Analysis
- max time kernel
300s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
14/03/2024, 11:06
General
- Target https://www.upload.ee/files/16388525/Setup.exe.html
- Sample240314-m7sjcaad2z
Malware Config
Extracted
-
asyncrat
-
40 +
-
authority-amazon.gl.at.ply.gg:41414
-
诶P5ي尺b2Zcryتmبץ吾ieye艾ylg
-
delay
1
-
install
true
-
install_file
svchost .exe
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Async RAT payload 1 IoCs
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 16 IoCs
- Registers COM server for autorun 1 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 40 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.upload.ee/files/16388525/Setup.exe.html1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ebd46f8,0x7ffa7ebd4708,0x7ffa7ebd47182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7376 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,7189907802924565834,13926616046661709930,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\Downloads\Setup.exe"C:\Users\Admin\Downloads\Setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Defender Antivirus.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Defender Antivirus" /tr "C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost " /tr '"C:\Users\Admin\AppData\Roaming\svchost .exe"' & exit3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost " /tr '"C:\Users\Admin\AppData\Roaming\svchost .exe"'4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF325.tmp.bat""3⤵
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\svchost .exe"C:\Users\Admin\AppData\Roaming\svchost .exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe"2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Setup.exe"C:\Users\Admin\Downloads\Setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"C:\Users\Admin\AppData\Roaming\Microsoft Defender Antivirus.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\Setup.exe"C:\Users\Admin\Downloads\Setup.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe"2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
7-zip.chm
7-zip.dll.tmp2
7zFM.exe
History.txt
af.txt
descript.ion
Microsoft Defender Antivirus.exe.log
Setup.exe.log
Windows Update.exe.log
powershell.exe.log
settings.dat
settings.dat
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity~RFe58c54f.TMP
a35c6f1d-3dd9-469f-877c-45b334a51cae.tmp
CURRENT
Local State
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
7z2301-x64.exe
7z2301-x64.exe
Microsoft Defender Antivirus.exe
Windows Update.exe
__PSScriptPolicyTest_41vropje.wtl.ps1
tmpF325.tmp.bat
Microsoft Defender Antivirus.lnk
Setup.exe
memory/432-720-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/432-724-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/1480-290-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/1480-289-0x00007FFA7E0D0000-0x00007FFA7E0E9000-memory.dmp
memory/1480-265-0x0000000000890000-0x00000000008C2000-memory.dmp
memory/1480-288-0x00007FFA8D870000-0x00007FFA8DA65000-memory.dmp
memory/1480-274-0x00000000010E0000-0x00000000010F0000-memory.dmp
memory/1480-273-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/2540-637-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/2540-646-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/2808-604-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/2808-606-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4100-673-0x0000000002A70000-0x0000000002AA4000-memory.dmp
memory/4100-674-0x0000000002AA0000-0x0000000002ABE000-memory.dmp
memory/4100-628-0x00007FFA8D870000-0x00007FFA8DA65000-memory.dmp
memory/4100-607-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4100-565-0x00007FFA8D870000-0x00007FFA8DA65000-memory.dmp
memory/4100-546-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4100-671-0x00007FFA7E0D0000-0x00007FFA7E0E9000-memory.dmp
memory/4100-672-0x000000001B580000-0x000000001B5F6000-memory.dmp
memory/4340-597-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4340-269-0x0000000000750000-0x000000000079A000-memory.dmp
memory/4340-271-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4340-512-0x000000001B440000-0x000000001B450000-memory.dmp
memory/4340-669-0x0000000000E10000-0x0000000000E1A000-memory.dmp
memory/4340-602-0x000000001B440000-0x000000001B450000-memory.dmp
memory/4388-638-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4388-610-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4388-611-0x000000001B440000-0x000000001B450000-memory.dmp
memory/4580-559-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4580-560-0x000002A3DAE10000-0x000002A3DAE20000-memory.dmp
memory/4580-563-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4580-561-0x000002A3DAE10000-0x000002A3DAE20000-memory.dmp
memory/4620-718-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4620-694-0x000000001BBD0000-0x000000001BBE0000-memory.dmp
memory/4620-693-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4720-528-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4720-522-0x00000216E2460000-0x00000216E2482000-memory.dmp
memory/4720-523-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4720-525-0x00000216FA910000-0x00000216FA920000-memory.dmp
memory/4720-524-0x00000216FA910000-0x00000216FA920000-memory.dmp
memory/4868-642-0x00007FFA7E0D0000-0x00007FFA7E0E9000-memory.dmp
memory/4868-640-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4868-643-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/4868-641-0x000000001B3A0000-0x000000001B3B0000-memory.dmp
memory/5156-682-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5156-681-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5192-272-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5192-235-0x000000001BDE0000-0x000000001BDF0000-memory.dmp
memory/5192-215-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5192-214-0x0000000000F10000-0x00000000010CC000-memory.dmp
memory/5208-723-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5208-722-0x00007FFA7E0D0000-0x00007FFA7E0E9000-memory.dmp
memory/5208-721-0x000000001ABF0000-0x000000001AC00000-memory.dmp
memory/5208-717-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5276-571-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-578-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-570-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-576-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-569-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-581-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-577-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-575-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-580-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5276-579-0x000001EE60400000-0x000001EE60401000-memory.dmp
memory/5340-668-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5340-670-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5436-531-0x00000246C4E70000-0x00000246C4E80000-memory.dmp
memory/5436-530-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp
memory/5436-532-0x00000246C4E70000-0x00000246C4E80000-memory.dmp
memory/5436-548-0x00007FFA6A7F0000-0x00007FFA6B2B1000-memory.dmp