Analysis

  • max time kernel
    76s
  • max time network
    168s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    04-11-2024 04:39

General

  • Target

    Roblox exploit 2024.7z

  • Size

    922KB

  • MD5

    b83419ff541c2f78be5921c4c150aa2f

  • SHA1

    2b0a73d56cf4af03d0b1eb51d7e2092f320972f0

  • SHA256

    0fa8e2b1073b28e1941150d9ff1651b4dfce15cb1a0ccdcd33d5caca3af20db0

  • SHA512

    d9faa15debc5bcae1d391f8cf6f713f2bf8996c64ca4b05f1bddb5f47a7c3980dbc5b784d4791f3a41739b8443fce6a224bcb7ee3654761698f02918b7c5f6a8

  • SSDEEP

    24576:uc92iZi0TVp6x0W7GjN59lfzlPRdAeqoeTy4x3kNp6k:um2iZnV8x0W+Npko0ny1

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Inversin-43597.portmap.host:43597

Mutex

80329fd2-f063-4b06-9c7e-8dbc6278c2a3

Attributes
  • encryption_key

    744EA1A385FEBC6DA96387411B7000D77E66B075

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    java updater

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Roblox exploit 2024.7z"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3108
  • C:\Users\Admin\Desktop\Client-built.exe
    "C:\Users\Admin\Desktop\Client-built.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1028
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3292
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\AddTest.rm"
        3⤵
          PID:4920
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
          3⤵
            PID:3712
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3712 CREDAT:17410 /prefetch:2
              4⤵
                PID:4980
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3712 CREDAT:148482 /prefetch:2
                4⤵
                  PID:2888
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\CheckpointEdit.inf
                3⤵
                • Opens file in notepad (likely ransom note)
                PID:1424
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\ConfirmRevoke.xsl
                3⤵
                  PID:1064
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:17410 /prefetch:2
                    4⤵
                      PID:1688
                  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\AppData\Roaming\ConfirmTrace.dotm"
                    3⤵
                      PID:3452
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\ConvertFromExit.css
                      3⤵
                      • Opens file in notepad (likely ransom note)
                      PID:452
                    • C:\Windows\system32\mspaint.exe
                      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\EditSend.wmf"
                      3⤵
                        PID:1204
                      • C:\Program Files\VideoLAN\VLC\vlc.exe
                        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\ExitUnblock.rm"
                        3⤵
                          PID:2804
                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\AppData\Roaming\ImportDisable.xltm"
                          3⤵
                            PID:5060
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\InstallMount.mhtml
                            3⤵
                              PID:1104
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffc43f746f8,0x7ffc43f74708,0x7ffc43f74718
                                4⤵
                                  PID:740
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,9908901234595581444,4367690020873171540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
                                  4⤵
                                    PID:1528
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,9908901234595581444,4367690020873171540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
                                    4⤵
                                      PID:1272
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,9908901234595581444,4367690020873171540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
                                      4⤵
                                        PID:4536
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                    PID:4664
                                  • C:\Windows\system32\OpenWith.exe
                                    C:\Windows\system32\OpenWith.exe -Embedding
                                    1⤵
                                      PID:2412
                                    • C:\Windows\system32\OpenWith.exe
                                      C:\Windows\system32\OpenWith.exe -Embedding
                                      1⤵
                                        PID:1084
                                      • C:\Windows\system32\OpenWith.exe
                                        C:\Windows\system32\OpenWith.exe -Embedding
                                        1⤵
                                          PID:3928
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                          1⤵
                                            PID:984
                                          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
                                            1⤵
                                              PID:3176
                                              • C:\Windows\SysWOW64\unregmp2.exe
                                                "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
                                                2⤵
                                                  PID:4736
                                                  • C:\Windows\system32\unregmp2.exe
                                                    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
                                                    3⤵
                                                      PID:5572
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                                                  1⤵
                                                    PID:5408

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    557df060b24d910f788843324c70707a

