quasar | 3fe52d194f176397ab988ef072b0cb64dd8a7997ce99e53fa36d94bc3d4beb45

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Blorious-V1.exe
Size

3.3MB
MD5

ab7ba1e3026b48ceadd7b68950f0e693
SHA1

18f1b5fb26221b6404b549b09699adb7663d9b60
SHA256

3fe52d194f176397ab988ef072b0cb64dd8a7997ce99e53fa36d94bc3d4beb45
SHA512

d595be554b5cc1824a4310c1cd81c4357833f49c2f1fe48ab9133d1d6abfa34377b039d40a9acbcaedd28955f5b3b4c5e5a15faa55b10a4f7eb2420deb948b41
SSDEEP

49152:rvyI22SsaNYfdPBldt698dBcjHjdSZ1J/foGdUNLTHHB72eh2NT:rvf22SsaNYfdPBldt6+dBcjHjdSp

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.0.134:4782

Mutex

b9145fb3-526d-41e5-a912-983ece635713

Attributes

encryption_key
44DC4ECD533CD0CB4AAF178AEB927FA0D40432AF
install_name
Blorious.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Gaming Utility
subdirectory
Blorious

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4592-1-0x0000000000850000-0x0000000000BA0000-memory.dmp	family_quasar
behavioral1/files/0x000a000000023b81-8.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2464	Blorious.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{602ABEAC-D258-4272-A3C8-6C58C68E4E14}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2676	schtasks.exe
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2404	identity_helper.exe
2404	identity_helper.exe
2484	msedge.exe
4608	msedge.exe
4608	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	Blorious-V1.exe
Token: SeDebugPrivilege	2464	Blorious.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2464	Blorious.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2676	4592	Blorious-V1.exe	83
PID 4592 wrote to memory of 2676	4592	Blorious-V1.exe	83
PID 4592 wrote to memory of 2464	4592	Blorious-V1.exe	85
PID 4592 wrote to memory of 2464	4592	Blorious-V1.exe	85
PID 2464 wrote to memory of 2460	2464	Blorious.exe	86
PID 2464 wrote to memory of 2460	2464	Blorious.exe	86
PID 2924 wrote to memory of 4800	2924	msedge.exe	90
PID 2924 wrote to memory of 4800	2924	msedge.exe	90
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 5080	2924	msedge.exe	91
PID 2924 wrote to memory of 2256	2924	msedge.exe	92
PID 2924 wrote to memory of 2256	2924	msedge.exe	92
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93
PID 2924 wrote to memory of 4468	2924	msedge.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Blorious-V1.exe
"C:\Users\Admin\AppData\Local\Temp\Blorious-V1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Microsoft Gaming Utility" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Blorious\Blorious.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2676
- C:\Users\Admin\AppData\Roaming\Blorious\Blorious.exe
  "C:\Users\Admin\AppData\Roaming\Blorious\Blorious.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft Gaming Utility" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Blorious\Blorious.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebf8246f8,0x7ffebf824708,0x7ffebf824718
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=1132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,15551466220938019018,5988450659588890339,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
103KB

MD5
8dff9fa1c024d95a15d60ab639395548

SHA1
9a2eb2a8704f481004cfc0e16885a70036d846d0

SHA256
bf97efc6d7605f65d682f61770fbce0a8bd66b68dac2fb084ec5ce28907fbbdb

SHA512
23dd9110887b1a9bbdbcc3ae58a9fe0b97b899ad55d9f517ff2386ea7aac481a718be54e6350f8ba29b391cc7b69808c7a7f18931758acce9fbf13b59cee3811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ee7c3718d0efe6d700ca9af0cd57d2e7

SHA1
24159ee081d6bc6da01f6b6399754b1f06fec3cd

SHA256
bbda4571504c734e3536ce21fa2e49b7088f69f98582d1443a31a512b1b29e19

SHA512
ec98c0acd33a440776673de4d429e59dda36421a03f9753813624e67a1f5433659bbfe9703771c2add58dbb54e6587a25fb11988ced7ccc12c8249d4b7715daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
46c9f79f74fc471bcc5caaac599895a3

