quasar | 8c693ee26028976b6f9377f1a95e27cb821120e2ab6b5ffb885782f66eb59699

Analysis

max time kernel
149s
max time network
138s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11/01/2025, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

2ec8bb66e6d31a3eed3ab81af9c86633
SHA1

51775afa0bda90e7fb956897a0649302a6e3e862
SHA256

8c693ee26028976b6f9377f1a95e27cb821120e2ab6b5ffb885782f66eb59699
SHA512

a9b2fab76f360e7cdde888b205d823c062e9d883dfe97a066590a00e43ab2d6e8853223ff44e572bc221da03bd8f9bf2c419851783322172618f56a6e52c6d0a
SSDEEP

49152:rvTlL26AaNeWgPhlmVqvMQ7XSKsZxNESEZk/i6LoGdwETHHB72eh2NT:rvJL26AaNeWgPhlmVqkQ7XSK+xMkg

Score

10^/10

quasar office04 discovery spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

aurelosking-49560.portmap.host:49560

Mutex

9064a2b3-19b5-40a3-82ef-c2a129c8a662

Attributes

encryption_key
151D6A9E126EFB6E3B926F9127D87D6BF4A4C605
install_name
fontdrvhost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SecurityHealthSystray.exe
subdirectory
NVlDlA

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/2560-1-0x0000000000620000-0x0000000000944000-memory.dmp	family_quasar
behavioral1/files/0x00290000000461ae-3.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1132	fontdrvhost.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\39d2d706-5c32-4228-b389-8880a716ea14.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250111223152.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000_Classes\Local Settings	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe
1900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
4300	msedge.exe
4300	msedge.exe
1120	msedge.exe
1120	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	Client-built.exe
Token: SeDebugPrivilege	1132	fontdrvhost.exe
Token: SeDebugPrivilege	2056	taskmgr.exe
Token: SeSystemProfilePrivilege	2056	taskmgr.exe
Token: SeCreateGlobalPrivilege	2056	taskmgr.exe
Token: 33	2056	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2056	taskmgr.exe
Token: SeDebugPrivilege	5760	taskmgr.exe
Token: SeSystemProfilePrivilege	5760	taskmgr.exe
Token: SeCreateGlobalPrivilege	5760	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1132	fontdrvhost.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
1132	fontdrvhost.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
1120	msedge.exe
1120	msedge.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1132	fontdrvhost.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
1132	fontdrvhost.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
2056	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe
5760	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4732	2560	Client-built.exe	80
PID 2560 wrote to memory of 4732	2560	Client-built.exe	80
PID 2560 wrote to memory of 1132	2560	Client-built.exe	82
PID 2560 wrote to memory of 1132	2560	Client-built.exe	82
PID 1132 wrote to memory of 1900	1132	fontdrvhost.exe	83
PID 1132 wrote to memory of 1900	1132	fontdrvhost.exe	83
PID 1132 wrote to memory of 1120	1132	fontdrvhost.exe	96
PID 1132 wrote to memory of 1120	1132	fontdrvhost.exe	96
PID 1120 wrote to memory of 3392	1120	msedge.exe	97
PID 1120 wrote to memory of 3392	1120	msedge.exe	97
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 2916	1120	msedge.exe	98
PID 1120 wrote to memory of 4300	1120	msedge.exe	99
PID 1120 wrote to memory of 4300	1120	msedge.exe	99
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100
PID 1120 wrote to memory of 3744	1120	msedge.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SecurityHealthSystray.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4732
- C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe
  "C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "SecurityHealthSystray.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff05ec46f8,0x7fff05ec4708,0x7fff05ec4718
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:3484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x114,0x100,0x110,0x7ff782bf5460,0x7ff782bf5470,0x7ff782bf5480
        5⤵
        
        PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17119514203218194815,13844921598731214347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
      4⤵
      PID:2484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b712a4c83dfb3c522d032cf900e863a

