quasar | f962beec9703a522fae680c30ec2b7bc44565e431128bc46d1410e476b564962

Analysis

max time kernel
51s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 16:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Lose2himatoBeta.exe
Size

135.3MB
MD5

15498caff53ec11af87a73319367838c
SHA1

4a45433a0a513119418ed44f4c475151a43ba923
SHA256

f962beec9703a522fae680c30ec2b7bc44565e431128bc46d1410e476b564962
SHA512

aaa86e7258f11329cf9853d4dec64e7b891dc139fc8dd1133e2229b0987494ad4191d9663cc3cf5c90a4a99e8ccca86171d8b3c12f09885ca751e4bdd2fc2430
SSDEEP

786432:zl5HNB9pAbrDMZBfPPgs9TFMd15DeSqVO0EQWW2IxEm+KoZd7APUF85n9wwTtLwd:J5HOsPfmZ0/EmREdEPUF85nSUgTX

Score

10^/10

quasar office04 defense_evasion discovery evasion ransomware spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

himato667-58401.portmap.host:58401

Mutex

0e2bc079-3316-407c-a26f-115195d9fe5b

Attributes

encryption_key
D14CC6B8490A41A48C1E115285B6932B9A857EA0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/1208-59-0x0000000000A50000-0x0000000000D74000-memory.dmp	family_quasar
behavioral1/files/0x000900000001da66-38.dat	family_quasar

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables Task Manager via registry modification
evasion

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
3964	cmd.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Lose2himatoBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 5 IoCs

