quasar | 5fb2ada2fd81c7b0ed6e517e92900c6336323bc9f1b7fb19989e9a4e44ef0213

Analysis

max time kernel
1036s
max time network
1045s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

73a3341a9194801bc9024e6b8f963258
SHA1

7c10750556e5eba8e9872432561f76d010d519f3
SHA256

5fb2ada2fd81c7b0ed6e517e92900c6336323bc9f1b7fb19989e9a4e44ef0213
SHA512

629756335bcb53b1fde013c4c090f580b622bafe6d340bba0b9d1d53c3acc0719dbae025fb389ccad1bc298835a76077607f34a3ededa6e701d3dacabac375f7
SSDEEP

49152:Cv5G42pda6D+/PjlLOlg6yQipVil6bn1JqLoGdbTHHB72eh2NT:Cvo42pda6D+/PjlLOlZyQipVLbM

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

auto-london.gl.at.ply.gg:51655

facilities-desktop.gl.at.ply.gg:5987

Mutex

1ae47733-5e8b-44b5-b988-3cb4dd5ded05

Attributes

encryption_key
3C8DD6CA308BD63A3F09A62959EA7F529CD3E4F7
install_name
bob123.exe
log_directory
Logs
reconnect_delay
0
startup_key
SytemUpd
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/620-1-0x0000000000C00000-0x0000000000F24000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b97-8.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3712	bob123.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1780	ScreenClippingHost.exe
1340	ScreenClippingHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3216	schtasks.exe
1960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
4912	msedge.exe
4912	msedge.exe
4528	identity_helper.exe
4528	identity_helper.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	Client-built.exe
Token: SeDebugPrivilege	3712	bob123.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3712	bob123.exe
3712	bob123.exe
3712	bob123.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
3712	bob123.exe
3712	bob123.exe
3712	bob123.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3712	bob123.exe
3712	bob123.exe
3712	bob123.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
3712	bob123.exe
3712	bob123.exe
3712	bob123.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3712	bob123.exe
1780	ScreenClippingHost.exe
1340	ScreenClippingHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1960	620	Client-built.exe	82
PID 620 wrote to memory of 1960	620	Client-built.exe	82
PID 620 wrote to memory of 3712	620	Client-built.exe	84
PID 620 wrote to memory of 3712	620	Client-built.exe	84
PID 3712 wrote to memory of 3216	3712	bob123.exe	85
PID 3712 wrote to memory of 3216	3712	bob123.exe	85
PID 4912 wrote to memory of 4088	4912	msedge.exe	99
PID 4912 wrote to memory of 4088	4912	msedge.exe	99
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 4508	4912	msedge.exe	100
PID 4912 wrote to memory of 3928	4912	msedge.exe	101
PID 4912 wrote to memory of 3928	4912	msedge.exe	101
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102
PID 4912 wrote to memory of 1924	4912	msedge.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SytemUpd" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bob123.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1960
- C:\Users\Admin\AppData\Roaming\SubDir\bob123.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\bob123.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "SytemUpd" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bob123.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffee12c46f8,0x7ffee12c4708,0x7ffee12c4718
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8365530469488478708,11772126289804035925,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppXyz3w1x599ya8gjvt9jprqjvttt0dxhd7.mca
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe" -ServerName:ScreenClipping.AppXyz3w1x599ya8gjvt9jprqjvttt0dxhd7.mca
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
540B

MD5
5c65e3b5a02bfb013cf61bc8b5c6010f

SHA1
09e09bd0915eb70e4f3fcbb55245d81ece328026

SHA256
57e08d1eb4ba1120b6d712b85bc7cdac198defcdc03f3056b0078c5a08a0cedc

SHA512
94f069fce7c0956a0337ee37f9cf29d96ba1501bd3ae66e4e23c56a54f6ff6e993c08f2e4eb0847ae94a8fe75000c6b19eef662cc8e8e43cdefc40410793d5b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
898bfddbbe98582a29b0a3a3d5ccc8a4