SHA1
4f5bec4be6f4ebfa959e899ceafc62309bb1f141

SHA256
31da2a41a051db11559c47feb923d4baad32a384f530013a435fa884dad64493

SHA512
03b24d9307623b3a341230805f3ea662b0107c314650a51ae7e89d901cb3ad212d4219bab4d763d0aa8d50831aa0e6d4e3379573cc2f724873804578e8642898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24dada8956438ead89d9727022bac03a

SHA1
09b4fb1dba48ec8e47350131ae6113edd0fdecf0

SHA256
bf1e5c7828e4672982b16451b5a201e65e812e98a97b87c9f2f7c22677cb4ec1

SHA512
03f092a4b20a4d8cc111220b35fbf5470878b7723faeddee65b1d9cf327167053792c77864103b4530b9b9f819e32a5721b44189291dfdb5832769835ea5dd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04725960-4479-424e-8d92-bbc434d9f20a.tmp

Filesize
24KB

MD5
85eca930a791cbcb1373f5fdaf17857b

SHA1
ffea7d54e9803374a484f1e4c124766e80024efc

SHA256
fbc990061790350f00dc28f2dda277aac81bb8385a6e92e90a20101436c3312c

SHA512
2ffe0de3f80ac60f2ffa55f334026979e6be328b7c69f4603aa3c5d1bfa6c3b3744d86ac2a34ecf904d0a41b36bc485392ece58f6cc89d7ffca293d02efe5bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
ea2e7237cc485f6e22d3eb9fa7d4a1b4

SHA1
69f608598950209d10727cdbe7d79031c14ac121

SHA256
582148453c68c09f076037686a6583425370dad90cb1bcdb6b598ed94c74b226

SHA512
6f392e1322fa69c0973be9b5bb880bcd3f3e5eb7de2b6516c7caa084a5e2131d7a9a3594b3d3d82c02044b1c949c4e44e21cb05a4efb0083ccaced1eaea5a81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5c5f14dba5751a53d8dacf663e28473a

SHA1
ccb1028a739e7fcee23aa4ec0786674dfd5bb89d

SHA256
dc5ca0b78a9aa838752dc762fac461342ea2bf9f92ea10eed03ef294c5a8cbdd

SHA512
703eb4513bfd684b1c34b1b9ab93a1a0bca64d4b78e7492e72226fac77dc92304b6baa072ec0c45c9072abe2f7f65b9f81e1d149b9e2ea48c7cd86d417592636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
5da39e6f047cb4d314237b61504ba1c5

SHA1
7c5c6b7035de00129999fefac9e7672f47b38609

SHA256
6e19f77ba915820ce14a017af54d818b5d5c94d4a216395e25258d82d740a4b4

SHA512
66baee54db8824846a0c3f0bfedcf48a3750d058ed69bdff20412cece65a7aa1f05cda8078432e9f78aacf2f005e5f8b13c02b8c56eaec36ae5a611aa3b81102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea040e10fbbcb626fc7ee8db68155dfd

SHA1
2f148695040ca0e7899342e21f347659d6bd055f

SHA256
9c32a11a411ce598ba7a8a20df9015f124664a05c4e6093d2d8f9c2026c3f087

SHA512
7f085b21e4b00c0ef931fec86c73ccec4252c09d66ba4a8215e468cb9be75a33b8e2caf354a7e8e514e7666616f5d8b6c9548dd178085b8c491f5e8aafb4d816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
778ee6083f905ffaca93f8bd18b585dc

SHA1
c1dfdcca43b59c0a539303a322da2d46f35d1f28

SHA256
5f01697aabc71d12e2c2535d1062e87b7b23ed86952a0c5d5ecdfd1b946c9c1b

SHA512
3c031dba60399a1487c1d9419fe01ef3691b4e01f9b2ec360ed365fd0238ab8d0ee0d6a59d09052f5d8e3d3dd2c323cb055a46019bd3cfa59370822157177b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
655bfbd1cf63714745da513082b6487e