pid	Process
1208	better.exe
3936	Client.exe
5920	Client.exe
3920	Client.exe
212	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	better.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	better.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MySingleFileApp\\wallpaper.bmp"	Lose2himatoBeta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lose2himatoBeta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3496	PING.EXE
3512	PING.EXE
1516	PING.EXE
5632	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "232"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{5C85767E-A658-4211-9542-52E108B380E8}	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
3512	PING.EXE
1516	PING.EXE
5632	PING.EXE
3496	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1632	schtasks.exe
1204	schtasks.exe
5700	schtasks.exe
5276	schtasks.exe
1624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
4304	msedge.exe
4304	msedge.exe
4808	msedge.exe
4808	msedge.exe
2076	msedge.exe
2076	msedge.exe
5348	identity_helper.exe
5348	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	better.exe
Token: SeDebugPrivilege	3936	Client.exe
Token: SeDebugPrivilege	5920	Client.exe
Token: SeShutdownPrivilege	6008	shutdown.exe
Token: SeRemoteShutdownPrivilege	6008	shutdown.exe
Token: SeDebugPrivilege	3920	Client.exe
Token: SeDebugPrivilege	212	Client.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
3936	Client.exe
4808	msedge.exe
5920	Client.exe
3920	Client.exe
212	Client.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
3936	Client.exe
5920	Client.exe
3920	Client.exe
212	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2396	4576	Lose2himatoBeta.exe	84
PID 4576 wrote to memory of 2396	4576	Lose2himatoBeta.exe	84
PID 4576 wrote to memory of 2396	4576	Lose2himatoBeta.exe	84
PID 4576 wrote to memory of 3468	4576	Lose2himatoBeta.exe	86
PID 4576 wrote to memory of 3468	4576	Lose2himatoBeta.exe	86
PID 4576 wrote to memory of 3468	4576	Lose2himatoBeta.exe	86
PID 4576 wrote to memory of 4416	4576	Lose2himatoBeta.exe	88
PID 4576 wrote to memory of 4416	4576	Lose2himatoBeta.exe	88
PID 4576 wrote to memory of 4416	4576	Lose2himatoBeta.exe	88
PID 2396 wrote to memory of 1672	2396	cmd.exe	89
PID 2396 wrote to memory of 1672	2396	cmd.exe	89
PID 2396 wrote to memory of 1672	2396	cmd.exe	89
PID 4576 wrote to memory of 3964	4576	Lose2himatoBeta.exe	91
PID 4576 wrote to memory of 3964	4576	Lose2himatoBeta.exe	91
PID 4576 wrote to memory of 3964	4576	Lose2himatoBeta.exe	91
PID 4576 wrote to memory of 3616	4576	Lose2himatoBeta.exe	93
PID 4576 wrote to memory of 3616	4576	Lose2himatoBeta.exe	93
PID 4576 wrote to memory of 3616	4576	Lose2himatoBeta.exe	93
PID 1672 wrote to memory of 1112	1672	net.exe	94
PID 1672 wrote to memory of 1112	1672	net.exe	94
PID 1672 wrote to memory of 1112	1672	net.exe	94
PID 4576 wrote to memory of 4772	4576	Lose2himatoBeta.exe	96
PID 4576 wrote to memory of 4772	4576	Lose2himatoBeta.exe	96
PID 4576 wrote to memory of 4772	4576	Lose2himatoBeta.exe	96
PID 4576 wrote to memory of 2216	4576	Lose2himatoBeta.exe	98
PID 4576 wrote to memory of 2216	4576	Lose2himatoBeta.exe	98
PID 4576 wrote to memory of 2216	4576	Lose2himatoBeta.exe	98
PID 4576 wrote to memory of 4444	4576	Lose2himatoBeta.exe	100
PID 4576 wrote to memory of 4444	4576	Lose2himatoBeta.exe	100
PID 4576 wrote to memory of 4444	4576	Lose2himatoBeta.exe	100
PID 4416 wrote to memory of 4212	4416	cmd.exe	101
PID 4416 wrote to memory of 4212	4416	cmd.exe	101
PID 4416 wrote to memory of 4212	4416	cmd.exe	101
PID 3964 wrote to memory of 2940	3964	cmd.exe	102
PID 3964 wrote to memory of 2940	3964	cmd.exe	102
PID 3964 wrote to memory of 2940	3964	cmd.exe	102
PID 4212 wrote to memory of 1212	4212	net.exe	104
PID 4212 wrote to memory of 1212	4212	net.exe	104
PID 4212 wrote to memory of 1212	4212	net.exe	104
PID 2940 wrote to memory of 2624	2940	net.exe	105
PID 2940 wrote to memory of 2624	2940	net.exe	105
PID 2940 wrote to memory of 2624	2940	net.exe	105
PID 3468 wrote to memory of 1004	3468	cmd.exe	106
PID 3468 wrote to memory of 1004	3468	cmd.exe	106
PID 3468 wrote to memory of 1004	3468	cmd.exe	106
PID 4576 wrote to memory of 1440	4576	Lose2himatoBeta.exe	107
PID 4576 wrote to memory of 1440	4576	Lose2himatoBeta.exe	107
PID 4576 wrote to memory of 1440	4576	Lose2himatoBeta.exe	107
PID 1004 wrote to memory of 3260	1004	net.exe	109
PID 1004 wrote to memory of 3260	1004	net.exe	109
PID 1004 wrote to memory of 3260	1004	net.exe	109
PID 4772 wrote to memory of 2680	4772	cmd.exe	110
PID 4772 wrote to memory of 2680	4772	cmd.exe	110
PID 4772 wrote to memory of 2680	4772	cmd.exe	110
PID 3616 wrote to memory of 2524	3616	cmd.exe	112
PID 3616 wrote to memory of 2524	3616	cmd.exe	112
PID 3616 wrote to memory of 2524	3616	cmd.exe	112
PID 4576 wrote to memory of 1208	4576	Lose2himatoBeta.exe	111
PID 4576 wrote to memory of 1208	4576	Lose2himatoBeta.exe	111
PID 4576 wrote to memory of 4740	4576	Lose2himatoBeta.exe	113
PID 4576 wrote to memory of 4740	4576	Lose2himatoBeta.exe	113
PID 4576 wrote to memory of 4740	4576	Lose2himatoBeta.exe	113
PID 2216 wrote to memory of 1248	2216	cmd.exe	115
PID 2216 wrote to memory of 1248	2216	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Lose2himatoBeta.exe
"C:\Users\Admin\AppData\Local\Temp\Lose2himatoBeta.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user OWN3DbyHXM4TO /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\net.exe
    net user OWN3DbyHXM4TO /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user OWN3DbyHXM4TO /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user OWN3DbyHXM4TO Test
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\net.exe
    net user OWN3DbyHXM4TO Test
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user OWN3DbyHXM4TO Test
      4⤵
      System Location Discovery: System Language Discovery
      PID:3260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "OWN3DbyHXM4TO" /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "OWN3DbyHXM4TO" /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "OWN3DbyHXM4TO" /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "%USERNAME%" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "Admin" /delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
      4⤵
      System Location Discovery: System Language Discovery
      PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4444
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1440
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860
- C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe
  "C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1632
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3936
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SYCzd0Oied1O.bat" "
      4⤵
      PID:4456
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:428
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3512
    - - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5920
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QocwK8nSU5Vt.bat" "
        6⤵
        