SHA1
2f5757a277160d2ae3502333e3145976260d2f1c

SHA256
8676c8c1b29d7138d7994afdce2d8c5c57371783a6d3162ea90fa2edbf78e45d

SHA512
0b6aed7872b75daa823f0f0c8df0bba44895aca01249833c9dde411b4c8d358b294d14d946210acbc92e501ce206eb5a435375b40358544bc0f8f5facdb0172d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe3461a12acda608c0127792d34cc210

SHA1
2c2b48d9afa14dada62f769bfa4d8a23c0ba8e2e

SHA256
6fa539f192210a1af8bbd1d8ddf4ebd722a49479579eab4762b55347844cea5a

SHA512
eb9314f4ab56265e5194dfce4de4cb3045b10f85153e1fda86117eea6b84ca448fd3a7c6bbd91f1e1e0f9fa785124700911b4ac8363b513a744188a0674e15ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82dd03d9a4006b68cf4e9c0fd8cd24bd

SHA1
a29058d4fde528e108f2e61b9c9e290bbd4320a1

SHA256
a304c29b4f4f1582121a79806ba818e1152c75489a5a249536098fea0cec9cba

SHA512
e18ff770ae0c9e4b53047e63206740a3579cc0d7f2e6447a3a1782bada3e9ce676e91841a238ead16816151c178b303141669e05d0b4ce9779225fe95a0a97da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
afa005a864998867c297be5cb6b5710a

SHA1
70a5ae9fff1dd6de4149be81547d05826d45a9ca

SHA256
453dd461d6652269234b44546f59dd1895a4ce4020aa2b4e764ee75c7c1eb152

SHA512
0f611a5f42485fa2da056ffe71798080cc83f38c6db77c03f272d026fa1acce633ac2babff3f583d70782a59c6ab969d0760e55f3961093bdcc8c0431de594ab

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\bob123.exe

Filesize
3.1MB

MD5
73a3341a9194801bc9024e6b8f963258

SHA1
7c10750556e5eba8e9872432561f76d010d519f3

SHA256
5fb2ada2fd81c7b0ed6e517e92900c6336323bc9f1b7fb19989e9a4e44ef0213

SHA512
629756335bcb53b1fde013c4c090f580b622bafe6d340bba0b9d1d53c3acc0719dbae025fb389ccad1bc298835a76077607f34a3ededa6e701d3dacabac375f7

Download Submit
memory/620-13-0x00007FFEE8970000-0x00007FFEE9431000-memory.dmp

Filesize
10.8MB

Download
memory/620-0-0x00007FFEE8973000-0x00007FFEE8975000-memory.dmp

Filesize
8KB

Download
memory/620-2-0x00007FFEE8970000-0x00007FFEE9431000-memory.dmp

Filesize
10.8MB

Download
memory/620-1-0x0000000000C00000-0x0000000000F24000-memory.dmp

Filesize
3.1MB

Download
memory/3712-10-0x00007FFEE8970000-0x00007FFEE9431000-memory.dmp

Filesize
10.8MB

Download
memory/3712-18-0x000000001D090000-0x000000001D0CC000-memory.dmp

Filesize
240KB

Download
memory/3712-17-0x000000001C310000-0x000000001C322000-memory.dmp

Filesize
72KB

Download
memory/3712-14-0x00007FFEE8970000-0x00007FFEE9431000-memory.dmp

Filesize
10.8MB

Download
memory/3712-11-0x000000001C280000-0x000000001C2D0000-memory.dmp

Filesize
320KB

Download
memory/3712-87-0x000000001E2E0000-0x000000001E808000-memory.dmp

Filesize
5.2MB

Download
memory/3712-12-0x000000001C390000-0x000000001C442000-memory.dmp

Filesize
712KB

Download
memory/3712-9-0x00007FFEE8970000-0x00007FFEE9431000-memory.dmp

Filesize
10.8MB

Download