quasar | hxxps://gofile[.]io/d/0H3xvK

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 13 IoCs

pid	Process
3040	better.exe
4068	Client.exe
868	Client.exe
2704	Client.exe
2428	Client.exe
4020	Client.exe
2308	Client.exe
940	Client.exe
4120	Client.exe
3084	Client.exe
3052	Client.exe
2516	Client.exe
1808	Client.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	better.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	better.exe
File created	C:\Windows\System32\SubDir\Client.exe\:SmartScreen:$DATA	better.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1360	PING.EXE
884	PING.EXE
3748	PING.EXE
1052	PING.EXE
4240	PING.EXE
4756	PING.EXE
1292	PING.EXE
1288	PING.EXE
4484	PING.EXE
3312	PING.EXE
3056	PING.EXE
3872	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 96709.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
4240	PING.EXE
3056	PING.EXE
1288	PING.EXE
3748	PING.EXE
1052	PING.EXE
4484	PING.EXE
4756	PING.EXE
1292	PING.EXE
3312	PING.EXE
1360	PING.EXE
3872	PING.EXE
884	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2864	schtasks.exe
1388	schtasks.exe
2556	schtasks.exe
3748	schtasks.exe
4304	schtasks.exe
5004	schtasks.exe
32	schtasks.exe
2400	schtasks.exe
4888	schtasks.exe
4024	schtasks.exe
1488	schtasks.exe
3708	schtasks.exe
4812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2844	msedge.exe
2844	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
2708	msedge.exe
2708	msedge.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	better.exe
Token: SeDebugPrivilege	4068	Client.exe
Token: SeDebugPrivilege	868	Client.exe
Token: SeDebugPrivilege	2704	Client.exe
Token: SeDebugPrivilege	2428	Client.exe
Token: SeDebugPrivilege	4020	Client.exe
Token: SeDebugPrivilege	2308	Client.exe
Token: SeDebugPrivilege	940	Client.exe
Token: SeDebugPrivilege	4120	Client.exe
Token: SeDebugPrivilege	3084	Client.exe
Token: SeDebugPrivilege	1716	taskmgr.exe
Token: SeSystemProfilePrivilege	1716	taskmgr.exe
Token: SeCreateGlobalPrivilege	1716	taskmgr.exe
Token: SeDebugPrivilege	3052	Client.exe
Token: SeDebugPrivilege	2516	Client.exe
Token: SeDebugPrivilege	1808	Client.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
4068	Client.exe
868	Client.exe
2704	Client.exe
2428	Client.exe
4020	Client.exe
2308	Client.exe
940	Client.exe
4120	Client.exe
3084	Client.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
4068	Client.exe
868	Client.exe
2704	Client.exe
2428	Client.exe
4020	Client.exe
2308	Client.exe
940	Client.exe
4120	Client.exe
3084	Client.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
3052	Client.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe
1716	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3420	2608	msedge.exe	82
PID 2608 wrote to memory of 3420	2608	msedge.exe	82
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2168	2608	msedge.exe	83
PID 2608 wrote to memory of 2844	2608	msedge.exe	84
PID 2608 wrote to memory of 2844	2608	msedge.exe	84
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85
PID 2608 wrote to memory of 1036	2608	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/0H3xvK
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc02b446f8,0x7ffc02b44708,0x7ffc02b44718
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Users\Admin\Downloads\better.exe
  "C:\Users\Admin\Downloads\better.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4068
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8gaDjnEV1qGc.bat" "
      4⤵
      PID:1220
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1440
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4240
    - - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:868
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:32
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fbCtDFCzUnfb.bat" "
        6⤵
        
        PID:3176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3200
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4756
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3tUvYKKQVVOo.bat" "
        8⤵
        
        PID:2148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1292
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2428
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5Xh1R9CXmcRl.bat" "
        10⤵
        
        PID:4784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3312
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eZTQRKQoMUAy.bat" "
        12⤵
        
        PID:3576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4068
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1360
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2308
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5509u1oMZs5R.bat" "
        14⤵
        
        PID:1508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1396
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3056
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:940
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B1gzOHdDTAUh.bat" "
        16⤵
        
        PID:2192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3872
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4120
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oJKjd3d2Byhw.bat" "
        18⤵
        
        PID:4204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1288
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3084
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IkVA86CQf0UO.bat" "
        20⤵
        
        PID:2576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:884
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SendNotifyMessage
        
        PID:3052
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vtWvMKGpYewW.bat" "
        22⤵
        
        PID:1720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4812
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3748
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GC4xUfdmYvDq.bat" "
        24⤵
        
        PID:2852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3292
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1052
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5b3MkrVD3x2i.bat" "
        26⤵
        
        PID:744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3692
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2137661838968362705,6210748301682622215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery