quasar | f935aa86278a25e8f537a4b2663d5f3126cc112aac450643edd1cff2c3cf35ab

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	DatacenterUGPP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	JaffaCakes118_1cececc0c2136ae507cbda82380546aa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	re.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	DatacenterUGPP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	DatacenterUGPP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	._cache_re.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe

Executes dropped EXE 16 IoCs

pid	Process
1844	re.exe
1756	._cache_re.exe
756	Synaptics.exe
2160	Synaptics.exe
5952	._cache_re.exe
3416	._cache_Synaptics.exe
4172	._cache_Synaptics.exe
4468	._cache_Synaptics.exe
5360	._cache_._cache_re.exe
880	._cache_Synaptics.exe
4424	._cache_._cache_Synaptics.exe
4964	._cache_._cache_Synaptics.exe
1472	DatacenterUGPP.exe
3560	DatacenterUGPP.exe
5964	DatacenterUGPP.exe
5352	DatacenterUGPP.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	re.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com
103	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\._cache_._cache_Synaptics.exe	._cache_Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_._cache_Synaptics.exe	._cache_Synaptics.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 5952	1756	._cache_re.exe	95
PID 3416 set thread context of 4172	3416	._cache_Synaptics.exe	98
PID 4468 set thread context of 880	4468	._cache_Synaptics.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3840	1472	WerFault.exe	109
1812	3560	WerFault.exe	136
4380	5964	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DatacenterUGPP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DatacenterUGPP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DatacenterUGPP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_._cache_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DatacenterUGPP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3280	PING.EXE
5340	PING.EXE
6084	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	re.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	._cache_re.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	._cache_Synaptics.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5340	PING.EXE
6084	PING.EXE
3280	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
412	schtasks.exe
5048	schtasks.exe
5608	schtasks.exe
744	schtasks.exe
4124	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2396	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5360	._cache_._cache_re.exe
Token: SeDebugPrivilege	1472	DatacenterUGPP.exe
Token: SeDebugPrivilege	3560	DatacenterUGPP.exe
Token: SeDebugPrivilege	5964	DatacenterUGPP.exe
Token: SeDebugPrivilege	5352	DatacenterUGPP.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
1472	DatacenterUGPP.exe
3560	DatacenterUGPP.exe
5964	DatacenterUGPP.exe
2396	EXCEL.EXE
5352	DatacenterUGPP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1844	224	JaffaCakes118_1cececc0c2136ae507cbda82380546aa.exe	86
PID 224 wrote to memory of 1844	224	JaffaCakes118_1cececc0c2136ae507cbda82380546aa.exe	86
PID 224 wrote to memory of 1844	224	JaffaCakes118_1cececc0c2136ae507cbda82380546aa.exe	86
PID 1844 wrote to memory of 1756	1844	re.exe	90
PID 1844 wrote to memory of 1756	1844	re.exe	90
PID 1844 wrote to memory of 1756	1844	re.exe	90
PID 1844 wrote to memory of 756	1844	re.exe	93
PID 1844 wrote to memory of 756	1844	re.exe	93
PID 1844 wrote to memory of 756	1844	re.exe	93
PID 1580 wrote to memory of 2160	1580	cmd.exe	94
PID 1580 wrote to memory of 2160	1580	cmd.exe	94
PID 1580 wrote to memory of 2160	1580	cmd.exe	94
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 1756 wrote to memory of 5952	1756	._cache_re.exe	95
PID 756 wrote to memory of 3416	756	Synaptics.exe	96
PID 756 wrote to memory of 3416	756	Synaptics.exe	96
PID 756 wrote to memory of 3416	756	Synaptics.exe	96
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 3416 wrote to memory of 4172	3416	._cache_Synaptics.exe	98
PID 2160 wrote to memory of 4468	2160	Synaptics.exe	99
PID 2160 wrote to memory of 4468	2160	Synaptics.exe	99
PID 2160 wrote to memory of 4468	2160	Synaptics.exe	99
PID 5952 wrote to memory of 5360	5952	._cache_re.exe	100
PID 5952 wrote to memory of 5360	5952	._cache_re.exe	100
PID 5952 wrote to memory of 5360	5952	._cache_re.exe	100
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4468 wrote to memory of 880	4468	._cache_Synaptics.exe	101
PID 4172 wrote to memory of 4424	4172	._cache_Synaptics.exe	103
PID 4172 wrote to memory of 4424	4172	._cache_Synaptics.exe	103
PID 4172 wrote to memory of 4424	4172	._cache_Synaptics.exe	103
PID 880 wrote to memory of 4964	880	._cache_Synaptics.exe	104
PID 880 wrote to memory of 4964	880	._cache_Synaptics.exe	104
PID 880 wrote to memory of 4964	880	._cache_Synaptics.exe	104
PID 5360 wrote to memory of 5608	5360	._cache_._cache_re.exe	107
PID 5360 wrote to memory of 5608	5360	._cache_._cache_re.exe	107
PID 5360 wrote to memory of 5608	5360	._cache_._cache_re.exe	107
PID 5360 wrote to memory of 1472	5360	._cache_._cache_re.exe	109

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1cececc0c2136ae507cbda82380546aa.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1cececc0c2136ae507cbda82380546aa.exe"
1⤵
- Quasar RAT
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\re.exe
  "C:\Users\Admin\AppData\Local\Temp\re.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\._cache_re.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_re.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\._cache_re.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_re.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\._cache_._cache_re.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_re.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5360
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "DataenterQuasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_re.exe" /rl HIGHEST /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5608
      - C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "DataenterQuasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o1dzuoEnpvw5.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3280
        
        C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "DataenterQuasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jcwK5GlrRHKz.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5340
        
        C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5964
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "DataenterQuasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe" /rl HIGHEST /f
        11⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EVGWGzzZZvDV.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6084
        
        C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5352
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "DataenterQuasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DatacenterUGPP.exe" /rl HIGHEST /f
        13⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 2212
        11⤵
        Program crash
        
        PID:4380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 2092
        9⤵
        Program crash
        
        PID:1812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 2228
        7⤵
        Program crash
        
        PID:3840
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_Synaptics.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\ProgramData\Synaptics\Synaptics.exe
  C:\ProgramData\Synaptics\Synaptics.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\._cache_Synaptics.exe
    "C:\Windows\system32\._cache_Synaptics.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:880
    - - C:\Windows\SysWOW64\._cache_._cache_Synaptics.exe
        
        "C:\Windows\system32\._cache_._cache_Synaptics.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4964

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1472 -ip 1472
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3560 -ip 3560
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5964 -ip 5964
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery