Resubmissions
16-01-2025 18:07
250116-wqarmssrar 1016-01-2025 17:52
250116-wfwlcs1rdv 1016-01-2025 17:48
250116-wdtc8asmbk 10Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-01-2025 17:48
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/4776-342-0x0000029AE95B0000-0x0000029AE96E8000-memory.dmp family_quasar behavioral1/memory/4776-343-0x0000029AEB2F0000-0x0000029AEB306000-memory.dmp family_quasar -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 20 camo.githubusercontent.com 21 camo.githubusercontent.com 2 camo.githubusercontent.com 6 raw.githubusercontent.com 19 camo.githubusercontent.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133815234031581054" chrome.exe -
Modifies registry class 49 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 500031000000000047593265100041646d696e003c0009000400efbe4759005f305a408e2e0000002c570200000001000000000000000000000000000000464e0101410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 6600310000000000305a648e10005155415341527e312e3100004c0009000400efbe305a598e305a648e2e000000bb5c0200000004000000000000000000000000000000ed6173005100750061007300610072002000760031002e0034002e00310000001a000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000004759005f1100557365727300640009000400efbec5522d60305a408e2e0000006c0500000000010000000000000000003a00000000002dcc690055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\NodeSlot = "3" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 7e00310000000000305a598e11004465736b746f7000680009000400efbe4759005f305a598e2e000000365702000000010000000000000000003e00000000003ec1b3004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000 explorer.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Quasar.v1.4.1.zip:Zone.Identifier chrome.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3404 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1468 chrome.exe 1468 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1468 chrome.exe 1468 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe Token: SeShutdownPrivilege 1468 chrome.exe Token: SeCreatePagefilePrivilege 1468 chrome.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 4776 Quasar.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 1468 chrome.exe 4776 Quasar.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3404 explorer.exe 3404 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1468 wrote to memory of 1180 1468 chrome.exe 78 PID 1468 wrote to memory of 1180 1468 chrome.exe 78 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 912 1468 chrome.exe 79 PID 1468 wrote to memory of 2448 1468 chrome.exe 80 PID 1468 wrote to memory of 2448 1468 chrome.exe 80 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81 PID 1468 wrote to memory of 3080 1468 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/quasar/quasar1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa781ecc40,0x7ffa781ecc4c,0x7ffa781ecc582⤵PID:1180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1772 /prefetch:22⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:32⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2344 /prefetch:82⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4288,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4624 /prefetch:82⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4820,i,12372061297174276187,8600563757753710723,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4932 /prefetch:82⤵
- NTFS ADS
PID:4560
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:5040
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5076
-
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4776 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"2⤵PID:4076
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD568c7758e9c176afe88e89063bddc04a6
SHA1a7f2719517e344ce146f5b9142b258630c325b11
SHA25654ead0874ebfdbe36fee708218ef32cc0c55065c63c135026be191845c21a038
SHA5121adaaee5da03ad231f7da08223a395b9aa3944115b8daaf8156b2729e780c90eb715b7f5cc245ede256519c6b15c91e19b874daa255dc1984d968a7e411cff9b
-
Filesize
1KB
MD568081f376bcf5079304cee73f0213bcc
SHA1f976fb77ed8b1e7b86cfc17ddbc1f167124cfe8e
SHA256391e70fa0e2d29e63e65d1595d8e502c3c6f0e503abfb4f513f8bdb7b4017af6
SHA5128f863f146c290fdfab1fc8af17d16fbe72889b5a15a359fb730c2dc94ec771969fd1545aa90d258ef34457efa8011b7cb3fd258359ccd047d5cd8b6052a4f62e
-
Filesize
1KB
MD5105b6df13eabdc36c8d7d0a61b5d46b7
SHA1f4d3d9581cc3b41e81624459ae4e182b9ab7bf8a
