quasar | 8026bb6c85d3106c2e42ffae25c686b84869ad2aa498f645e7296d7681562e50

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02/01/2025, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

VCGENERATOR/ELKAYSGENERATORFORVC.exe
Size

3.1MB
MD5

20d5a38a42861505c7d525f824c67215
SHA1

9fbcf3ee11bfee1c6225e99f28d2d417c3b7b763
SHA256

9832cccc37c358584162d3c9df7238f6e27c39abcad58e10de0c0596a649bf57
SHA512

a4cdc5a52d3b317f0be5502f9a03db0662c78e7bcdcc716cf6455089769283612522d895893a951cdcfa87c8868020313364c82000ff714d12fab518086c9376
SSDEEP

49152:avkt62XlaSFNWPjljiFa2RoUYIWCD1JPLoGd4THHB72eh2NT:av462XlaSFNWPjljiFXRoUYIWCn

Score

10^/10

quasar photon (vc)defense_evasion discovery phishing spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

PHOTON (VC)

68.9.130.235:5000

Mutex

7def7a0b-7c21-4aa6-8287-626e35f99b65

Attributes

encryption_key
924B0A7B7369598A14904A9651CD2598B3DE0717
install_name
VCGENV1.exe
log_directory
Logs
reconnect_delay
3000
startup_key
solara in yo pc
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/2488-1-0x0000000000E70000-0x0000000001194000-memory.dmp	family_quasar
behavioral1/files/0x001000000002ab0a-6.dat	family_quasar

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 3 IoCs

pid	Process
4436	VCGENV1.exe
4520	winrar-x64-710b2.exe
2096	winrar-x64-710b2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-710b2.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VCGENERATOR.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 92664.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-710b2.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3644	schtasks.exe
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4792	msedge.exe
4792	msedge.exe
2908	msedge.exe
2908	msedge.exe
2160	identity_helper.exe
2160	identity_helper.exe
4916	msedge.exe
4916	msedge.exe
3364	msedge.exe
3364	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1992	OpenWith.exe
4436	VCGENV1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	ELKAYSGENERATORFORVC.exe
Token: SeDebugPrivilege	4436	VCGENV1.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4436	VCGENV1.exe
1992	OpenWith.exe
1992	OpenWith.exe
1992	OpenWith.exe
4520	winrar-x64-710b2.exe
4520	winrar-x64-710b2.exe
4520	winrar-x64-710b2.exe
2096	winrar-x64-710b2.exe
2096	winrar-x64-710b2.exe
2096	winrar-x64-710b2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4232	2488	ELKAYSGENERATORFORVC.exe	77
PID 2488 wrote to memory of 4232	2488	ELKAYSGENERATORFORVC.exe	77
PID 2488 wrote to memory of 4436	2488	ELKAYSGENERATORFORVC.exe	79
PID 2488 wrote to memory of 4436	2488	ELKAYSGENERATORFORVC.exe	79
PID 4436 wrote to memory of 3644	4436	VCGENV1.exe	80
PID 4436 wrote to memory of 3644	4436	VCGENV1.exe	80
PID 4792 wrote to memory of 2304	4792	msedge.exe	87
PID 4792 wrote to memory of 2304	4792	msedge.exe	87
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4288	4792	msedge.exe	88
PID 4792 wrote to memory of 4832	4792	msedge.exe	89
PID 4792 wrote to memory of 4832	4792	msedge.exe	89
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90
PID 4792 wrote to memory of 4516	4792	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VCGENERATOR\ELKAYSGENERATORFORVC.exe
"C:\Users\Admin\AppData\Local\Temp\VCGENERATOR\ELKAYSGENERATORFORVC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "solara in yo pc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\VCGENV1.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4232
- C:\Users\Admin\AppData\Roaming\SubDir\VCGENV1.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\VCGENV1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "solara in yo pc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\VCGENV1.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffe97733cb8,0x7ffe97733cc8,0x7ffe97733cd8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Users\Admin\Downloads\winrar-x64-710b2.exe
  "C:\Users\Admin\Downloads\winrar-x64-710b2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5119894039214800739,16033998102690838101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Users\Admin\Downloads\winrar-x64-710b2.exe
  "C:\Users\Admin\Downloads\winrar-x64-710b2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1992

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\3dc1ef229c2543e0a622ae14af7dab6e /t 4284 /p 4520
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a87ebc4-20ef-4239-856b-748bab9ce0f5.tmp

Filesize
1KB

MD5
c2d74e6a4cffc9fd3ba29415976e5837

SHA1
05962a14d173f789e5ec7cf8466a04db2101e9aa

SHA256
388794a85776982964305a8f15f5ec377f2520660166368a67f6a51807b18021

SHA512
68be0e20358342b738f0232fdc75506c97c05dbe9d9627a55dd85fff338e84ce555bc9b4f564daa2ab3c914a8765262ec3a6cde23d17da46e8ce58102afde8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
761df82d349e0b931c8dc7b747b0282c

