quasar | hxxps://github[.]com/AJMartel/MeGa-RAT-Pack

System Information Discovery

persistence privilege_escalation

Processes:

Quasarx.exeQuasar Golden Editionx.exeQuasar Golden Edition.exeUpdater.exeUpdater.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Quasarx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Quasar Golden Editionx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Quasar Golden Edition.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Updater.exe

Executes dropped EXE 18 IoCs

Processes:

Quasarx.exeTiWorker.exeQuasar.exeFacebookCracker.exeJava Updater.exeQuasar.exeQuasar Golden Editionx.exeQuasar Golden Edition.exedotNET_Reactor.Console.exedotNET_Reactor.exempress.exesad.exeUpdater.exeUpdater.exeUpdater.exesad.exeUpdater.exeUpdater.exe

pid	process
3764	Quasarx.exe
5308	TiWorker.exe
5488	Quasar.exe
5700	FacebookCracker.exe
4812	Java Updater.exe
5664	Quasar.exe
5668	Quasar Golden Editionx.exe
5880	Quasar Golden Edition.exe
5188	dotNET_Reactor.Console.exe
3152	dotNET_Reactor.exe
3436	mpress.exe
4832	sad.exe
6112	Updater.exe
5644	Updater.exe
2652	Updater.exe
888	sad.exe
6016	Updater.exe
5288	Updater.exe

Loads dropped DLL 2 IoCs

Processes:

dotNET_Reactor.exe

pid process

3152 dotNET_Reactor.exe
3152 dotNET_Reactor.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
3152	dotNET_Reactor.exe
3152	dotNET_Reactor.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Updater.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Updater.exe\""	Updater.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
defense_evasion

Clear Persistence
T1070.009

Processes:

cmd.exe

pid process

5724 cmd.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

67 raw.githubusercontent.com
68 raw.githubusercontent.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

114 ip-api.com
226 ip-api.com
300 ip-api.com

pid	process
5724	cmd.exe

flow	ioc
67	raw.githubusercontent.com
68	raw.githubusercontent.com

flow	ioc
114	ip-api.com
226	ip-api.com
300	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasarx.exe	autoit_exe
C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Quasar Golden Editionx.exe	autoit_exe

Drops file in System32 directory 6 IoCs

Processes:

Quasarx.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TiWorker.exe	Quasarx.exe
File opened for modification	C:\Windows\SysWOW64\TiWorker.exe	Quasarx.exe
File created	C:\Windows\SysWOW64\config.json	Quasarx.exe
File opened for modification	C:\Windows\SysWOW64\config.json	Quasarx.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.xml	Quasarx.exe
File opened for modification	C:\Windows\SysWOW64\MicrosoftWindows.xml	Quasarx.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\899d799e-8ec8-4290-90ac-056cdf016fb7.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241125055617.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

dotNET_Reactor.execsc.execvtres.exempress.exeFacebookCracker.exeschtasks.exeJava Updater.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotNET_Reactor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mpress.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FacebookCracker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Java Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

5432 ipconfig.exe
4384 ipconfig.exe

pid	process
5432	ipconfig.exe
4384	ipconfig.exe

Modifies registry class 64 IoCs

Processes:

Quasar Golden Edition.exeQuasar.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e8005398e082303024b98265d99428e115f0000	Quasar Golden Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Quasar Golden Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Quasar Golden Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "4"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\NodeSlot = "7"	Quasar Golden Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar Golden Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar Golden Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1	Quasar Golden Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar Golden Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar Golden Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar Golden Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Quasar Golden Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar Golden Edition.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5104	schtasks.exe
944	schtasks.exe
4628	schtasks.exe
5776	schtasks.exe
772	schtasks.exe
4576	schtasks.exe
5784	schtasks.exe
4492	schtasks.exe
3244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeQuasarx.exemsedge.exeJava Updater.exe

pid	process
4560	msedge.exe
4560	msedge.exe
416	msedge.exe
416	msedge.exe
3448	identity_helper.exe
3448	identity_helper.exe
5692	msedge.exe
5692	msedge.exe
3764	Quasarx.exe
3764	Quasarx.exe
3764	Quasarx.exe
3764	Quasarx.exe
3764	Quasarx.exe
3764	Quasarx.exe
3764	Quasarx.exe
3764	Quasarx.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe
4812	Java Updater.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

Quasar.exeQuasar.exeQuasar Golden Edition.exeJava Updater.exe

pid process

5488 Quasar.exe
5664 Quasar.exe
5880 Quasar Golden Edition.exe
4812 Java Updater.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid process

416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe
416 msedge.exe

pid	process
5488	Quasar.exe
5664	Quasar.exe
5880	Quasar Golden Edition.exe
4812	Java Updater.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

7zG.exeTiWorker.exeFacebookCracker.exeJava Updater.exeQuasar.exetaskmgr.exeQuasar.exe7zG.exesad.exeUpdater.exeQuasar Golden Edition.exeAUDIODG.EXEsad.exeUpdater.exe

description	pid	process
Token: SeRestorePrivilege	2836	7zG.exe
Token: 35	2836	7zG.exe
Token: SeSecurityPrivilege	2836	7zG.exe
Token: SeSecurityPrivilege	2836	7zG.exe
Token: SeLockMemoryPrivilege	5308	TiWorker.exe
Token: SeDebugPrivilege	5700	FacebookCracker.exe
Token: SeDebugPrivilege	4812	Java Updater.exe
Token: SeDebugPrivilege	5488	Quasar.exe
Token: SeDebugPrivilege	5480	taskmgr.exe
Token: SeSystemProfilePrivilege	5480	taskmgr.exe
Token: SeCreateGlobalPrivilege	5480	taskmgr.exe
Token: 33	5480	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5480	taskmgr.exe
Token: SeDebugPrivilege	5664	Quasar.exe
Token: SeRestorePrivilege	5500	7zG.exe
Token: 35	5500	7zG.exe
Token: SeSecurityPrivilege	5500	7zG.exe
Token: SeSecurityPrivilege	5500	7zG.exe
Token: SeDebugPrivilege	4832	sad.exe
Token: SeDebugPrivilege	6112	Updater.exe
Token: SeDebugPrivilege	5880	Quasar Golden Edition.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: SeSecurityPrivilege	6112	Updater.exe
Token: SeBackupPrivilege	6112	Updater.exe
Token: 33	5728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5728	AUDIODG.EXE
Token: SeDebugPrivilege	888	sad.exe
Token: SeDebugPrivilege	5288	Updater.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exeQuasar.exetaskmgr.exe

pid	process
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
2836	7zG.exe
5488	Quasar.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeQuasar.exetaskmgr.exe

pid	process
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
416	msedge.exe
5488	Quasar.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe
5480	taskmgr.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

Quasarx.exeQuasar.exeJava Updater.exeQuasar.exeQuasar Golden Editionx.exeQuasar Golden Edition.execsc.exeUpdater.exeUpdater.exe

pid	process
3764	Quasarx.exe
5488	Quasar.exe
4812	Java Updater.exe
5488	Quasar.exe
5488	Quasar.exe
5488	Quasar.exe
5488	Quasar.exe
5664	Quasar.exe
5664	Quasar.exe
5664	Quasar.exe
5664	Quasar.exe
5668	Quasar Golden Editionx.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
1152	csc.exe
6112	Updater.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5880	Quasar Golden Edition.exe
5288	Updater.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 416 wrote to memory of 3588	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3588	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 3724	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4560	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4560	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe
PID 416 wrote to memory of 4408	416	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/AJMartel/MeGa-RAT-Pack
1⤵
- Quasar RAT
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb1b8246f8,0x7ffb1b824708,0x7ffb1b824718
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7e4995460,0x7ff7e4995470,0x7ff7e4995480
    3⤵
    PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15379030436771262577,15419745765688019151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3032 /prefetch:3
  2⤵
  PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5964

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap26543:112:7zEvent32666
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2836

C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasarx.exe
"C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasarx.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit
  2⤵
  PID:1156
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:5792
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "WindowsUpdate"
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5724
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WindowsUpdate" /F
    3⤵
    PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  PID:5968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  PID:1348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
  2⤵
  PID:5124
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
  2⤵
  PID:6084
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"
    3⤵
    PID:5224
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit
  2⤵
  PID:5400
- - C:\Windows\system32\certutil.exe
    certutil –addstore –f root MicrosoftWindows.crt
    3⤵
    PID:5436
- C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasar.exe
  "C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasar.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5488

C:\Windows\SysWOW64\TiWorker.exe
"C:\Windows\SysWOW64\TiWorker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5240
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:5432

C:\Users\Admin\Desktop\FacebookCracker.exe
"C:\Users\Admin\Desktop\FacebookCracker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5700
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\Desktop\FacebookCracker.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5104
- C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4812
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:944

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5480

C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasar.exe
"C:\Users\Admin\Desktop\Quasar 1.3 modified by Deos\Quasar.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5664

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap31963:116:7zEvent27427
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5500

C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Quasar Golden Editionx.exe
"C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Quasar Golden Editionx.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5668
- C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Quasar Golden Edition.exe
  "C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Quasar Golden Edition.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5880
- - C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.Console.exe
    "C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.Console.exe" -q -control_flow_obfuscation 1 -flow_level 6 -obfuscate_public_types 1 -obfuscation 1 -stringencryption 1 -exclude_serializable_types 1 -exclude_methods 1 -file "C:\Users\Admin\Desktop\sad.exe" -targetfile "C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\tmp\tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:5188
  - - C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.exe
      "C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\dotNET_Reactor.exe" "-q" "-control_flow_obfuscation" "1" "-flow_level" "6" "-obfuscate_public_types" "1" "-obfuscation" "1" "-stringencryption" "1" "-exclude_serializable_types" "1" "-exclude_methods" "1" "-file" "C:\Users\Admin\Desktop\sad.exe" "-targetfile" "C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\tmp\tmp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3152
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\trv33glf\trv33glf.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1152
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF44.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7F08C729242B4CF79A7FFA4B277769EA.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
- - C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\mpress.exe
    "C:\Users\Admin\Desktop\Quasar Golden Edition 1.4.1.0\Include\mpress.exe" -q "C:\Users\Admin\Desktop\sad.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3436

C:\Users\Admin\Desktop\sad.exe
"C:\Users\Admin\Desktop\sad.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Updater" /sc ONLOGON /tr "C:\Users\Admin\Desktop\sad.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4628
- C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6112
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe" /sc MINUTE /MO 1
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /K
    3⤵
    PID:5464
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4628
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:4384

C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"
1⤵
- Executes dropped EXE
PID:5644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"
1⤵
- Executes dropped EXE
PID:2652

C:\Users\Admin\Desktop\sad.exe
"C:\Users\Admin\Desktop\sad.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Updater" /sc ONLOGON /tr "C:\Users\Admin\Desktop\sad.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5784
- C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5288
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4492
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe" /sc MINUTE /MO 1
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:772

C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"
1⤵
- Executes dropped EXE
PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery