Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 02:26
Behavioral task
behavioral1
Sample
Quasar.v1.4.1.zip
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
Quasar.v1.4.1.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Quasar.v1.4.1.zip
Resource
win11-20240611-en
General
-
Target
Quasar.v1.4.1.zip
-
Size
3.3MB
-
MD5
13aa4bf4f5ed1ac503c69470b1ede5c1
-
SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
-
SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
-
SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
SSDEEP
49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1604 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1604 taskmgr.exe Token: SeSystemProfilePrivilege 1604 taskmgr.exe Token: SeCreateGlobalPrivilege 1604 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe 1604 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Quasar.v1.4.1.zip1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1604-2-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-1-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-0-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-7-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-12-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-11-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-10-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-9-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-8-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB
-
memory/1604-6-0x000001F21F440000-0x000001F21F441000-memory.dmpFilesize
4KB