SHA1
8de6c6ecd6b34fa0adc6b47749fd1d05aa749941

SHA256
9352b34280ed6becdd0a7f4bd4571848427177b91794950ed8c504c33d42aade

SHA512
63c77a9a236880792273b51d79005e4d2ea5ff4253c8ed6457f069ed1437661dffb5f9659be09684088b9275163160eab8f582d9e30d7bb82476f8129bbc72f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f2a8d47b20f01176a051da9cbd253aad

SHA1
0b0c327d8a8d09969e7ffc5944a71284be6091e7

SHA256
c013e601000849a43b63a3849d6a11706de02a19126343f2e8f861d12f675585

SHA512
3c1c6c63a6897453a1d712fa25a69c087e47897794dbfeea8396c2828b82fe8d50853e561235700e9e29eb9b083bec9c8709bfd5d7e4e71aec14911432c02155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69a69fbcf0293d60fed00bd90e4abbff

SHA1
ba6463e9627794db43d6e66d22e57259d2fb406e

SHA256
7323e49f82fb606fcb1c594891d9b7f901b06a1c4d53b2eb840b2755ab935a7b

SHA512
cf3c9e0f7c11bddced6b520f8fb378916a2fd204ca488a100a5947b791c1c2f48a0d1c090c8e8bf5fca033cc89926e83cb90974ba6e721f24336a2a3dc2fc39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
255d4c5b1397c580f19c03c4270722b7

SHA1
957a32f7baaa3ecee4a7f6473056fd329f315b66

SHA256
48273e283d88040f57503d693ee8c242c62176059031f6a7c9e9e2847c06df43

SHA512
20df19335d3c4a9d825fd5fb9b4b3c544f0035898cd513e309fb6f1431b69d336e079ef1f8958426794ff7afa8c7d8987ff95e5f39c6f794f71fa71fea2151ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ad228bfcbbf28c8b5f5f48e63015d86

SHA1
66a4f2d19febb0e90e4089e819358a7b97670e55

SHA256
da75ca16dd81f270a84a224d62163f074035ed113160958e710634bb8b033f8c

SHA512
a65143976f2ac39831078325e4e769aeaa7f62edcc835cfb1b474a285afc32df564b8c1602ebb3b585e0180bdfcfb98be5aa768790141dbc366ead06427e20e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b213b814e70f31eb1712e953c4913003

SHA1
18ebfa4a1e10ba4dccdb8e64cfe24f106731bbf6

SHA256
d39f7a8e00058f6d23a643be23ce056fb2f1b177e00ca30f00415f17f9c3bcdc

SHA512
363dc48b85d6a8a7befbc1516b00e4234bcb16c1ddd162e7f342a15ca60f3c379a33c9179ee7b76f812a25e04567b59fd75342d51a86b190b653bad82bacc410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
389d16d01ac9aa6b8577437a3e94da7b

SHA1
dc80ca4bf91481e8bb763da4584da55c3925fd37

SHA256
00e244a7756e049ae1c85e1573743ac21020af195e3e2133736b0d2c7c6a781d

SHA512
85293e69d2621a7019c34d89310c6cf3f896d4f6312ebab0e11157e87152e7e4ae87395fc139b473e7ffcd3a7659c6ac1e930a97cb7bccc6d9ade0ad8ea43076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2b42e1ac3ac3897cfb8d62e27b4ed44

SHA1
7adb70c1b535c4fee565e0bbd47af6e94d654bb3

SHA256
b39c53032acdc8e567e7947e07d98e201bb12a13c583fc347a651a541d98404c

SHA512
b179c80304817e02db91161711be934c0740e7d45eb738d4937464ae1757dcae56ce38b256ab67b6e619c258ba98650eb30a0b5aeace75caf9e26b35c699ec57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
0b79ce9e224e9cac0d2fb6e402879cd9

SHA1
db27d2984717ab3ed8ba23dc442163496e8bc359

SHA256
f95f8f9bdf447dcd36a8123bea3b591f9fcd9f2752d2c981be0267169d3d4e3c

SHA512
09c4e7a475698245527d87673c64a9a4a048685e922c6e9d8c6b2f7c975cf9d038a88abd872c0f1960abfd509b40844e76df09e3ad7b9a85ce679765e83a8248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e40f76da053acc9a410adc509aa3dafb

SHA1
06d755b8bc866cfafd2e1bbc46742e772b05d94c

SHA256
5633059e88b2d4b2282133cab32edfc73f5c99e6dc36b493f3de6087a423743e

SHA512
7699257034ba60c4a57c05213dfc6cd052051565d1b45005c0b74761ce50b99beaf434489791de7cbd584e6580f6b1e636770db88d6fbc08d8c9ce112ea25dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590620.TMP

