quasar | hxxps://github[.]com/S0UlS1232/AWP[.]GG-CRACKED/blob/main/Awp[.]gg%20CRACKED[.]exe

Resubmissions

19-12-2024 19:49

241219-yjr4fsxrf1 10

19-12-2024 19:39

241219-yc9d6axrbv 10

Analysis

max time kernel
164s
max time network
167s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
19-12-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/S0UlS1232/AWP.GG-CRACKED/blob/main/Awp.gg%20CRACKED.exe

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.19:4782

Mutex

cbd5bb11-a5b0-4dee-8e4b-bb4f3dacc71d

Attributes

encryption_key
17F9A06104A1A84BB74B1E617E0D5896149A2953
install_name
Solora.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Defender
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0004000000040b73-359.dat	family_quasar
behavioral1/memory/5616-396-0x0000000000AE0000-0x0000000000E04000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5616	Awp.gg CRACKED.exe
3616	Solora.exe
5848	Awp.gg CRACKED.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
85	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\49e11cab-b03f-429f-8cc2-e55679503fa9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241219194217.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1798060429-1844192857-3165087720-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2196	schtasks.exe
5084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3284	msedge.exe
3284	msedge.exe
700	identity_helper.exe
700	identity_helper.exe
5252	msedge.exe
5252	msedge.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	Awp.gg CRACKED.exe
Token: SeDebugPrivilege	3616	Solora.exe
Token: SeDebugPrivilege	5156	taskmgr.exe
Token: SeSystemProfilePrivilege	5156	taskmgr.exe
Token: SeCreateGlobalPrivilege	5156	taskmgr.exe
Token: 33	5156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5156	taskmgr.exe
Token: SeDebugPrivilege	5848	Awp.gg CRACKED.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3616	Solora.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1988	3284	msedge.exe	82
PID 3284 wrote to memory of 1988	3284	msedge.exe	82
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 460	3284	msedge.exe	83
PID 3284 wrote to memory of 3120	3284	msedge.exe	84
PID 3284 wrote to memory of 3120	3284	msedge.exe	84
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85
PID 3284 wrote to memory of 2396	3284	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/S0UlS1232/AWP.GG-CRACKED/blob/main/Awp.gg%20CRACKED.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcfd1a46f8,0x7ffcfd1a4708,0x7ffcfd1a4718
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff763e75460,0x7ff763e75470,0x7ff763e75480
    3⤵
    PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,406052006792376059,5858437698050798716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5552

C:\Users\Admin\Downloads\Awp.gg CRACKED.exe
"C:\Users\Admin\Downloads\Awp.gg CRACKED.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5616
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2196
- C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3616
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Solora.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5084

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5156

C:\Users\Admin\Downloads\Awp.gg CRACKED.exe
"C:\Users\Admin\Downloads\Awp.gg CRACKED.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Awp.gg CRACKED.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b03d78ec6b6f6bfc8ce2f6e81cd88647

SHA1
014cb7dc4aa1bc5d2cb4ec25ec58470baf5b6741

SHA256
983928a84fcf0791614cc3d17d92d62ffbed0bf0f141d7544d0cc762977a3905

SHA512
4699916bdfa5776d72ad2643fad072a7a19783900608290bd1246a19624d61b58a1d80eceb74215b7198aaf04c526fa8703d38f3c5fdcc1add19b87508685ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
95ba0df0c4c417ae5a52c277e5f43b64

SHA1
7c3bf3447551678f742cc311cd4cf7b2a99ab3be

SHA256
fdaa82c65558793b81117a66acd5645d4072f6b71f164ed2717a17cab6e727ea

SHA512
fcb35a1949664f218ae40c25fd6eaefc4ba6417034a522f0800c50ee78e530c33080faa73ff9ea82f35749d404d6b9c94fc7e8e224689503e699a5ec2b0d5abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
f990393938da550dce1d9c1b1092c70a

SHA1
5081d15c58e4edf0bbf4e0e4ccc6507a31a7fcd8

SHA256
b62ad0f90989afdf1e216667a352702d5be9d4543bc067180a1cfbcdf47f8f49

SHA512
1ac0e02b8d47b2db05fc33c09338b95abea9d19f3737616daeb275e4201131fe0a1526470bec34c89f08fac1f39cc56477997193362df4040642b0381e79b3fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
135aeec14b0fed0b2c2e0e2d8bfb557e