SHA1
8cadb1e77cbc89e8929ddc8a424aefbc6400b355

SHA256
a1b6b43c5cb425ef11bfa3a32e4156202ae47ba16ebf5f9b4888bfb5cccb051d

SHA512
b0a779b054cfa5ce29af0d112251e654d4378ffa7af37f47d250431a0be485a317f307df8e4fc451b027acb5092a26611f7e4153e4fd64863f00494c214d7a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8354b7c9ed5b37fb1951b642e1cc4a71

SHA1
f0e5cdd225fd588dbae92afc18fc5993fa6e0043

SHA256
8c75be86d635e6bdb3571138353b216d026341effbe4c3930634610a95f807c6

SHA512
0ad3135b5770396707e3997d9de8315ee09939bbfba18d31a0156542d9a0021f523e1b1a33d79b460f2585e41bb300f2d65eb10c6968499b4b5ceb3f64f36703

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
576b900e632bf02c73ebf966ba480b3b

SHA1
6291d7549aa9c09361220b06eb74d5a015fd6f4b

SHA256
be71d3fbe1120cb33111450474cab5cda5ba2347913bc693bd0f71597ce78eef

SHA512
3a5379759b25699a6a6e62ac3e1a60e874a4743fcc489437bb3653b439b7935f38e4c2134c9e9ca65e000a09515d0e0739609a531dc7417de499d7e259cee210

Download Submit
C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe

Filesize
3.1MB

MD5
2ec8bb66e6d31a3eed3ab81af9c86633

SHA1
51775afa0bda90e7fb956897a0649302a6e3e862

SHA256
8c693ee26028976b6f9377f1a95e27cb821120e2ab6b5ffb885782f66eb59699

SHA512
a9b2fab76f360e7cdde888b205d823c062e9d883dfe97a066590a00e43ab2d6e8853223ff44e572bc221da03bd8f9bf2c419851783322172618f56a6e52c6d0a

Download Submit
memory/1132-9-0x000000001CD90000-0x000000001CE42000-memory.dmp

Filesize
712KB

Download
memory/1132-28-0x000000001CD30000-0x000000001CD6C000-memory.dmp

Filesize
240KB

Download
memory/1132-5-0x00007FFF0BB40000-0x00007FFF0C602000-memory.dmp

Filesize
10.8MB

Download
memory/1132-7-0x00007FFF0BB40000-0x00007FFF0C602000-memory.dmp

Filesize
10.8MB

Download
memory/1132-23-0x00007FFF0BB40000-0x00007FFF0C602000-memory.dmp

Filesize
10.8MB

Download
memory/1132-27-0x000000001CCD0000-0x000000001CCE2000-memory.dmp

Filesize
72KB

Download
memory/1132-8-0x000000001CC80000-0x000000001CCD0000-memory.dmp

Filesize
320KB

Download
memory/2056-21-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-20-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-11-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-10-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-17-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-16-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-12-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-18-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-22-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2056-19-0x00000299D3350000-0x00000299D3351000-memory.dmp

Filesize
4KB

Download
memory/2560-1-0x0000000000620000-0x0000000000944000-memory.dmp

Filesize
3.1MB

Download
memory/2560-0-0x00007FFF0BB43000-0x00007FFF0BB45000-memory.dmp

Filesize
8KB

Download
memory/2560-2-0x00007FFF0BB40000-0x00007FFF0C602000-memory.dmp

Filesize
10.8MB

Download
memory/2560-6-0x00007FFF0BB40000-0x00007FFF0C602000-memory.dmp

Filesize
10.8MB

Download
memory/5760-483-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-482-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-481-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-488-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-493-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-492-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-491-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-490-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download
memory/5760-489-0x0000021E32C40000-0x0000021E32C41000-memory.dmp

Filesize
4KB

Download