SHA1
fb57d254ebaa40a3b361a273cbe99fda72541401

SHA256
de4542ef3520296105820481ce5de556ea15c925d055b548ebc3ff4164da1ec5

SHA512
3962482e87f1ad4c2b466c585d15187e049d6cac820bc9c8f41855da61b46b1f76c6f02a8bd2e65c27fc4603e1f514b4921b25fe49955f1056db97185262c14a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
389B

MD5
619196cf624db569a414cd9cae59e8ff

SHA1
39171d8af4bb61583f8b6e51c44b1d73ab09edac

SHA256
55a1d88e6ea6f52d0682f0b675bcf488423d91dbf76a1d65b645f4ba6bc6c1aa

SHA512
5e180674878ae6e24a6399ab9b010b55a157a2de1ce7be6d7a1f3d1c466455edf148b39603442f346576ac3e8f43612328542e5f78b191a8a3a7ba693a1e589a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe58a0bf.TMP

Filesize
671B

MD5
5a22f4b1cd78e37c8ffa65e95b55f4cd

SHA1
c0aa9117413a1618053fc4f59cb88cc720bfcf58

SHA256
7f8ab77de5cc4998784d37ecba2f1c178c16a1c2cb26a6e65b139e1aaa758f31

SHA512
68d5a68007e03b77a319bac4a9aa221c39d1e1e2b4e6de791cd71585bd308d0a211e94feca5a9461d9b4f8c0e1c2df691c32ac4d9126fd0102636f085b1ade6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
100B

MD5
6c2ef658d99a3dc773181789665bb033

SHA1
315b197bc13cf9143aa47ad37f7ef0ee80e50afb

SHA256
ecd06a875d2eef9cb4a8050e896af6383baa1d5c52e20b07e9285ec2fe20dc16

SHA512
b962acd5e2e28c0c6523f71cd12322c4500ec090ad68c2e635a7f4837ee0391f9648a10a6e4990881b6e5cfbd8cc8469089038f34c56e74aa257954d99854dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f65af2a1929b700ce7edc3e87f120894

SHA1
cd7ee62daf7737f29ad7a1803c8e57821c288d80

SHA256
6437215ae9eb7aecd05bd9c89478c26fb66a540a20670bb26bc0d0aa7e99fcc1

SHA512
f06483417c89ac75c6639ff238fee3e428e4f9eab558a55d843c2caf470c7e0dad873b2095b4f47b289014748a7757b6d6fa7bb5c4b9bd5bbf999ac28437a91f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b4f0ee4774550da97fa05052357c950f

SHA1
0b813daf6c9dae1048da8f1ccc506971fd99d92d

SHA256
e3bfbb70be2177efd7454f30ae1951cfaa6a0549b98b7131a5d89feaa1760838

SHA512
d6700fc6d70d056e664f9c12b4141e076b139e1bbf55989db84e8284eb078179d286ce9828121d045901c4f6b111a27e5ad51ce3af59cc2dd2ef93ce9c42a6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58e9c01ca1de4252c2d720b3f1b04583

SHA1
258317f1018925e04c138d2e60d35525b9a23323

SHA256
b370264ff61453b89c9a640006e341f35bb880a09809a888cf893e91e84d6e0e

SHA512
1a5d9c7d459d5a90c01e6b1978abe17bf440e4533df98d652953daa30fdc8c5f64da7d0dafc331585357bb0de374011dffc978571cd3e07ff82cd1ee804f922c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce814ec84709921a6ff7f3658ee9d514