SHA1
049730b8917831271bb80374869b0b45e43ca6f8

SHA256
1a2a65ac9d3395f879c1bf97865e8448bc374e3f1dd4b9bab92b4015b4aeb0d0

SHA512
1373257a8b348382cd80d6206fd80f99e9ea25ef7a8d761e5f7b16fc6735349ea0e5bcbd742e7cd1237e4a95eacaacdaaac8b972dbcf4323f156c0f182733312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
775d89fb1a0bd136a43ed46024f60929

SHA1
3b5bb6fe40081473a85111973eca3f61620a933b

SHA256
4ec51bee0724dd6a83c7e78a60f06f54a77b64ecbbe52fdb9415ae971a95f038

SHA512
f2b45e5354db467a52c77b63486a906a45b0cec1b6afd8361a2258c590e18d49f15db2cbd5b4263f083183aa7851f9c82d09526729bc0284aa52458c38330201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
22f9219db085824bb6a7f9bfe914cbbe

SHA1
14e1cab074af65f50ac84d03c870d95e4ab2ee59

SHA256
41bbe5880ba5e40b17110a4068d3ceef16ec53a1ba9d8d503147f22da008c41c

SHA512
835a3fbcec38ea3019616a953925658e854cb381f2930a0b043cc77902f5bf1e022b0df6dca72c42360ac57cb37763899fd8513e49771121e64203b70305156c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5868b8.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbfd1dddb8a2e246f306304a957c1858

SHA1
633c64289701974f423010f4e8831a312d4eb65b

SHA256
da40486f9af67d722fb67c25203a8ea7b4045f7fbf9a5b1a5a8b0ca647866f52

SHA512
bceb6207691261b3a0893d3eb3edb35586aa8dac92b3a5e3bebaf9282a1925360d2230d21a9519f5e510883b11fea3f0a3e63c88339bbe12038e84280fc1f14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e64654af845fd99014022aff1e2f57ae

SHA1
ae97ae08680ca11291de4f11c97ac70d5f9e5dc5

SHA256
3059719d7a8b3c047d0710caaf3ae83b6739a8b2157494f293e745797fb83bb9

SHA512
0a922649739c8c54910a1143dcf877e4031671870f691012410ca47eb8d2285f457a083eb4f9c909a05de5c0ab18c95cf35fe02580e07873c88d7bc31fb4aa4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9852e50cbf78c022da82091caad38c67

SHA1
252144a0b800c66d12e5c3ed2b18aae8d16853bc

SHA256
da165788dcbb057c73720379af9a2d71c6df2410b6b365d67b29b507a3e634a6

SHA512
39df5c422ac58dd0f7df1e60502550420c427bf61f543c4161460e3e113f3df8ae0e523e4de348113507f2950fc5949b9eb5f0db890c177adea9e141fea48493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bb3051f18d0212189093b7cbcfee245

SHA1
bb3219204403b1f35dae86ef8eb4a57e7c0b8148

SHA256
6943fb6609924220a9ae744c6fb13c8e1af15060595b74f23e5e34db7d73a240

SHA512
4e9ce1c8bc59da3bafb5949952abd08acd733fbc182a5f9b445d4434e4868cbb8b8458f2dff6b63ce8455599c564ed39e1db7c464c1ccd812f8e495affda9311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1cc3bc2b1c52831cc0b972d856888e8c

SHA1
9ffa8cf55aa29f6cbdd5ec39b1b33938b29e9990

SHA256
a8f894b23c518e04d94f1bb51343443de8121366171d2f05441283dbb1cfdd2c

SHA512
85bd6789da57c911f9cc35929ab302829614a4f03b3de30e28ab16558279ed02200a7db802c9bcd6b2e5886ea3c323d6a39eb8c3ee309d8b5702be65dab7c3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0493f44576fd7d9b6216b7387a26543e

SHA1
47d35c7f2990ec4668ecf1c01e0e5f623153a3f3

SHA256
0679b6900e2118e17164159f449fdc1f6bf20c0cc0b056cc9aedfae42a830ca8

SHA512
a519962ffb281d471bcf63c0bf75bed19d4eeac591cf6bf8565af14dde1d57fe8cabfc05bec52b2087ce8c6f637dbefb438ce22054895dc116b31bffa18e9cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cab8d0a1fda705fd022da9959c90133e

