asyncrat | 7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07

Analysis

max time kernel
202s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe
Size

4.4MB
MD5

b9182a18d285439d5a8f54e43acf7ed0
SHA1

6bdb5cb62375d0defb52426fd55f1e73ade3a9a9
SHA256

7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07
SHA512

7f0007306704cddff6070d90b44fd737a458b2169a9e5cba5cce25c1d63de51973b063600fe482b9c51470d9856a82d88b4a7ad9869499fa27169c83b5e1463f
SSDEEP

98304:AyXPoKTkGvDygM1dqd4gCNMTcrSahyeCKWkxla:Pzv2P1gx8tc50xk

Score

10^/10

asyncrat 默认 rat

Malware Config

Extracted

Family

asyncrat

Version

萝莉控

Botnet

默认

cn-gx-plc-1.openfrp.top:25565

cn-gx-plc-1.openfrp.top:48454

Mutex

火绒远程管理

Attributes

delay
1
install
true
install_file
Windows Updata.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1872-62-0x0000000001FF0000-0x0000000002006000-memory.dmp	asyncrat

Executes dropped EXE 2 IoCs

pid	Process
908	HMCL-3.5.3.exe
1872	Windows_Updata.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_7136936	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe
File created	C:\Windows\HMCL-3.5.3.exe	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe
File opened for modification	C:\Windows\HMCL-3.5.3.exe	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe
File created	C:\Windows\Windows_Updata.exe	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe
File opened for modification	C:\Windows\Windows_Updata.exe	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d49e9efd33d9f34a8a2e004ebdd0dcb200000000020000000000106600000001000020000000621d4603dccaf9afacaa467d55e0e968440e4e057fa4f4da352892f977780c96000000000e80000000020000200000004aa582b522bc8d71f6f6e8fb2a1ab6635c5611086feeed97aa99f1a78dbf9f652000000071cb0cd5f6325058b3b19e306468f95c8dccd606802db3ac8249f357a62585b94000000086cb310611b2961c3c0961c75cdc4e35126a43ccb4f853c6ea513421d701f9c3bccfe5b3def3b63b71a1c00305f98f3707002b45161462154f7cefdf33e727f3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382990248"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "231"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "266"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "266"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "42"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "209"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "209"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "231"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "224"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28039AE1-AB00-11ED-9B9F-7AEFAD47A2D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "229"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "266"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d065fb0b0d3fd901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d49e9efd33d9f34a8a2e004ebdd0dcb200000000020000000000106600000001000020000000e045a418d0eb8d8fee5ba054d4471fee2fea4d5fad3b41ff415209c8da4e1ff1000000000e80000000020000200000007368f5eb88b85abbea2715e5de4cbce4141207e06d3c9200791f6737be6dcb0b10010000ea75f8e17b8466710814e1eb48e7b630c5a054e716d81a6ed759092f83de5822751deab399e815360629092f334c3f3a1bc57745075c035caa2ef6e671dae9e0e1e62f888f0a106de5d5ebfda9f6a0daef2c3cd3365362e6d4a10dcc598e8856a3c47d8249279d1f25a4d4e7203754766d16d9e0fd636586dd9f287fcdf827238ec1b200dbe139eeeb91a6e53f22454c958c9f692c2d4f8e235c59cd91676c6e6379cdcff4865a3cd485dbd794c1c74169b00c760e1adca4e41523c16dcf6152f93054aae660d50acdf49ec01288858fe34d8627c05ef87374c1c00982733014d7a50940404d88ab5385746f564f15b5e316a2ae7e24aba2fd845154aea04af5d96012a8a5250c9f3d2d244a111c0d8f400000006998ca3101f697d7610f2977c6e7921a24b5550d5488d7bbe64bc4e1e20e0af0035c3b8ebaa5ed1f928d6a5d3503e141e0cb528fb64bb935aa8d36457b7065d2	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe
1872	Windows_Updata.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	Windows_Updata.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
564	iexplore.exe
564	iexplore.exe
604	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 908	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	27
PID 1304 wrote to memory of 908	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	27
PID 1304 wrote to memory of 908	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	27
PID 1304 wrote to memory of 908	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	27
PID 1304 wrote to memory of 1872	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	28
PID 1304 wrote to memory of 1872	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	28
PID 1304 wrote to memory of 1872	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	28
PID 1304 wrote to memory of 1872	1304	7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe	28
PID 908 wrote to memory of 564	908	HMCL-3.5.3.exe	30
PID 908 wrote to memory of 564	908	HMCL-3.5.3.exe	30
PID 908 wrote to memory of 564	908	HMCL-3.5.3.exe	30
PID 908 wrote to memory of 564	908	HMCL-3.5.3.exe	30
PID 564 wrote to memory of 604	564	iexplore.exe	32
PID 564 wrote to memory of 604	564	iexplore.exe	32
PID 564 wrote to memory of 604	564	iexplore.exe	32
PID 564 wrote to memory of 604	564	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe
"C:\Users\Admin\AppData\Local\Temp\7dd1b9c77b656ecbff01099deec50c1c65a19168fa1314869fca22f3193f6d07.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\HMCL-3.5.3.exe
  "C:\Windows\HMCL-3.5.3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://java.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:604
- C:\Windows\Windows_Updata.exe
  "C:\Windows\Windows_Updata.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
462f125b244253af2398adfe00354b77

