asyncrat | a1094fd210d9c5845758c9c144a863b0d98fcd71e5fff9ce6ea2abe6b25e0fc2

Resubmissions

12/02/2023, 17:24

230212-vyv7wafd49 10

12/02/2023, 14:28

230212-rs1cvsee85 1

Analysis

max time kernel
1237s
max time network
1245s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoogleUpdateCore.exe
Size

339KB
MD5

dffce796a69f576b2ce5161c5bf23249
SHA1

9cfac609a83d93c7727a6cfa8ee75c2f3d5d7281
SHA256

a1094fd210d9c5845758c9c144a863b0d98fcd71e5fff9ce6ea2abe6b25e0fc2
SHA512

959a626766dd615b4022dacc9dcebc845cdafc82f37ecbd3264e7dc2e6a8c65c15ecb54561d7991f4593d3f5bdb1fe6064dbb722eb4e59e92e93b7820e857289
SSDEEP

3072:fub/CFYzAFsmRZIK3D8tjoBYOh8joBYOhVjoBYOhAeaqJsQy4Wr/CCs3iI84450v:fa/CVZ3D8OeaWyXVsa44vBjjzue8GMu

Score

10^/10

asyncrat https://api.telegram.org/bot rat

Malware Config

Extracted

Family

asyncrat

Version

丽杰ョょ诶жצョרョバぎウ東バ尺迪迪制Ежर马ばぎंょ煙

Botnet

https://api.telegram.org/bot

Mutex

713693179

Attributes

delay
9000
install
false
install_file
notepad.exe
install_folder
رچىقمپازجغنصشعیوهاخجطۆلقهنهم..
pastebin_config
https://www.youtube.com/

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral2/memory/1212-68-0x0000000000400000-0x0000000000436000-memory.dmp	asyncrat
behavioral2/memory/1212-69-0x0000000000400000-0x0000000000436000-memory.dmp	asyncrat
behavioral2/memory/1212-70-0x0000000000400000-0x0000000000436000-memory.dmp	asyncrat
behavioral2/memory/1212-74-0x0000000000400000-0x0000000000436000-memory.dmp	asyncrat
behavioral2/memory/1212-76-0x0000000000400000-0x0000000000436000-memory.dmp	asyncrat
behavioral2/memory/1212-71-0x0000000000431D9E-mapping.dmp	asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1972	tmp1D6F.tmp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 1212	1972	tmp1D6F.tmp.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	GoogleUpdateCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	GoogleUpdateCore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	GoogleUpdateCore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	GoogleUpdateCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	GoogleUpdateCore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	GoogleUpdateCore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
932	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe
1636	GoogleUpdateCore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	GoogleUpdateCore.exe
Token: SeDebugPrivilege	1212	InstallUtil.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1972	1636	GoogleUpdateCore.exe	29
PID 1636 wrote to memory of 1972	1636	GoogleUpdateCore.exe	29
PID 1636 wrote to memory of 1972	1636	GoogleUpdateCore.exe	29
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1212	1972	tmp1D6F.tmp.exe	30
PID 1972 wrote to memory of 1952	1972	tmp1D6F.tmp.exe	31
PID 1972 wrote to memory of 1952	1972	tmp1D6F.tmp.exe	31
PID 1972 wrote to memory of 1952	1972	tmp1D6F.tmp.exe	31
PID 1952 wrote to memory of 932	1952	cmd.exe	33
PID 1952 wrote to memory of 932	1952	cmd.exe	33
PID 1952 wrote to memory of 932	1952	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\GoogleUpdateCore.exe
"C:\Users\Admin\AppData\Local\Temp\GoogleUpdateCore.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\tmp1D6F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1D6F.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" w4khkLFu3HEG3bx6A21EYGEQQO6B6kSn3s2F9JrUHvFWQPQ30rnPnBu6RiEJ1cPbkn5IIpQLWNX6FTBUEDoU3ndj6l5e1MGt9l1NBCV2Y1w1uM8JAo0bIGYeE56AAK6C7MX7F3BKI3LKMT293Y4KxBRHxAOLRYLBRu3gYLgn3gMD3Haj487U2W9E8B2xl1vjyFDsHLEDE6m42mJoi3oUm8O8P3OiIDVuRt46XIAO99hVMb0GVA6YTDgRk8RJ4B2H9F0M2swq4VSTTB8YIX4hJKTOb40Fgh7Vb2RO390yTw5OVllI2GKL8Ttov24RUXLYPF45GS3mbrIPiGWI3xLH292J98l4Fe1319qP56H4O008tpg0oIA43bucb33urj146oFM92wHOTLX3ILk7JD5AT37623dk5OBhf6C11phrOVWEK4uPf7SC79g16fl9HRXdA32HA9qDQ6MU7BDK8NBE1u7yQ5ASQkEVypv2XExo2EMm8137R2IAvJ22YMUt1EPu9soOC3hfLOG1Yc8WArEmG0CCFP1FSd596OSqcG3K31c6n60EvGF76cq7LB4U9gQ090g0oXGMTw9B5HC14EePE6P22wpQ91E8STQ35YPfTGcu81V7lqy6e3IM73ht0wR26D6RYh7G69TMUI3Q2hnXwR3Al55vF05CUBPFV4S8X5ggdFhPD1B3SdAC55bmMivGv8AHyh456RPX3928JRXELoTW462tHF4e2QmY1P072IRNP3L6771Q6TCu2W8uhUH4xK6xFYoD6PXRPhyqF2M38rLJxJqy1jBB66yniLYWjwRKe2reqUCYOH1WQ16geQaQXxVbJCocB0FDYW6362cVYb2M4GV6Q9pajxY40CYRCYXt841cEw4W6S54ILXIPraGBsLPfU59jsF7hAL0T1U7UqiqByKTFt6SI0XJ50YDCrk5iex6711a198F61NL3m6A7J6m76yIjYXdb3ILcDYIGS609ih0GEP5Cgt6UkI0Ayx31Q01LCo7pvNc5E1Yy
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\system32\cmd.exe
    "cmd" /c ping google.com & del "C:\Users\Admin\AppData\Local\Temp\tmp1D6F.tmp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\system32\PING.EXE
      ping google.com
      4⤵
      Runs ping.exe
      PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9feeab957d395302d8e609b750901d9e