Filesize
537B

MD5
817aa5a0cf5f0cd71b3ec5513f3f7e34

SHA1
d914d9143b14cc901b304c49f0350a086470260e

SHA256
4f9c36f7ce20edc8433e5cb2ff61d5a5477cbcc7e74ef43b7e86c8adaad0eb7a

SHA512
87bd44452c66a9b22bfb21cf623473aafec41230befef0787d8cf61926e1c68e1cb1eb051f713805b7ae0a305d2fe165353e6acc6b5998d754766c573801f673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f61a9789909ecb650cc73096cef561d

SHA1
75167d33f0b982db30f3ceac632f3ee372cc9c78

SHA256
514e628338e64a77a2cd185ea3b399c93f7e187773bd6dc2bd756c87ede5cb39

SHA512
ba3259d2fabae440e1f79c0113b664107ee5666ba92b28850a34518b21498b97477110cdde7e9d0ea3b64d9a9bffbf67c2d212242c847a2ec1b7dc6926aee35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1a4ef292d9f6c539242ae2b0201c5e03

SHA1
2352ec2e37cb6995c40f7c55b0e97dd520fabe3b

SHA256
6d8deb80381d18929230766758ec281a6f641372b51507608391b2a94a2a1394

SHA512
ba46c868206748e5a8eacc1a2a9352655770a50b0d4039c8c21561f1f9afe350c2ad88a5d55d651b33580a4dcdbf51884a568535122eea12cef50f0373b6972b

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\VCGENV1.exe

Filesize
3.1MB

MD5
20d5a38a42861505c7d525f824c67215

SHA1
9fbcf3ee11bfee1c6225e99f28d2d417c3b7b763

SHA256
9832cccc37c358584162d3c9df7238f6e27c39abcad58e10de0c0596a649bf57

SHA512
a4cdc5a52d3b317f0be5502f9a03db0662c78e7bcdcc716cf6455089769283612522d895893a951cdcfa87c8868020313364c82000ff714d12fab518086c9376

Download Submit
C:\Users\Admin\Downloads\VCGENERATOR.rar

Filesize
1.0MB

MD5
229be1f03d087484af49ee7dc7bebff8

SHA1
0ab0654db6c863957aad7411572253864040a37b

SHA256
8026bb6c85d3106c2e42ffae25c686b84869ad2aa498f645e7296d7681562e50

SHA512
c688e6665f5fe4a5ff79bcd2f6b6d1fae1754fa03a2eaf951e57b8e019c7ce7c75f7d7d66719245e00a59787368cc91a6a4b5ea686034a2216577d9a003c9943

Download Submit
C:\Users\Admin\Downloads\VCGENERATOR.rar:Zone.Identifier

Filesize
216B

MD5
a78e1b6ee194ab5c9ef5f85ae9e80524

SHA1
beba078e17f4181a2835bc575351fb275abe237a

SHA256
edcfb28c2160b1e04bc358744f260f751d1b0ef84c1e49e24e11c251b42f80d5

SHA512
933298f1ef080a70e11e0683fac67b93c91825dc6c70e2f4e4132a1d99d94dcff0460a91435c8f48653b014676e934bdaebc5fc354ff9107f2a92981daa3ff4b

Download Submit
C:\Users\Admin\Downloads\winrar-x64-710b2.exe

Filesize
3.6MB

MD5
5c107657b128f1e7cd8acb2f4a7c0810

SHA1
2a73bb8ce70ed23b78bba9c44f11d831b8843d89

SHA256
093deb9b3886f586659bcbce31965a7c97d39cd8df35f71c615225686c02798c

SHA512
8dd49c9cd1644e2c5e9bc5e7db72424a5af224260209092f5f378afa50ad8b5723661775800f8105cd0d0ab42f11115ce3ec1c0ee54d25c87676c03e6e26915b

Download Submit
C:\Users\Admin\Downloads\winrar-x64-710b2.exe:Zone.Identifier

Filesize
75B

MD5
cc0696988fb91d676adc27bf3949786d

SHA1
0561557bebafa161aff436b63f28e213b99d9c5a

SHA256
c95c0ffea82a8baa88cd2ef8b099ab37c1e78f64dcfaee17e22fa4ebda309e08

SHA512
a8316da6329998903726eb1bc4321f2e30458cc63cf1e2246623a44ce58a26ee7f84ce04c40651d36977ed38b55e12d426f86934b5a5340b7e4bfe1e5449e631

Download Submit
memory/2488-0-0x00007FFE9D993000-0x00007FFE9D995000-memory.dmp

Filesize
8KB

Download
memory/2488-2-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download
memory/2488-1-0x0000000000E70000-0x0000000001194000-memory.dmp

Filesize
3.1MB

Download
memory/2488-9-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download
memory/4436-10-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download
memory/4436-14-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download
memory/4436-12-0x000000001BB80000-0x000000001BBD0000-memory.dmp

Filesize
320KB

Download
memory/4436-13-0x000000001C520000-0x000000001C5D2000-memory.dmp

Filesize
712KB

Download
memory/4436-43-0x000000001CE60000-0x000000001D388000-memory.dmp

Filesize
5.2MB

Download
memory/4436-11-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download