                                                    SHA1

                                                    e5d15be40f23484b3d9b77c19658adcb6e1da45c

                                                    SHA256

                                                    83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b

                                                    SHA512

                                                    78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{30F75644-9A67-11EF-8CBB-C6C8B2E6F645}.dat

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    d04164fee9cabcfada8e2dd0f0f638ed

                                                    SHA1

                                                    f0c2ddd394dfb2b79922d923a27a4eed32f50e17

                                                    SHA256

                                                    63da2f0ff20ad058afa4c7045b5b5998d59e8a0b2315c548b374d16851398010

                                                    SHA512

                                                    2a96cc1c1bcfaa610fa9b9efd0563c9c47863bfafd760dd9354bb34368543679d762568839096b850281069920576f5acaec2436057613b45518e92d19833475

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                    Filesize

                                                    512KB

                                                    MD5

                                                    946f3d332664c951e4220b6529c08cf4

                                                    SHA1

                                                    8cef2495aeb0b14c503c53fe51282e7bdfa487a1

                                                    SHA256

                                                    def03bbc743e3f1f8e1e7c235e05180fd3501857547d59eac77034bb17f54d16

                                                    SHA512

                                                    a6ed17d51b299c250d9b50385e5a0c7c35dc388062d3d448fd2d55a001928518fb18f84a38a692af85d8f4b40b5e3a767724a0060702c842ac0bf8f83f9a67bc

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\BEC75E29-4FE1-495B-B32C-81B0A1FC367A

                                                    Filesize

                                                    174KB

                                                    MD5

                                                    f8db7f09426ecc00ce324eaeecb2dff3

                                                    SHA1

                                                    bd6b1a22699861d429c051cef88afc614470d604

                                                    SHA256

                                                    d7610320553579e0e6674873feb1aa37fc0108037ae48dc22a1e408915c5647f

                                                    SHA512

                                                    b42349aea2965dccb3ba427fa3bdb9c080029e3123d6d0d9a9492ff6ee580bb731021d9ef1bbc224a63d7992bd0da516d0077a01fc6d6ec81b0959d2a75ca1c8

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

                                                    Filesize

                                                    9KB

                                                    MD5

                                                    7050d5ae8acfbe560fa11073fef8185d

                                                    SHA1

                                                    5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                    SHA256

                                                    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                    SHA512

                                                    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                  • C:\Users\Admin\Desktop\Client-built.exe

                                                    Filesize

                                                    3.1MB

                                                    MD5

                                                    f5b93af3ee1b64dacd2bac9ba4af9b27

                                                    SHA1

                                                    1f2a038199a71a2b917dca4dff2f5fac5e840978

                                                    SHA256

                                                    48d4fde21b28f0614fdf124f83f5594bddc13292f21b775da58b017385a49b01

                                                    SHA512

                                                    83703b0f567723abe3d6b34bd419be5df3475e049ae8893993fec017da9a420cd875184c570bdffbfc0bccac662762991885dea8ebcc2af172b3aac2fb00a302

                                                  • memory/2804-90-0x00007FF69C970000-0x00007FF69CA68000-memory.dmp

                                                    Filesize

                                                    992KB

                                                  • memory/2804-93-0x00007FFC51310000-0x00007FFC51328000-memory.dmp

                                                    Filesize

                                                    96KB

                                                  • memory/2804-91-0x00007FFC4A740000-0x00007FFC4A774000-memory.dmp

                                                    Filesize

                                                    208KB

                                                  • memory/3452-57-0x00007FFC27E90000-0x00007FFC27EA0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3452-58-0x00007FFC27E90000-0x00007FFC27EA0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3452-60-0x00007FFC27E90000-0x00007FFC27EA0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3452-61-0x00007FFC27E90000-0x00007FFC27EA0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3452-59-0x00007FFC27E90000-0x00007FFC27EA0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3452-62-0x00007FFC25BA0000-0x00007FFC25BB0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3452-63-0x00007FFC25BA0000-0x00007FFC25BB0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3644-14-0x000000001D160000-0x000000001D172000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/3644-10-0x000000001D110000-0x000000001D160000-memory.dmp

