Overview
overview
10Static
static
10Quasar.v1.4.1.zip
windows7-x64
1Quasar.v1.4.1.zip
windows10-2004-x64
10Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....e.html
windows7-x64
3Quasar v1....e.html
windows10-2004-x64
3Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....to.dll
windows7-x64
1Quasar v1....to.dll
windows10-2004-x64
1Quasar v1....ok.dll
windows7-x64
1Quasar v1....ok.dll
windows10-2004-x64
1Quasar v1.4.1/LICENSE
windows7-x64
1Quasar v1.4.1/LICENSE
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
1Quasar v1....ks.dll
windows7-x64
1Quasar v1....ks.dll
windows10-2004-x64
1Quasar v1....il.dll
windows7-x64
1Quasar v1....il.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 21:47
Behavioral task
behavioral1
Sample
Quasar.v1.4.1.zip
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
Quasar.v1.4.1.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Quasar v1.4.1/3rdPartyLicenses/Be.HexEditor_license.txt
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
Quasar v1.4.1/3rdPartyLicenses/Be.HexEditor_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Quasar v1.4.1/3rdPartyLicenses/GlobalMouseKeyHook_license.txt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Quasar v1.4.1/3rdPartyLicenses/GlobalMouseKeyHook_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Quasar v1.4.1/3rdPartyLicenses/Mono.Cecil_license.txt
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
Quasar v1.4.1/3rdPartyLicenses/Mono.Cecil_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Quasar v1.4.1/3rdPartyLicenses/Open.Nat_license.txt
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
Quasar v1.4.1/3rdPartyLicenses/Open.Nat_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Quasar v1.4.1/3rdPartyLicenses/ResourceLib_license.txt
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
Quasar v1.4.1/3rdPartyLicenses/ResourceLib_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Quasar v1.4.1/3rdPartyLicenses/SilkIcons_license.txt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Quasar v1.4.1/3rdPartyLicenses/SilkIcons_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Quasar v1.4.1/3rdPartyLicenses/protobuf-net_license.txt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Quasar v1.4.1/3rdPartyLicenses/protobuf-net_license.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Quasar v1.4.1/LICENSE
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Quasar v1.4.1/LICENSE
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Quasar.v1.4.1.zip
-
Size
3.3MB
-
MD5
13aa4bf4f5ed1ac503c69470b1ede5c1
-
SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
-
SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
-
SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
SSDEEP
49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
Malware Config
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000a000000023b79-4.dat family_quasar behavioral2/memory/5032-13-0x000001D900580000-0x000001D9006B8000-memory.dmp family_quasar -
Executes dropped EXE 35 IoCs
Processes:
Quasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exepid Process 5032 Quasar.exe 4856 Quasar.exe 2056 Quasar.exe 3080 Quasar.exe 1688 Quasar.exe 4640 Quasar.exe 2816 Quasar.exe 2380 Quasar.exe 544 Quasar.exe 5112 Quasar.exe 2280 Quasar.exe 5032 Quasar.exe 1308 Quasar.exe 736 Quasar.exe 4464 Quasar.exe 3080 Quasar.exe 3948 Quasar.exe 4184 Quasar.exe 4620 Quasar.exe 2708 Quasar.exe 1248 Quasar.exe 3464 Quasar.exe 4648 Quasar.exe 4772 Quasar.exe 4424 Quasar.exe 1268 Quasar.exe 3164 Quasar.exe 1052 Quasar.exe 392 Quasar.exe 2812 Quasar.exe 4392 Quasar.exe 1516 Quasar.exe 1500 Quasar.exe 4928 Quasar.exe 5112 Quasar.exe -
Modifies registry class 1 IoCs
Processes:
7zFM.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 7zFM.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 4732 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7zFM.exepid Process 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid Process 2672 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7zFM.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exeQuasar.exedescription pid Process Token: SeRestorePrivilege 2672 7zFM.exe Token: 35 2672 7zFM.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 5032 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4856 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 2056 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 3080 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 1688 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4640 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 2816 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 2380 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 544 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 5112 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 2280 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 5032 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 1308 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 736 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4464 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 3080 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 3948 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4184 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4620 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 2708 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 1248 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 3464 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4648 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4772 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4424 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 1268 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 3164 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 1052 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 392 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 2812 Quasar.exe Token: SeSecurityPrivilege 2672 7zFM.exe Token: SeDebugPrivilege 4392 Quasar.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
7zFM.exepid Process 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe 2672 7zFM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7zFM.exedescription pid Process procid_target PID 2672 wrote to memory of 5032 2672 7zFM.exe 89 PID 2672 wrote to memory of 5032 2672 7zFM.exe 89 PID 2672 wrote to memory of 4856 2672 7zFM.exe 95 PID 2672 wrote to memory of 4856 2672 7zFM.exe 95 PID 2672 wrote to memory of 2056 2672 7zFM.exe 99 PID 2672 wrote to memory of 2056 2672 7zFM.exe 99 PID 2672 wrote to memory of 3080 2672 7zFM.exe 102 PID 2672 wrote to memory of 3080 2672 7zFM.exe 102 PID 2672 wrote to memory of 1688 2672 7zFM.exe 105 PID 2672 wrote to memory of 1688 2672 7zFM.exe 105 PID 2672 wrote to memory of 4640 2672 7zFM.exe 108 PID 2672 wrote to memory of 4640 2672 7zFM.exe 108 PID 2672 wrote to memory of 2816 2672 7zFM.exe 111 PID 2672 wrote to memory of 2816 2672 7zFM.exe 111 PID 2672 wrote to memory of 2380 2672 7zFM.exe 114 PID 2672 wrote to memory of 2380 2672 7zFM.exe 114 PID 2672 wrote to memory of 544 2672 7zFM.exe 117 PID 2672 wrote to memory of 544 2672 7zFM.exe 117 PID 2672 wrote to