SHA1
b26ce28ddb4b8ffd243671e90c44fc2e8c332f50

SHA256
a4ce7eb7c45cf6080912088908c4d3a0f2a12e37a11a8c7258be93966732f8e3

SHA512
cf8054fb3e90580afc51ed955c7479838ff8298d96b953a59b24f0a853b7e050fd9d6ef7356c0cfe420adfa352e62b3ddd7cac2afbd3c63fc2bf3c867a908868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t9o3c8r\imagestore.dat

Filesize
1KB

MD5
3130f97c268d30d64aa5fff9c1cd10eb

SHA1
f3ce52fd051cb00c0825fe44d330eaf621ad825a

SHA256
03a4a21d4c8bf2c164de7ac4381e669c57892dd3af9878288201ad8fccce7454

SHA512
f398b11c9ca87ea68e14e76f9a739bc92af435298a89af75225f67a32e5def092cab18b90f294666baad115e8013e5af32d8ddb514324fc2e6452bb6e4ad967a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IYE87ELC.txt

Filesize
601B

MD5
a5c61af2da3da30109090a6e901bdc8e

SHA1
eeb0bc89bf47aacb319e032f5bd2c95250387052

SHA256
362437049ee228da5fee3969dd9c8cf4434ef32b7800e0f250446903262f896c

SHA512
bd99152f7d0e2cc6ff3e78768945418c065e8697648b20a27353df6f4e39f96e482cf5a60d8ef85e2a3c7b6c53050886e44d0b5ae3d8ccabbd3a3b1890974d62

Download Submit
C:\Windows\HMCL-3.5.3.exe

Filesize
4.4MB

MD5
a29167e249e8c1113a92bc033335b998

SHA1
71d097d12491a6e0c9e3b3bffaf98065ab322631

SHA256
bd7c8ea1eea5054a5a5c9c29c4a001c1b8f33036fccbed309801dd6f9e59234c

SHA512
f7aea383587840d34cc3eacbb87a33afb40e76f768c170407c4ea3694451f83d1778fa66647a50ef9a656e098443e1acae192eb66287a426ebe9743ee97d1738

Download Submit
C:\Windows\Windows_Updata.exe

Filesize
152KB

MD5
739f33737de20fb9037ea304b0953249

SHA1
eb91946ff053272c4437b7d01cd2bf26f8954e10

SHA256
e22c92f125e5575b186ee09a98809b3addc86c5a827a81511170f87dc7244875

SHA512
41146a7ac8f17d839c291eff991cb0d552d54cc6487a65d4122d546e1a608f2db0a3ee83295923e47dbfdc2aa5e11fe6a7244f0f720cf7449372eec217348996

Download Submit
memory/1304-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1872-61-0x00000000005C0000-0x00000000005D9000-memory.dmp

Filesize
100KB

Download
memory/1872-62-0x0000000001FF0000-0x0000000002006000-memory.dmp

Filesize
88KB

Download