SHA2560654104a96b81a66f75c2ed64acb8aa84b8719050e0a8cdd54d513271ebe3a92
SHA51203d653f306fe9485d437e612df0ed4b8dab0ab46a17a5757b9380bf7d37ea3bbd1e18ae5cd7d0bcd81fde3f73ad1548608b7422d79d2e7e55783adfeba9e668d
-
Filesize
2KB
MD5f9d49222b711cca6b67da961996e60c1
SHA1705d3573265bce3508662f4df4e19ff062745e5a
SHA2563d67f145c722ad7c4d4c4463869959b9fb12b455c584259a5323830c6b332c2a
SHA512474f7b2020360a71242bd0bd5ea7a81d1f7c7161b1b9b5384755e9b51ab57a6666cd3c9b265f640a9b1f911be749ec7324b7d172e137dfa2239dd8f9fb4e0ad0
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD57f214e0af1cda4e136a50c221eaf7d88
SHA18939aa5ede8362511aeb0c503151a7a8e54e711c
SHA256b85b752c9fe1118a40db69c8fc6c0835557b7c53e1c9ef85d8718aabefafa086
SHA512c651486953d54d97ec4be6fccfecb4d3c28b951554f67615cd859a44b659437c51a97806be8e1ef38479c08c0ce6346aa5edfe3f38ef7b2f8f33a99eb075ec8f
-
Filesize
1KB
MD511d11675a7ad26ea2c3ac9f1c63625d7
SHA19e5a444e461fa6788633d5034d89d1725d1374e5
SHA256fa3168ada2a8353ee5a48977f5e5c7a481d27592a69ec520c8073d244aa15b91
SHA512ca709ebccca9404aab5b291b9b66b2bb55c69b0f63e1ee88ddf7e2cc39c4c8878d0dedeff12653fc520e31268744ef03c21624f9fa890d5d14d6e9ea7056df0f
-
Filesize
9KB
MD544fe7ee1ee88cee267215abafd18d76d
SHA1303f0ada0e58c8bb473b5754ac58c16b946074a6
SHA2561273bf21c5cce1ee5c6c917c7f3353d2e63c81f39a5f42c49ccd07c385a8b461
SHA512f501c9cee0d8e57ab01e5c37604fd8acd35a120695665b4a9475cfb6cf7d42a74db63c0a928c7cf117165d8c09a7b3be3a57ba8074fa609924b9b9cda2fa8da8
-
Filesize
10KB
MD50082fbb4c4739ac20f6c5180586a0eb9
SHA15cb93d380720e2dd9af661835775515b7371d95f
SHA256555019941738658c22f67b86048f603efc381e6c87e3a2de836da6526cc117b6
SHA512bce9bd5c4a4c6e0280e28f92ea0e66f5ef247757919b2edc71421a2dc715fdef07a944733cc2f65e581b1bc6d41c694f8d7fb86a4d867a640d78b01464081a30
-
Filesize
9KB
MD559f90da3783a97bc8fc5c6c1afda0819
SHA13cc7f5b081ab8ba7d30c1949b9d03332996387e8
SHA256249ede16f6604363ee083b35d158cb0ab3da9801e36b09ec1823f790a329b585
SHA512bbe1545268df26ec2488b1c31c3305540bafbc38c566f45116eff02ebacd9ad8f267f28c4a6fd00dfdca92acb53fa478714cc1c7eed03d29fbadde0226544dcd
-
Filesize
9KB
MD596b007910c23664b99c212f8b1394e23
SHA1070c3a1ffd203fbc49739be2bd8bf653779359a8
SHA256461db6a07737a258d170a8dc3faad9e59cc416843f229fd9a409a3f5b01a405e
SHA5125a144b3a8e039af20b511d6af906ab8fcb9ad9ddde799b0a00f180f7e5c4874a56705be5af70289cfe0787132eb11791c3b729f8b2d7d00a06dae1ea16361d02
-
Filesize
228KB
MD534e245b5cd920d4efc8d68383b34d4db
SHA19edaf7f7d0b528d0c98a995e2c0be597164fa230
SHA2563eb4348d11e3256158d9ad118c6263e4aab08da97967af9b08b878d18a656a28
SHA51287ac0817706f34a4c33c0de82e846d7ebf3d72fabeb66406b4f4146abd8c092030575610526d6801b1aaa7016e552869f0dae3b4975000c9d3a8c7ee7496bd92
-
Filesize
228KB
MD5ffb29a4dc6951f6d538b2ed55edf52b8
SHA1affe94fba6b85fbeb81ae72230f5ac4e36753033
SHA256c211fb85ace00b8e0397ab088c68e8db3b3311b25fea354d00d5a62c56455ab7
SHA512a148eb8cde3ba2211b8e72985d32595b9f16dfd0d0580f78bd810fae74130cded10f4368e30b6832e1e32f38a2fc3e1f3a83e17c0e521f8f7a72408a940a1c1c
-
Filesize
228KB
MD5cebcc7e496b332b9c6dddd0786ea53e8
SHA1a743ae0f185628d717edd318bc9c7bb4099fc880
SHA256d41f23b366a6c58eacb3ae2498a3c691bc7c7c72cabfc6f8e06e73bfc44a2aef
SHA512df60511c883c4fb9c86bf25392439b5236c4f512c4a7a44663a867883ae7d20f61b4bfeb17793a6897dafb348ad9bc4a9ce6b2c136e5ce056d1c915442182f09
-
Filesize
264KB
MD51fe7fb512a2f7a834528eeca12945b2f
SHA1a10c2865217db9408f7824e27878408af65865c1
SHA256a98fe544ee978dd1c44c048151d3913bd5a92db5fb942ac7b234b43dc8e0b982
SHA512664d203acb16df2fd2a9b9910332c61c93324822f966d755ce1a1b804f39e90a6717675fd833b763141ea6c3abd4a0dca49ebe37e8b86ed455b42ae6ff733c1e
-
Filesize
4KB
MD5561ca23b2bba56424f6bdbeb451e7ac9
SHA1e47378ff59af9a2cf3da34511a110ff75088da6c
SHA256fe72094eaa842e4087f0be615c9db36f72478f68243d6c429c04d1fbcd69bfd7
SHA512dff78d61ad2a44fb60d33705441bdc0e4086bf89826dcb2b4180393c28d6f6f8c770b2a140df5e30aa38b98c47385ffcd8d966229f10dd58a7776eaf19b19194
-
Filesize
3.3MB
MD513aa4bf4f5ed1ac503c69470b1ede5c1
SHA1c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA2564cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
SHA512767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
Filesize
92B
MD539a3b0befd4479419cc341e48a664d5e
SHA1898fbd900ebd37b8a01dbce057253268cdbf194b
SHA2566e1ff9662b14a8458c528a745b0f7c02036649878d0b3a5895ca113f40b248c3
SHA51255b85d39b4d336ef45eb293d77fc19832228d57ad59abed9da4a838b9ef4b53f9493391c32004146b474b1f88f9fc1d0e10fabcfe24178a9275aa88238a70b2b