Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Quasar.v1.4.1.zip
windows7-x64
10Quasar.v1.4.1.zip
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....e.html
windows7-x64
3Quasar v1....e.html
windows10-2004-x64
3Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....se.txt
windows7-x64
1Quasar v1....se.txt
windows10-2004-x64
1Quasar v1....to.dll
windows7-x64
1Quasar v1....to.dll
windows10-2004-x64
1Quasar v1....ok.dll
windows7-x64
1Quasar v1....ok.dll
windows10-2004-x64
1Quasar v1.4.1/LICENSE
windows7-x64
1Quasar v1.4.1/LICENSE
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
1Quasar v1....ks.dll
windows7-x64
1Quasar v1....ks.dll
windows10-2004-x64
1Quasar v1....il.dll
windows7-x64
1Quasar v1....il.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 12:30
Behavioral task
behavioral1
Sample
Quasar.v1.4.1.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Quasar.v1.4.1.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Quasar v1.4.1/3rdPartyLicenses/Be.HexEditor_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Quasar v1.4.1/3rdPartyLicenses/Be.HexEditor_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Quasar v1.4.1/3rdPartyLicenses/GlobalMouseKeyHook_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Quasar v1.4.1/3rdPartyLicenses/GlobalMouseKeyHook_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Quasar v1.4.1/3rdPartyLicenses/Mono.Cecil_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Quasar v1.4.1/3rdPartyLicenses/Mono.Cecil_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Quasar v1.4.1/3rdPartyLicenses/Open.Nat_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Quasar v1.4.1/3rdPartyLicenses/Open.Nat_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Quasar v1.4.1/3rdPartyLicenses/ResourceLib_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Quasar v1.4.1/3rdPartyLicenses/ResourceLib_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Quasar v1.4.1/3rdPartyLicenses/SilkIcons_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Quasar v1.4.1/3rdPartyLicenses/SilkIcons_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Quasar v1.4.1/3rdPartyLicenses/protobuf-net_license.txt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Quasar v1.4.1/3rdPartyLicenses/protobuf-net_license.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Quasar v1.4.1/LICENSE
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Quasar v1.4.1/LICENSE
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win10v2004-20241007-en
General
-
Target
Quasar.v1.4.1.zip
-
Size
3.3MB
-
MD5
13aa4bf4f5ed1ac503c69470b1ede5c1
-
SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
-
SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
-
SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
SSDEEP
49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
Malware Config
Extracted
quasar
-
reconnect_delay
5000
Extracted
quasar
1.4.1
Office04
127.0.0.1:4782
460b3828-f738-4758-8b90-b34d6c48afd6
-
encryption_key
F122C497DF9EAA3340EC892D5AED1D6340233BC4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 11 IoCs
resource yara_rule behavioral1/files/0x000500000001a4b5-44.dat family_quasar behavioral1/memory/1924-47-0x00000000012C0000-0x00000000013F8000-memory.dmp family_quasar behavioral1/files/0x000500000001a4b3-48.dat family_quasar behavioral1/memory/1924-49-0x0000000000500000-0x0000000000516000-memory.dmp family_quasar behavioral1/files/0x000500000001a487-82.dat family_quasar behavioral1/files/0x000500000001a4c5-143.dat family_quasar behavioral1/files/0x000500000001a4cb-183.dat family_quasar behavioral1/memory/1036-185-0x0000000000FC0000-0x00000000012E4000-memory.dmp family_quasar behavioral1/memory/1584-192-0x0000000000360000-0x0000000000684000-memory.dmp family_quasar behavioral1/memory/2816-194-0x0000000000310000-0x0000000000634000-memory.dmp family_quasar behavioral1/memory/2892-196-0x0000000000D40000-0x0000000001064000-memory.dmp family_quasar -
Executes dropped EXE 5 IoCs