SHA1
d4b56e9eab3dc8c0d07c8ad58c30d62d1dbceebd

SHA256
82f84673f713f459a663887f6467c73bc14160215e6a6bd60c7c6c4c550c758d

SHA512
77b4304c295cc3d7a21b8ec9146349d06788e78168adbff709a98de2639bd950e2bb9f818f75478699de22d0e5a75ad2985f222501919c79d66fdfdbfa6d68e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589323.TMP

Filesize
864B

MD5
28fbc57ecc20c01593b095269615ccc0

SHA1
2c7f967f02cc928fe7cf25fac8ff1a8d69faab8c

SHA256
8c65aa1443ea904ac065ff41ae2ad9341c3443dacdf8b96ed680fd8d3a53bbc2

SHA512
baeab75d7dddd58203905dfaa31411c3ce083058bd08478f9716604416493f57fccc09a8e0b1f583dc1a9bcb32fc19e9ab95b58787696439b7b46e9bafc8bd6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f2437e3ee5674f3fe6eb7d5c1fd95dd3

SHA1
569d32a50b72c9423d45be08db5a01c96674e96b

SHA256
4e76016e2bccc97481d9fc565e201fbb122f605ccb39f3c3a227b1dfacc1c069

SHA512
997b9ed37bf61cee20d4d62d9d392a0b6ee6b5265e1cd2f53f08e544f8721f14eafe6cbaa79be5de5044c8f0283f23ea9ab4990fe8e38a51716898e2cb75a8e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bd659a77bed8ddca52e7e8625b228fab

SHA1
a6a96c283231589c6c8d899bf57486d74b04c87c

SHA256
16fea5be6ecd694428bde70ed1ad8ed46952f765b1de1608de2629e1d4efb605

SHA512
71ff6ea3faa505ad76349d6dd6f6893191f98f955036b60d3336c1f008c0fb0e9bd71717e58cb4af94675b867de5145c38cdfeb468d2de2d3d94fbb04115d387

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
437aed0efbcd0e7a004f1db6e8f3dc48

SHA1
7f9de694df581b4f23a8b20b3fa1a10048d21b81

SHA256
9452cc32791dc38406d0002a76bb874eddf32a309c0d93408defdc51739631b9

SHA512
9670b67abfefcb744f2274d079c436dfcdadb8e6fb68807ac9c45582929018f9ef49d18e91fefa3633df35866b31612f00c4fbd00d85adf15c5d2a12780a444a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
017840229b7147f0c5c8d4f6315aeab1

SHA1
058bea3edb057d95bdaa63e8f982c719d88c5d3c

SHA256
6eb9767cbf1de7944e1b2dfd72c9525caeae94851cbc4236a02f9db88082097c

SHA512
ced06746016722fb6f87a6efb976420184cfcdd3fd0fdc42e8ec30c03bcf4ff20091bc939e7d3408a16fdc627a4fec8f7eeb69d1bfd835a822dd5863c5864b76

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 934643.crdownload

Filesize
3.1MB

MD5
b622196e254ed84e5b1f59f1aac2cfb1

SHA1
f77a050aaff00d2cc3da7f11fb35e0bd2c0338be

SHA256
1d55a256b3519b624f19c81a9b9f0477d8ad45a967f853e723a921194ee585f0

SHA512
5a525dda3785449a3770f98ce105bf83a417654537a70e6f8a4ddfcba938dffa029e11161d1ae64afed48e78e6bd3336777c97334c7c1a453e9e742506520fbf

Download Submit
memory/3616-399-0x000000001BD30000-0x000000001BD80000-memory.dmp

Filesize
320KB

Download
memory/3616-400-0x000000001CF70000-0x000000001D022000-memory.dmp

Filesize
712KB

Download
memory/5156-407-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-402-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-413-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-412-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-411-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-410-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-409-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-408-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-403-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5156-401-0x000001606A260000-0x000001606A261000-memory.dmp

Filesize
4KB

Download
memory/5616-396-0x0000000000AE0000-0x0000000000E04000-memory.dmp

Filesize
3.1MB

Download