memory of 5112 2672 7zFM.exe 120 PID 2672 wrote to memory of 5112 2672 7zFM.exe 120 PID 2672 wrote to memory of 2280 2672 7zFM.exe 123 PID 2672 wrote to memory of 2280 2672 7zFM.exe 123 PID 2672 wrote to memory of 5032 2672 7zFM.exe 126 PID 2672 wrote to memory of 5032 2672 7zFM.exe 126 PID 2672 wrote to memory of 1308 2672 7zFM.exe 129 PID 2672 wrote to memory of 1308 2672 7zFM.exe 129 PID 2672 wrote to memory of 736 2672 7zFM.exe 132 PID 2672 wrote to memory of 736 2672 7zFM.exe 132 PID 2672 wrote to memory of 4464 2672 7zFM.exe 135 PID 2672 wrote to memory of 4464 2672 7zFM.exe 135 PID 2672 wrote to memory of 3080 2672 7zFM.exe 138 PID 2672 wrote to memory of 3080 2672 7zFM.exe 138 PID 2672 wrote to memory of 3948 2672 7zFM.exe 141 PID 2672 wrote to memory of 3948 2672 7zFM.exe 141 PID 2672 wrote to memory of 4184 2672 7zFM.exe 144 PID 2672 wrote to memory of 4184 2672 7zFM.exe 144 PID 2672 wrote to memory of 4620 2672 7zFM.exe 147 PID 2672 wrote to memory of 4620 2672 7zFM.exe 147 PID 2672 wrote to memory of 2708 2672 7zFM.exe 150 PID 2672 wrote to memory of 2708 2672 7zFM.exe 150 PID 2672 wrote to memory of 1248 2672 7zFM.exe 153 PID 2672 wrote to memory of 1248 2672 7zFM.exe 153 PID 2672 wrote to memory of 3464 2672 7zFM.exe 156 PID 2672 wrote to memory of 3464 2672 7zFM.exe 156 PID 2672 wrote to memory of 4648 2672 7zFM.exe 159 PID 2672 wrote to memory of 4648 2672 7zFM.exe 159 PID 2672 wrote to memory of 4772 2672 7zFM.exe 162 PID 2672 wrote to memory of 4772 2672 7zFM.exe 162 PID 2672 wrote to memory of 4424 2672 7zFM.exe 165 PID 2672 wrote to memory of 4424 2672 7zFM.exe 165 PID 2672 wrote to memory of 1268 2672 7zFM.exe 168 PID 2672 wrote to memory of 1268 2672 7zFM.exe 168 PID 2672 wrote to memory of 3164 2672 7zFM.exe 171 PID 2672 wrote to memory of 3164 2672 7zFM.exe 171 PID 2672 wrote to memory of 1052 2672 7zFM.exe 174 PID 2672 wrote to memory of 1052 2672 7zFM.exe 174 PID 2672 wrote to memory of 392 2672 7zFM.exe 177 PID 2672 wrote to memory of 392 2672 7zFM.exe 177 PID 2672 wrote to memory of 2812 2672 7zFM.exe 180 PID 2672 wrote to memory of 2812 2672 7zFM.exe 180 PID 2672 wrote to memory of 4392 2672 7zFM.exe 183 PID 2672 wrote to memory of 4392 2672 7zFM.exe 183 PID 2672 wrote to memory of 1516 2672 7zFM.exe 186 PID 2672 wrote to memory of 1516 2672 7zFM.exe 186
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Quasar.v1.4.1.zip"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7zO07ACDA18\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07ACDA18\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A20178\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A20178\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AD6368\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AD6368\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A08C68\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A08C68\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AA3B68\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AA3B68\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A05968\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A05968\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A6E758\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A6E758\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AC1458\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AC1458\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A15258\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A15258\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A7F058\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A7F058\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AD1158\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AD1158\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A26F58\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A26F58\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A8FD58\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A8FD58\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AE1A58\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AE1A58\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AEB958\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AEB958\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A5C748\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A5C748\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A9DED8\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A9DED8\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A98CC8\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A98CC8\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AF3DC8\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AF3DC8\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A47BC8\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A47BC8\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A949C8\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A949C8\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AD4739\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AD4739\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A3E539\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A3E539\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A82239\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A82239\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AE4039\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AE4039\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A6BC39\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A6BC39\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A0C839\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A0C839\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A68429\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A68429\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A5C329\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A5C329\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:392
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A78129\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A78129\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AABF29\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AABF29\Quasar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07AB1D29\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07AB1D29\Quasar.exe"2⤵
- Executes dropped EXE
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A46929\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A46929\Quasar.exe"2⤵
- Executes dropped EXE
PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A24419\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A24419\Quasar.exe"2⤵
- Executes dropped EXE
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\7zO07A2D319\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\7zO07A2D319\Quasar.exe"2⤵
- Executes dropped EXE
PID:5112
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO07A1F269\version.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4732
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD512ebf922aa80d13f8887e4c8c5e7be83
SHA17f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA25643315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275