        PID:1160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1516
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3920
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E2hM3eW49QQl.bat" "
        8⤵
        
        PID:2076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5632
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\leHEASnJNFj8.bat" "
        10⤵
        
        PID:5072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://x.com/Lose2hxm4to
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://x.com/Lose2hxm4to
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc66046f8,0x7ffcc6604708,0x7ffcc6604718
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4232 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4092 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16139195816759131149,11222381491210944538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://discord.gg/8eGVMdaD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/8eGVMdaD
    3⤵
    PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcc66046f8,0x7ffcc6604708,0x7ffcc6604718
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1125420062008659689,360188587546735538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:60
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1125420062008659689,360188587546735538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c shutdown /r
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5856
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38a1855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
523a39a8c24fc4b3a4f20bc0036c42b4

SHA1
46e02efd543e5c2356ac92df4e8a81b76b2a94a8

SHA256
56006846ce13877ecf1debe46580fd884e4a6b8fe2fd7239536ba55cfbc61a9d

SHA512
526af94beaac73483128895d7de7324662245c4e2e304767ad7c68429c74311cdadd4d34b451e0fe6924463d2c7a36aae2d4d92e60b924736bc36169394bc3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3196ff69e40cc033be6583041999fb22

SHA1
c05b1bce113e4784a21f3a3e543e0a5fce24d6d0

SHA256
d339a32e25cc4039a7fba71608c55a3075249831438fd99e36605f5b1dfa16c6

SHA512
b5122f84a7d2e164b889514d45752fdc665507c87b0952f935dc340edab0872955264e8a46c1020a38a8298e00384df7fa25cdc2d8d2dc5d262cc1ff6d840496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
61de6bf8068aaa9eec684c96df759320

SHA1
121a2bd30a0321a2bdc8045ffa94d8e1a642479d

SHA256
edb49726d8427d9819391da970436e82d083c78773811c3bc53647f672b057b8

SHA512
aa9a6a71fed55ca677d573f3373ec7dacc10e5b9792c7c5966a29e59acfbb7fa7f22f81d0bc4f94050bab9d3a8c86458f83a4b3c93b9f435ef3f80d69b9b9919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dacb8407e4e757be1053625e3f5fe4b0

SHA1
66daae0a72680256fd48a913a486e41634a6be76

SHA256
c8e472772c242db5d3b4ce2dc048d3fc7841ae64151bba94eec01454ea8edd08

SHA512
4654121e49896f64f2d63f23914049f4fa75dc62cb1bcd749e956df1ef0a17dceaccda66ef2056595a0b63219eb3b4ec190fedf2b6a9e139a9300ff8b94ec7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c52c89e7051732118054a4e90dcca084

SHA1
fcd4b8f18474ea74a9a1afd430ffbf4fb103ef8f

SHA256
e0b94a795a8ca48ee30ab6acf35cdb8585da3fdf3fef13f9ff070c8b04463ddc

SHA512
a0cbc956d45b94ecfe1806d93216ee4bcd2e6f9ea6480d4f6b8df48f6c83481ddb44be02b88ccf95a2f0bc9d4ab9f56c56dfea272ebff44aafe4a2977cc50f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
32192f9a33af3f82a64546206f16b66b

SHA1
f7a733cf1b6aff46be11a560fa4752154e01e4e5

SHA256
0fdd063cf78fc0b1d5dcbab6c02805a37e81c5977d117e4c5229cde936073536

SHA512
12053854c46fa6396507e524436fde99eef9a11ad3853296a776993e6a514458bb5191ff14d464892b9e0b1f89c74772d4d6e2bf95326eefa88a22412dc7f621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f55c.TMP