SHA1
2ee7d375d9ced3260bace976d1c67360fbef7cf0

SHA256
3aff74ea2e94b4078ea91d6441f1767411ba8e208603cfd31d81b3707cdb9f37

SHA512
826065d453b0e01244f65000764634f6422ea927afd46b075eee0182ba17630d1e1bc7f30837ad5e5312ccb8b884e652c53cf20bb56715ddb01f2d8e2a62e429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a301c450c299f517d4a0474479f49e3b

SHA1
b4f76e7e9124ddb1304e6dce1df52c8600e02886

SHA256
8f0c71dd4786dc4f6b1797905f5d0dd498fececdbfc31760839194704061a29e

SHA512
09853282ad6732be2e08a4c1bd6c62d91f23c7be72d054bb5e7484e8de980925c0cfdfaad63329ce18d5b4d0e064cc464ade12abb8bbde5c748b19a8248f89c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D6F.tmp.exe

Filesize
688KB

MD5
3cfa08af2e428627fc94d12cf816fa84

SHA1
fd620819a91ab99ccf03e564803da214775be163

SHA256
d76a3ee345f410aebfc11949c542acfea7b7445c3e396f1f2d7a785875d3595d

SHA512
95e0250f1686e36a5073d8b39a6833c30ad5447858edbc890fedd71393cbb4dd6d084f7b1442ebc78d56f6dd3b0b3794f12b7fad148d234407d7954856132848

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D6F.tmp.exe

Filesize
688KB

MD5
3cfa08af2e428627fc94d12cf816fa84

SHA1
fd620819a91ab99ccf03e564803da214775be163

SHA256
d76a3ee345f410aebfc11949c542acfea7b7445c3e396f1f2d7a785875d3595d

SHA512
95e0250f1686e36a5073d8b39a6833c30ad5447858edbc890fedd71393cbb4dd6d084f7b1442ebc78d56f6dd3b0b3794f12b7fad148d234407d7954856132848

Download Submit
memory/1212-66-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-70-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-78-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1212-76-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-65-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-74-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-68-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1212-69-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1636-54-0x0000000000A80000-0x0000000000ADA000-memory.dmp

Filesize
360KB

Download
memory/1636-58-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/1636-57-0x000000001B3D6000-0x000000001B3F5000-memory.dmp

Filesize
124KB

Download
memory/1636-56-0x000000001B3D6000-0x000000001B3F5000-memory.dmp

Filesize
124KB

Download
memory/1636-55-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/1972-64-0x00000000004D0000-0x00000000004EC000-memory.dmp

Filesize
112KB

Download
memory/1972-63-0x0000000000490000-0x00000000004D2000-memory.dmp

Filesize
264KB

Download
memory/1972-62-0x0000000000D00000-0x0000000000DB0000-memory.dmp

Filesize
704KB

Download