000001FE912D0000-0x000001FE912D8000-memory.dmp

Filesize
32KB

Download
memory/4788-49-0x000001FE8E640000-0x000001FE8E648000-memory.dmp

Filesize
32KB

Download
memory/4788-34-0x000001FE8A160000-0x000001FE8A170000-memory.dmp

Filesize
64KB

Download
memory/4788-17-0x000001FE8A050000-0x000001FE8A060000-memory.dmp

Filesize
64KB

Download
memory/4856-9-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

Filesize
10.8MB

Download
memory/4856-11-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

Filesize
10.8MB

Download
memory/4856-15-0x000000001C900000-0x000000001CE28000-memory.dmp

Filesize
5.2MB

Download
memory/4856-14-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

Filesize
10.8MB

Download
memory/4856-13-0x000000001BFD0000-0x000000001C082000-memory.dmp

Filesize
712KB

Download
memory/4856-12-0x000000001B960000-0x000000001B9B0000-memory.dmp

Filesize
320KB

Download