pid Process 1924 Quasar.exe 1036 Client-built.exe 1584 Client.exe 2816 Client-built.exe 2892 Client-built.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Quasar.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe Quasar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\NodeSlot = "2" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Quasar.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7a00310000000000365ad86311004465736b746f7000640008000400efbe4a59dc44365ad8632a000000ec0100000000020000000000000000003a00000000004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).y = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "1075" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4c003100000000004a596c4b100041646d696e00380008000400efbe4a59dc444a596c4b2a00000033000000000003000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "275" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).top = "75" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 74003100000000004a59dc441100557365727300600008000400efbeee3a851a4a59dc442a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 6200310000000000365ae06310005155415341527e312e310000480008000400efbe365ad863365ae0632a0000002c20010000000a0000000000000000000000000000005100750061007300610072002000760031002e0034002e00310000001a000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).bottom = "675" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Quasar.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2144 schtasks.exe 2132 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2316 7zFM.exe 1924 Quasar.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 2316 7zFM.exe Token: 35 2316 7zFM.exe Token: SeSecurityPrivilege 2316 7zFM.exe Token: SeDebugPrivilege 1924 Quasar.exe Token: SeDebugPrivilege 1036 Client-built.exe Token: SeDebugPrivilege 1584 Client.exe Token: SeDebugPrivilege 2816 Client-built.exe Token: SeDebugPrivilege 2892 Client-built.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2316 7zFM.exe 2316 7zFM.exe 2316 7zFM.exe 1924 Quasar.exe 1924 Quasar.exe 2728 explorer.exe 1924 Quasar.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1924 Quasar.exe 1924 Quasar.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1924 Quasar.exe 1924 Quasar.exe 1584 Client.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2336 1924 Quasar.exe 34 PID 1924 wrote to memory of 2336 1924 Quasar.exe 34 PID 1924 wrote to memory of 2336 1924 Quasar.exe 34 PID 1036 wrote to memory of 2144 1036 Client-built.exe 41 PID 1036 wrote to memory of 2144 1036 Client-built.exe 41 PID 1036 wrote to memory of 2144 1036 Client-built.exe 41 PID 1036 wrote to memory of 1584 1036 Client-built.exe 43 PID 1036 wrote to memory of 1584 1036 Client-built.exe 43 PID 1036 wrote to memory of 1584 1036 Client-built.exe 43 PID 1584 wrote to memory of 2132 1584 Client.exe 44 PID 1584 wrote to memory of 2132 1584 Client.exe 44 PID 1584 wrote to memory of 2132 1584 Client.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Quasar.v1.4.1.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2316
-
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"2⤵PID:2336
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2728
-
C:\Users\Admin\Desktop\Client-built.exe"C:\Users\Admin\Desktop\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2144
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2132
-
-
-
C:\Users\Admin\Desktop\Client-built.exe"C:\Users\Admin\Desktop\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
C:\Users\Admin\Desktop\Client-built.exe"C:\Users\Admin\Desktop\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2039016743-699959520-214465309-1000\a2dd33506bcf8715202318f787070c1d_d58f30ce-7498-4544-8c46-d67b11e386bc
Filesize3KB
MD574a1322ea7cea3d06973e8f9fd9ed4a4
SHA17ffdf995fe9bd6ea55e2ecf1d87537a340e030fb
SHA256b83a4041e8b70cca6b064f754ef49fd68a97b168ac14455f60bd98bb6f21f7b4
SHA51219551177b48e244080ec3bb3054bdfb6f8f211e4b3cddc1b2a82fa0c9ddd6623b7fd5031388390fd9637fcb2ab0f4c3a625a34092e382fc37274192bad9937bf
-
Filesize
3.1MB
MD546a077251d4976ce992b7c0bb99c5dae
SHA1362d83ab3ba133882d1a949154c3abd7a3992db2
SHA2564cc336f4ad9b50f48c7c761473e2dfe15a5cc138bba0b886afb56f1ffa59c1f5
SHA512d8b10d1c5e8606166cd19a1979c367db1700a3b76091216eb658342639571992db373e1dc57bde3d0685fe65aea96dd8bccb25d8f2d420bec86058d2f75f67b1
-
Filesize
3.2MB
MD50cf454b6ed4d9e46bc40306421e4b800
SHA19611aa929d35cbd86b87e40b628f60d5177d2411
SHA256e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