                                                    Filesize

                                                    320KB

                                                  • memory/3644-11-0x000000001D220000-0x000000001D2D2000-memory.dmp

                                                    Filesize

                                                    712KB

                                                  • memory/3644-15-0x000000001D1C0000-0x000000001D1FC000-memory.dmp

                                                    Filesize

                                                    240KB

                                                  • memory/4328-9-0x00007FFC49550000-0x00007FFC4A012000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/4328-4-0x00007FFC49553000-0x00007FFC49555000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/4328-5-0x0000000000410000-0x0000000000734000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                  • memory/4328-6-0x00007FFC49550000-0x00007FFC4A012000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/4920-29-0x00007FFC43AA0000-0x00007FFC43ABD000-memory.dmp

                                                    Filesize

                                                    116KB

                                                  • memory/4920-32-0x00007FFC3AA30000-0x00007FFC3BAE0000-memory.dmp

                                                    Filesize

                                                    16.7MB

                                                  • memory/4920-41-0x00007FFC43B70000-0x00007FFC43E26000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                  • memory/4920-50-0x00007FFC3AA30000-0x00007FFC3BAE0000-memory.dmp

                                                    Filesize

                                                    16.7MB

                                                  • memory/4920-33-0x00007FFC42EF0000-0x00007FFC42F31000-memory.dmp

                                                    Filesize

                                                    260KB

                                                  • memory/4920-37-0x00007FFC42D70000-0x00007FFC42D81000-memory.dmp

                                                    Filesize

                                                    68KB

                                                  • memory/4920-34-0x00007FFC42E50000-0x00007FFC42E71000-memory.dmp

                                                    Filesize

                                                    132KB

                                                  • memory/4920-35-0x00007FFC42E30000-0x00007FFC42E48000-memory.dmp

                                                    Filesize

                                                    96KB

                                                  • memory/4920-36-0x00007FFC42D90000-0x00007FFC42DA1000-memory.dmp

                                                    Filesize

                                                    68KB

                                                  • memory/4920-38-0x00007FFC417C0000-0x00007FFC417D1000-memory.dmp

                                                    Filesize

                                                    68KB

                                                  • memory/4920-23-0x00007FFC43B70000-0x00007FFC43E26000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                  • memory/4920-24-0x00007FFC51310000-0x00007FFC51328000-memory.dmp

                                                    Filesize

                                                    96KB

                                                  • memory/4920-79-0x00007FFC3AA30000-0x00007FFC3BAE0000-memory.dmp

                                                    Filesize

                                                    16.7MB

                                                  • memory/4920-25-0x00007FFC50060000-0x00007FFC50077000-memory.dmp

                                                    Filesize

                                                    92KB

                                                  • memory/4920-26-0x00007FFC43B00000-0x00007FFC43B11000-memory.dmp

                                                    Filesize

                                                    68KB

                                                  • memory/4920-27-0x00007FFC43AE0000-0x00007FFC43AF7000-memory.dmp

                                                    Filesize

                                                    92KB

                                                  • memory/4920-28-0x00007FFC43AC0000-0x00007FFC43AD1000-memory.dmp

                                                    Filesize

                                                    68KB

                                                  • memory/4920-30-0x00007FFC43A80000-0x00007FFC43A91000-memory.dmp

                                                    Filesize

                                                    68KB

                                                  • memory/4920-31-0x00007FFC43810000-0x00007FFC43A1B000-memory.dmp

                                                    Filesize

                                                    2.0MB

                                                  • memory/4920-21-0x00007FF69C970000-0x00007FF69CA68000-memory.dmp

                                                    Filesize

                                                    992KB

                                                  • memory/4920-22-0x00007FFC4A740000-0x00007FFC4A774000-memory.dmp

                                                    Filesize

                                                    208KB