SHA1
204bc5ed3b02569885a6f62095615db820de8c78

SHA256
0ced45c0b563e7fe4b12ca787a1f16fab7ba898c0565c37858dcbebb533866c2

SHA512
1f7ad573d260ee1c0c0eb76663b8946a508f37a945cc8459fce9cb56ff9f29999c65a142924c60fd8e1c7533cad1dce6fe8df0a2ccee39a09590c94e37df19d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
479dff147939caedd71f980597a4c7dc

SHA1
0734bc34cbaabbdd2fef6b8f39c602753788b1a3

SHA256
5116eb3a44583a39ffd3cd6ad9259bfa90b028a7560555430afe4235636d1d47

SHA512
c0a4e23c7e5e5b34d916d1eff108bea9e1710d550d75ca9022cb4d3fcaaae03eb73032303c1fb394841c62a25f75764420223a15837bcc2e3bc82e6c3392114a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efeb6adec3b5391d522072b70fe1db9c

SHA1
82c1a0c0f67317a545b200fb13cfae848e760655

SHA256
65e7ca90550c3b09ff62abf0094d09099c38b79b8a66348ce3f98a281ad00844

SHA512
3a3111c8b6a4e48decb4e36610f680de14cbbb9f1d24930adf3a921b657d7646c48a4707abb226d8ff557a64482fdb09ebda8311a1bb8faa10ac6397327d56a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
75ac12682c10b033aa8142c86f8b08a5

SHA1
74dfacd20e2ecf08482f29a339c2e8f967ad9db3

SHA256
096907c937b708270fccc948f76efa5d1aa834246d158d42701799b1f09e8ee0

SHA512
d647666f1d3b178d878d082038276d3758a0fb4176926082828d6886cfc25e3c63c12872ceff515e0838b8cb8f2cd947b6fdaf4994989dd85502a50edf1aeded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dbd861d786bdefaea96226fd26d18bb5

SHA1
761cad64b9d536a51904b0b08358df67684a9926

SHA256
803b6529add9f493d2d028320f477fb40937bc377d9733464624623b382493cc

SHA512
f9c269996262f837a541775bab19582156de6af48b50b92a3e9285fa8ace2d4bfcaf91452d05a21e53a9747b8496d0259e503e92c68859bf10881ef932426553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
48a277bc18e5abeff462150cc467d58f

SHA1
223a90388b65a6e59c0e30bcf29400baf032fabd

SHA256
82ab1f72d633d7e0d9cc2729b246668d2b4b203b7c21e277d3dcbf7b1bfc3cfd

SHA512
5066903986be1212ace1d737ca19463c42ca58c1711d626e1f4a5eef7caaa46e8a82aeafb3b25b4c30bf55108d1133e8dcbf0843e3084cffb1bfb055617f3587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
afe83b30494b1b34baaa7bb8d9813f74

SHA1
e39976fab71fb7b438f73764915a4e198523b1c4

SHA256
6749e9e781810ba16996749379b132486ee9dbfce95bd17879c693b3926fbeed

SHA512
715463bf893ff61243712efbb888d6f6c20dbb4f227bb8c1609fb0a094f02bd527d90869514aff345e10dff6ba2ef86ca55ed7fb0ea3daecd3123853039ca250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
88e68ceba14e543b4342f44bc527d7cc

SHA1
ae19d157f42a3164a4392c4e2d78c860cd5d4a0d

SHA256
b1970b9cec5260d9cb0870792bc6b92f5caef6438d9cf35ac9969e518044c1e5

SHA512
1674da4bd096a84c19721308a051a7feead7be4bdb36d68722577056db6a682eab1f488774464a2a25bbb22674e7383736674e4c3ad507429b5d9dec43d4f778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4e8378d01213939785d86a70895d289b

SHA1
b8837ac52038678aabf8f7212d62d3aa83ce17eb

SHA256
0ef06e07b504d54be2a5f16050c5bd5452651d5a7b416ac1d692a5b5488da68d

SHA512
3de308c0cb6fb8e4973fadad1ecb2a526249dfa6dc2319ba30bdf9b3a3223ca5592d644204026694b1868284f5b61f80cef50a36c122e9485a04c6600125e867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c44623416ee17cfce0a42aa9ece5310