SHA51285262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
-
Filesize
3.1MB
MD5df7598e580cad506f7dc5577c5bd18a3
SHA1259f88d8ae65015e5f0ad7d751eb0365f7e91c4c
SHA256482a29e67a1c2afb1792d18a7045f8d805fa99fd06ae4584bac969cfc24aa00e
SHA51211eadec82fc5d6dae8b6094fcbbc3b77859aeb5171711df845ffb4ab547cd3a29415f1d5052eea619cf7401c9c3bc2effb9d9a46e86ca70021b0d14f292472eb
-
Filesize
56KB
MD5bfb3bd1cb571360435100bfa6ed2b997
SHA11325e8dd76180a165117e04da4ee4a020e996880
SHA256a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef
SHA512ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15
-
Filesize
1KB
MD52656bf9fcaf47fa043715bbd3b2f5134
SHA15832164b16008d7396501f857f9f5f8799fd179c
SHA25649a25b5003ae74dc02141ba8cd29e1515baf4a2bf8d783019cc2148e07688b9b
SHA5124d8ca0fc4a8aca853925df5d93eeed1e7c232e1e3816fe096cf153bc6ff802258b7d7c58cbaab4817c3eb4acc7f888b0c622400783fdd3140c7fd954a40c095d
-
Filesize
42KB
MD51c6aca0f1b1fa1661fc1e43c79334f7c
SHA1ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
SHA256411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
SHA5121c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
-
Filesize
87KB
MD56d5eb860c2be5dbeb470e7d3f3e7dda4
SHA180c76660b87c52127b1a7da48e27700f75362041
SHA256447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
SHA51264cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
-
Filesize
27KB
MD56e7f0f4fff6c49e3f66127c23b7f1a53
SHA114a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
SHA2562e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
SHA5120c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
-
Filesize
350KB
MD5de69bb29d6a9dfb615a90df3580d63b1
SHA174446b4dcc146ce61e5216bf7efac186adf7849b
SHA256f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
SHA5126e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
-
Filesize
68KB
MD5cc6f6503d29a99f37b73bfd881de8ae0
SHA192d3334898dbb718408f1f134fe2914ef666ce46
SHA2560b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5
SHA5127f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f
-
Filesize
1018B
MD553533846da6fb0114f65ea865f50fac5
SHA14d502fe2d04b6b5970d9f0a0540c35c9e75eba95
SHA256941970a02c9d91c77d70e1f3d16ebdb18d292735e0715d2bbcbcd07019bbe9c4
SHA51212e133c1291072157ed5cea5e8646a84f831e009eb4dc4e0842ac2b963aaca04d4ac52ade10a9650d4a03ad94a999da6529437a9017424b15e784b543760ba63
-
Filesize
199B
MD549b95159190c0bf5e00d01d1fd371513
SHA1ffc6d33cb2294a35fc1c4d6aac25e3b66151e52c
SHA2565becabb6ceb694417fba7e6e62bdaa62c5dbc37ccea0d718313365b6f0a73db2
SHA5127c1a75c4612271fc789ab64b615bb5016598f93cd61633143c71b0576a1bd1be2b0c5b335a8eb1138b0ff41ef6b983efdbbe1af8bd0055289b8c399ef66ec6b7
-
Filesize
62KB
MD52185564051ea2e046d9f711ed3cd93ff
SHA12f2d7fd470da6d126582ad80df2802aabd6c9cea
SHA256de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2
SHA51200af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868
-
Filesize
1.2MB
MD512ebf922aa80d13f8887e4c8c5e7be83
SHA17f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA25643315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
-
Filesize
176B
MD5c8cd50e8472b71736e6543f5176a0c12
SHA10bd6549820de5a07ac034777b3de60021121405e
SHA256b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190
SHA5126e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f
-
Filesize
76KB
MD5944ce5123c94c66a50376e7b37e3a6a6
SHA1a1936ac79c987a5ba47ca3d023f740401f73529b
SHA2567da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
SHA5124c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
-
Filesize
3.1MB
MD5f4d16cfe4cad388255e43f258329f805
SHA1fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
SHA2568fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
SHA512867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
-
Filesize
282KB
MD5abc82ae4f579a0bbfa2a93db1486eb38
SHA1faa645b92e3de7037c23e99dd2101ef3da5756e5
SHA256ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6
SHA512e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3
-
Filesize
4KB
MD5987ef5e5c2499bd1dc48bb7bc6ec162d
SHA1e055ee684e1bacd728880eb7c6d5adeac7bae7b9
SHA25632c8bf9e819d9a818e1e6019a3ff36f9e0f1822ab6f163fda16e385e1fef7959
SHA5124dcbb972b2f2ac70c89732ff86054810617fd5688e8e579d21bc821fbdc03bdf33c448b1d60131ee7086547cc25552a84630318b22c834400ea94f95e86f18e7