Filesize
1KB

MD5
935dfd03a18e1b6bba263bb827b43061

SHA1
3c5e6a05d4f25c8f575ba4dfe2cb6f76dba64f60

SHA256
06fc2f1fc8027f3155b0235e83518d136d6626fca4b2c62dcca95b87ad0bcb09

SHA512
cb7cabefcd6a6d3342e301712a72c4fcc4e0d755f5e289ce17fae7cbdde5e1eecbca2f3c3c99d56f693757f3d30cba2eef94c3d0a6da4fd21a20111b675f3b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
add055154bef6b903ca6868de8634484

SHA1
517b09bd5736c51ac92808cbcb289abd1f8310be

SHA256
c019118d9deb5b3abf78440d817c43e705f9588562399a39ae30de67d5131077

SHA512
4ff0caaa229750d6b06b3ec070d8ea894c0b98db02a5854e1e57f918bd24953386b18ccfd8fc5bda1a130a152de57bb2a4808f5296cc8bd24d09612bdaa1a191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
012605cba310477a40a9f0d211016c8b

SHA1
b9ac8696bfa0d0d4519b457de02064445048fd0f

SHA256
d6f55adcfef3728f58b8ccf4376c438cb9d6f693185272ffd335f62a14f999e6

SHA512
62f7690f3fdeddd59767cc944f855e3bd27e381f499687d8fb7c59b92e9fb7c7eada619ec698fec032281852e584de44a420cfa464e9147b6dbdb63bc5819e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
044f6582e928bd6110bf0e18dadc0556

SHA1
71d843c0fa6d8e9e1c701a15beef3ff277368ee6

SHA256
47dad64b7659bc0a1df3dd721b4f1f42e1bd90f33cd494f6beb032a08a847c8e

SHA512
e90a883311d42325a3c74cf9161f13a809adbd955645f0d6cc29cb7af2a5492a65d3d3f3b9d7a6c1e4d4ddb0029375910ba857f17eee85271d995138395e0c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\E2hM3eW49QQl.bat

Filesize
196B

MD5
8f140e4e182a520b5e0b5139e1abc6a4

SHA1
6b24ecc3ec6c3c86a7c659898bbd064da4bb2bc4

SHA256
8fef842b184e53520c6954796c42b40c88084d141fff0da6c9b77131ffb606af

SHA512
d6e271281e4b1d67c673aa17c4058c7049b531d9537b3478745bb5432b347c004a2f6cdac86fb0f5a277584c39c152602076d1442ada387d2637e9ade3e359ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe

Filesize
3.1MB

MD5
47ec64e3d129b23c44f417cbc2a07aa7

SHA1
e65fbcf69e6e808ebe7bc9b13e483c5fc80d5fa2

SHA256
ccb17adb4b57a95a61acb010c01da98dc150be67a85df2ab40ba9d1f078f8373

SHA512
52247a235b708e98efcf977fd109344e16df9c5a9f13ad5afd395df3f009d9ee6edf81fef9d74a31a9fdec1f851e61642912eb9bc8384b39042b70f9d8b7d510

Download Submit
C:\Users\Admin\AppData\Local\Temp\QocwK8nSU5Vt.bat

Filesize
196B

MD5
cdbe66d1dc19422d431c1192d9aaae6f

SHA1
a8022935eab31bfdec2bd9320e4e1790d45db31d

SHA256
9a5fd457dfbdbf57d4d110cc5da0053ae5cc18e2d9eedf843ba85157b5245f99

SHA512
71db3bae8a4eea2bf74ab99425a56718834b68687994220b769154ddd346a32b269e65b68d3a80b814e2215055ac717cf8c63cadb9a8556a9ba7b4ac09680bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\SYCzd0Oied1O.bat

Filesize
196B

MD5
fd42e23d9ef83dbc8d931eb3081d3db6

SHA1
beeccc80acb74094bd90aacf94ccce9dd7917646

SHA256
3aa8b479b44b07d2068d5f15e90b473e5f64e7ca302edee64bf0debe362d5ba3

SHA512
d63fe4f4e1a9d6e1894c957ffab58c18e8da8050c4fe028c4e0b2b65b45ed75f93b820c3b0da7f7ac292c1522301c1e9ee3e9c4cf35218d7aa1533310eb78d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\leHEASnJNFj8.bat