SHA1
98874daced263d37df97e4abe8974d9ca3f62a2c

SHA256
65eb68a90475cbaf102e19423837f9ecb43d7f32d38607bec570fcbb4cabfc61

SHA512
af198cf4d65cd5c18212ebedbe84c9d4952eb357b6d8602c8312ec1429a65b2e16bf96989dc5361305f75cf3302c726c49fea0ecd0b6ca2a2ed632651914f6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
992423c5481c622d4a815eb6c4bdc72d

SHA1
d86382801abd9f823c127ac7061d223770dd1b4b

SHA256
e85774fc168029d01a51d8b21fbd42e29318f209b0c07914ff7626bd80130db1

SHA512
a91a9c7b25e93e11da22042b8a948711e398cfe4b133ddaa457c8605bbcf14676e820c77334787ccba9ec7a07be64f5d3095b23d6786e9898b53090edd8997f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c99472881ba136a68edf337fd548673d

SHA1
adf7e89135c84c871c2f1560a4651878d4ed4685

SHA256
75e4fb0729a3e482ba102e9756173475ef3565a31c8cbb4135ab2be046f083b6

SHA512
9d00177a88cf505f03feb8cbc7c25dd2655fc3f641a5a430242e72b0fcc1aaabdf4f5292ef382491d757059130667b8333623339b4fd166eedb9234b0223f3cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58216e.TMP

Filesize
1KB

MD5
7f33c6ff57f385671194352859489ea4

SHA1
01c4096e77273816bd6965ba7db8933661643fe1

SHA256
fca75a9b3cd1812a91c956a0ce540ff9a104574a2ce1fffdd0454bcbf7c72212

SHA512
b271dfb5db3bb7bb797c9ff06bd2786a1ff6348606eda35a48ea81304e579177972ae10331142d0bb4a569670616ea3d6054274376a3a427e9a9f9d3700164df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2e610f0cef00aa0db0644a15d7e26fdc

SHA1
09ea831d634196d995a353f8ebcf0a68cb5a4536

SHA256
add6bde3b62700ee1a56cd46067f2f0f400ad3b02219bdb9a5c34409208f8a3b

SHA512
a4bd8ac06fea16c779da2757e16f23a62cc3e0c624c030109be9994ba93fe2a4a3eeb05499e872f8b7f6551521a62cae2c889caf54c52e28104f3b06d661f2fa

Download Submit
C:\Users\Admin\AppData\Roaming\Blorious\Blorious.exe

Filesize
3.3MB

MD5
ab7ba1e3026b48ceadd7b68950f0e693

SHA1
18f1b5fb26221b6404b549b09699adb7663d9b60

SHA256
3fe52d194f176397ab988ef072b0cb64dd8a7997ce99e53fa36d94bc3d4beb45

SHA512
d595be554b5cc1824a4310c1cd81c4357833f49c2f1fe48ab9133d1d6abfa34377b039d40a9acbcaedd28955f5b3b4c5e5a15faa55b10a4f7eb2420deb948b41

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2464-51-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/2464-10-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/2464-11-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/2464-12-0x000000001B040000-0x000000001B090000-memory.dmp

Filesize
320KB

Download
memory/2464-135-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/2464-50-0x000000001D7C0000-0x000000001DCE8000-memory.dmp

Filesize
5.2MB

Download
memory/2464-13-0x000000001D0D0000-0x000000001D182000-memory.dmp

Filesize
712KB

Download
memory/4592-0-0x00007FFEC6143000-0x00007FFEC6145000-memory.dmp

Filesize
8KB

Download
memory/4592-9-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/4592-2-0x00007FFEC6140000-0x00007FFEC6C01000-memory.dmp

Filesize
10.8MB

Download
memory/4592-1-0x0000000000850000-0x0000000000BA0000-memory.dmp

Filesize
3.3MB

Download