4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Analysis

max time kernel
840s
max time network
845s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-12-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Size

1KB
MD5

bf8d5a737e70dd3493a475b8672f14df
SHA1

01d35be1b65293f7ca43ee1045424599923ab54a
SHA256

6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
SHA512

ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
3628	msedge.exe
3628	msedge.exe
2560	identity_helper.exe
2560	identity_helper.exe
4152	msedge.exe
4152	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3080	3628	msedge.exe	77
PID 3628 wrote to memory of 3080	3628	msedge.exe	77
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 3720	3628	msedge.exe	78
PID 3628 wrote to memory of 1580	3628	msedge.exe	79
PID 3628 wrote to memory of 1580	3628	msedge.exe	79
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80
PID 3628 wrote to memory of 2760	3628	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\3rdPartyLicenses\BouncyCastle_license.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9289e3cb8,0x7ff9289e3cc8,0x7ff9289e3cd8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,10427582782531828349,7213732084106817501,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a332d2060dee0a5b0f1b9102894e189e

SHA1
5ad4fcc2240aa715eada32b539da212fb459c38c

SHA256
82aa6874667961b7e47166e1dc8cd2867ab05f8fe3202d8e91c2cc4c8015b3c0

SHA512
9bdc060fc47374edc455ab9e9aaf2410948ea360c641545e87ed8946d59c174dcf39e2c9f31098d6cfe140a9e4a97e64a037c0d29006691607a91af0041abb6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3442b3dd06f90b73d1eac669d0b0c662

SHA1
1e931247bf1ede80e13f056dd90625f614497880

SHA256
8d533eceda4f954fe8d2aee9d35abda6552c25fff532f563454a97935e5cce82

SHA512
54ffa38a83a0c5d24f7e003bcf6b032790e851c87f253be8defeb61e920f6aa18a4b748e0912ef024ec0168383f959cb5aa326e35d8322d25994439fffa4aacc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65f9dd18e1de88bcb05cab758813763e

SHA1
76e1e927b1ab1930648e427038c8acabdd8b5990

SHA256
41ee93e9e81f25e3509267aac52d4308795c5c17dba26a2b6aab656251633ad0

SHA512
bb89bd76ecadb51802cd0708366f47073cb29d30f8387a14b040c940f244eb9fe7c86f56e015b76e7143c7459f7e74f685a4e40fedfb288f7ea5e26de83fa7e7

Download Submit