Filesize
196B

MD5
4dbdc0b8e090f0d5a085618855a39e75

SHA1
99296d320ba46375d7493582b532295f5b0fcea6

SHA256
cb52f65966133bacc40d7dc020bf35dac77bcbb1fe7c914881bde2fd4f3e5b51

SHA512
6e2e3e7c62ea5374c95a2060d461bd0722c4c5a717d8528bc11e56e9c351c4fcdf8e54ceb505989e045a21f05f53367d05c156a89aa6d4e4a183902b0d19d5e5

Download Submit
memory/1208-59-0x0000000000A50000-0x0000000000D74000-memory.dmp

Filesize
3.1MB

Download
memory/3936-108-0x000000001C840000-0x000000001C890000-memory.dmp

Filesize
320KB

Download
memory/3936-109-0x000000001C950000-0x000000001CA02000-memory.dmp

Filesize
712KB

Download
memory/4576-24-0x0000000006D70000-0x0000000006D98000-memory.dmp

Filesize
160KB

Download
memory/4576-33-0x0000000006800000-0x000000000680C000-memory.dmp

Filesize
48KB

Download
memory/4576-39-0x00000000067F0000-0x00000000067F6000-memory.dmp

Filesize
24KB

Download
memory/4576-47-0x0000000009750000-0x000000000978A000-memory.dmp

Filesize
232KB

Download
memory/4576-43-0x00000000097C0000-0x0000000009874000-memory.dmp

Filesize
720KB

Download
memory/4576-36-0x0000000006800000-0x000000000680C000-memory.dmp

Filesize
48KB

Download
memory/4576-27-0x0000000006D70000-0x0000000006D98000-memory.dmp

Filesize
160KB

Download
memory/4576-46-0x00000000097C0000-0x0000000009874000-memory.dmp

Filesize
720KB

Download
memory/4576-50-0x0000000009750000-0x000000000978A000-memory.dmp

Filesize
232KB

Download
memory/4576-51-0x0000000009730000-0x000000000974F000-memory.dmp

Filesize
124KB

Download
memory/4576-54-0x0000000009730000-0x000000000974F000-memory.dmp

Filesize
124KB

Download
memory/4576-58-0x0000000009790000-0x00000000097A5000-memory.dmp

Filesize
84KB

Download
memory/4576-55-0x0000000009790000-0x00000000097A5000-memory.dmp

Filesize
84KB

Download
memory/4576-42-0x00000000067F0000-0x00000000067F6000-memory.dmp

Filesize
24KB

Download
memory/4576-248-0x0000000000FE3000-0x0000000000FE4000-memory.dmp

Filesize
4KB

Download
memory/4576-28-0x00000000066C0000-0x00000000066D2000-memory.dmp

Filesize
72KB

Download
memory/4576-31-0x00000000066C0000-0x00000000066D2000-memory.dmp

Filesize
72KB

Download
memory/4576-0-0x0000000000FE3000-0x0000000000FE4000-memory.dmp

Filesize
4KB

Download
memory/4576-17-0x00000000067B0000-0x00000000067D3000-memory.dmp

Filesize
140KB

Download
memory/4576-20-0x00000000067B0000-0x00000000067D3000-memory.dmp

Filesize
140KB

Download
memory/4576-9-0x0000000006660000-0x00000000066A0000-memory.dmp

Filesize
256KB

Download
memory/4576-12-0x0000000006660000-0x00000000066A0000-memory.dmp

Filesize
256KB

Download
memory/4576-13-0x0000000006630000-0x0000000006641000-memory.dmp

Filesize
68KB

Download
memory/4576-16-0x0000000006630000-0x0000000006641000-memory.dmp

Filesize
68KB

Download
memory/4576-7-0x0000000008990000-0x0000000009578000-memory.dmp

Filesize
11.9MB

Download
memory/4576-8-0x0000000008990000-0x0000000009578000-memory.dmp

Filesize
11.9MB

Download
memory/4576-4-0x0000000006DA0000-0x0000000007725000-memory.dmp

Filesize
9.5MB

Download
memory/4576-1-0x0000000006DA0000-0x0000000007725000-memory.dmp

Filesize
9.5MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads