asyncrat | 916049b956a4db4cbcbdfb612f7cb13413e4beb2282f6cddee30038378ce3748

Resubmissions

03/05/2024, 03:00

240503-dhq5jsdd5110

03/05/2024, 02:57

240503-dfyfvafe5410

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
asd.exe
Size 74KB
Sample240503-dfyfvafe54
SHA256 916049b956a4db4cbcbdfb612f7cb13413e4beb2282f6cddee30038378ce3748
MD5 041009ada3c0371d1fcf69a8ed984e3f
SHA1 dd2265310cf6bc59a770609b1cd405488125582d
SHA512 c408aaed60e453aa965054421cb3a2344fea093504d31af4477d57caebac37660dff61db9aca24057531d69b607fb03314d1e960fcae442abef492f9824464f2
SSDEEP 1536:/5U1AcxqXPC/2PMV1sIM+rYYYPYYYYYYYYYFSYFYY6MYY99bzYYt4IGX1bs/fMQ0:BUKcxqfs2PMV1bM+CX1bssQHBY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

147.185.221.19:42550

Attributes

delay
1
install
true
install_file
test.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000023bac-13.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	asd.exe

Executes dropped EXE 1 IoCs

pid	Process
4780	test.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2056	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1984	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133591787626976531"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
1964	asd.exe
4780	test.exe
4780	test.exe
4780	test.exe
3760	chrome.exe
3760	chrome.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	asd.exe
Token: SeDebugPrivilege	4780	test.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4780	test.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 5004	1964	asd.exe	89
PID 1964 wrote to memory of 5004	1964	asd.exe	89
PID 1964 wrote to memory of 3180	1964	asd.exe	90
PID 1964 wrote to memory of 3180	1964	asd.exe	90
PID 5004 wrote to memory of 2056	5004	cmd.exe	93
PID 5004 wrote to memory of 2056	5004	cmd.exe	93
PID 3180 wrote to memory of 1984	3180	cmd.exe	94
PID 3180 wrote to memory of 1984	3180	cmd.exe	94
PID 3180 wrote to memory of 4780	3180	cmd.exe	102
PID 3180 wrote to memory of 4780	3180	cmd.exe	102
PID 3760 wrote to memory of 2764	3760	chrome.exe	123
PID 3760 wrote to memory of 2764	3760	chrome.exe	123
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 1408	3760	chrome.exe	124
PID 3760 wrote to memory of 2100	3760	chrome.exe	125
PID 3760 wrote to memory of 2100	3760	chrome.exe	125
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126
PID 3760 wrote to memory of 4972	3760	chrome.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\asd.exe
"C:\Users\Admin\AppData\Local\Temp\asd.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "test" /tr '"C:\Users\Admin\AppData\Roaming\test.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp449A.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1984
- - C:\Users\Admin\AppData\Roaming\test.exe
    "C:\Users\Admin\AppData\Roaming\test.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa21a9cc40,0x7ffa21a9cc4c,0x7ffa21a9cc58
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2032,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1884,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2136,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4588,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4580,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4440,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3580,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3548,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4808,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4904,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3536,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5352,i,6146399195221550200,222639339462543626,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6128

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c5e8cb6640d21791bf270280cf00313f586e85b42e69af72f0d81500c6cf5b1d
MD5 e3d09f31c1c62e4be1ec2e7c2c87be87
SHA1 ac0a8d4d6b54cbe89b9c5276b789274bcb00e5c2
SHA512 f0489641d0a364f9e76c173c5ea76cd0a62ac9dc08a769da58db85160240d766553d5e8070e5b77215151e074f5727f2165c4bafd48a9f557b90522b43dc4f22
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 27KB
SHA256 751f9ea75e28033193df30031bf3d33e0553e1644ccbaecb26fe7d3bda21b78c
MD5 75f1d5724eddb6c481e2e87727c0a19d
SHA1 3cfe079018e25b2646f23e0744bc5af2114ee256
SHA512 a52fade9a438e7896f12afb5b8cccf05ab2cdd71dcc8683ba80001e74800d0c6a6d446d162e75eff573ccfc7106c1beb6f91bdd41753b81a6f5b7510c7c36b4a
SSDEEP 768:pw0RST+3JrpYIQCxLi6ejWjmIAHWswn5A0Mm:W0RSLCxLibs51
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 64KB
SHA256 91eb454ba34c3c40bd85158046f285e797a21dc861e5b60cf05ad7b604a539d8
MD5 5a16d31f5aafb6faa08ac1110f135e3f
SHA1 87df7fe0aa4a6f518dd237803bd72638bd2b90cf
SHA512 f55a1908999184304a213fd93edcc40dd6092db8702ec33dc61bf7ebf77980b52545f2b6a526f9165cd6206839fca42f30e72644a19d27f651f3ee73fb6f2b13
SSDEEP 1536:bLwNrvlnl1tLQ6ErV77Y6SDF9sKDZ0KZCW/u3mKV4K7eM:34TlnlLs6Eh7a7LZ0F8u3F7yM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 20KB
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
SSDEEP 384:tC7niyi/By45+9iBV538WjAC8jNe8qUo4DdsmPMb7lV2bzOAZo1Csk/r:wrfi/BNY9iR80AC8jNdBsJb7A6Woe
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 78KB
SHA256 3dfb4715163bdd16d75d0b225bfba302a544c0ce6ea8276027e948d5f0fcb5fb
MD5 e84c54f8270672be907b0e123881ddd1
SHA1 5e06dfcb0e2fafa3ca5e9feee2578a93de50bb0c
SHA512 fdeb8c12c109f2a0d69297c783afbb08e512488b6750caa514861305b4397dc38982f07ce44d9b37053bdcab9b634f2df144fa3006ea15872d5b698b662731a1
SSDEEP 1536:QdEYLlRnBZ3mk8Qx+AWhSEm95eWFNFqZgP8EfO5f3Xl8aNQLb:mE6Nn8Qx5UShHaOk5/Ob
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 94KB
SHA256 0f985b3647f4da56867208cb6c583e7a3f7b20c09f4ab11355094ab80ec95cfa
MD5 3a321d1f986c0ab1ef210b0807fb0cb3
SHA1 6c47c300a54da1edbb505325b3bfa22b78e95941
SHA512 a691a7c738d5800d168ed0bd2e8ded8d213753a563c5cb21195bf08a51b930a30b1d639acb7d46e7bccbb91146b1b010cc44dc5a5dff51c574e68c7c6702081a
SSDEEP 1536:O/7DgyGHEMSYW6xOK5a0pdm0S3f6lvdiOwyUfpO/Bw8i7G3joGGPnzV8f2LtNtb7:OIyGHhHj53pqCTYpO5w8iWFmnzNLtfOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 29KB
SHA256 4b0beec41cb9785652a4a3172a4badbdaa200b5e0b17a7bcc81af25afd9b2432
MD5 f85e85276ba5f87111add53684ec3fcb
SHA1 ecaf9aa3c5dd50eca0b83f1fb9effad801336441
SHA512 1915a2d4218ee2dbb73c490b1acac722a35f7864b7d488a791c96a16889cd86eee965174b59498295b3491a9783facce5660d719133e9c5fb3b96df47dde7a53
SSDEEP 768:oAQsDyy4sdW7Bpud9WAiJXevVFyD0516r99ZIiFoF:Yxf7BmWAuXefyg516+Sq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 60KB
SHA256 4b285731dab9dd9e7e3b0c694653a6a74bccc16fe34c96d0516bf8960b5689bc
MD5 5d061b791a1d025de117a04d1a88f391
SHA1 22bf0eac711cb8a1748a6f68b30e0b9e50ea3d69
SHA512 1ff46597d3f01cd28aa8539f2bc2871746485de11f5d7995c90014e0b0ad647fb402a54f835db9a90f29c3446171a6870c24f44fb8bbb1f85b88e3ade9e0360e
SSDEEP 1536:d+dOSFn3L4esZxf7iAQTd7G6+F56e0wMX+p6Pyg:sf3PsZV78d66G5G+pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 98eb079e9488430677ab31577623ae9bff3042cfa263e6cc57dff728ac674c43
MD5 4403f18047f71f234ca5509b207dbfba
SHA1 c959e4eeb056ec37382479bad387d44749fef835
SHA512 49d5b7bd8507a863c9196f72256b89e25f9ac17fd5b1e6910da5c359c45e10dd659c7d7e66367584a90d96881e24f8616973c6c075d2ca0d2475122eb91b2852
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9b1dea16cbb1625a1beb8dfb1066250d0b765aa1168824861ead0d21c74f11ff
MD5 76c6143f6910e1c39af0843bcb4ad5bf
SHA1 380809fc9641767291bc2ac257ae44c7e5c5d637
SHA512 918ad5c69071cbdbecef1fd4d39de4eea48009c4206d952cd143e1d4e708d0cfef384ef380ba2fa43fee11a022efbd4003afa97cfe57aa2714d0cb66a567b6fb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1664396ef005d6b2b8341eb44498b3776ada623e0bae3949125df317814f0b1b
MD5 5a871044917aa431dcdd4d988473d978
SHA1 16c9cecfff2ea23210091809fc48acbb7fb2a61e
SHA512 4accc8d87f6052d9cd0415e378f901f7376a41f9e470f48b258604b4e3cfd4ae3bf5910b27d9e3b993833d77843b78f196ced8299b4ac28028091610c485ec8d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 8d9fe64d6fb928516a23eead0e2ea0d1a2325da367c4091b93596d48af67f887
MD5 b5d16ec249469f60bf4a5e434a26273b
SHA1 79914174181c67fdad2b58ebf939fe5c66548dae
SHA512 6bf9663d127c73e46f5ece25df69acbf27aea2176f29ef5ca07f4d49a6bbb5419601e1c79961f4b51a0ab0f0219e5be007a383f355f96c66c906eba5d63f24e9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 ffbbe1421748e74a8bbd3559cdde84fdf7a0fe91d2248aaee23926edb0c0f2d3
MD5 5c1e0b01eba2d42a7d7670ad2b00082a
SHA1 a2bf9cf64c2baaf5f528b77a8526474477ac21b3
SHA512 223bc7179b07000381a409fe15fe69a93dde4f7ed1dfc5072a83c910c9d551597ab15240d89d9e091bc9f4c2122cdacbbb3bb92b5b6fda1035093d2625cce092
SSDEEP 192:w9xk0zpeNb9HV+Fb9i0kK3EkwN0Ka4NPo6yIsnVdg4:w9x92btG5NkPyv4v4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b0307e95dd73345badebc0234a030f70abf1406749b636d6abae4838a64d7808
MD5 6b9aff63b48aa3fe8455f8187e51fe2d
SHA1 867a627b41b91b7ba3eaee4bc050426e4af9ad95
SHA512 658c53e1fbb7c7b1c59877502cb733320ea1487a37c394b83708edc1e5d609bb0215b7e2320d98a14d7cfa5cac584ede3b1676b89f22077a006f320109305456
SSDEEP 192:w9xk0z1eVb9HV+Fb9i0kv3EkwN0KaSNPD6yIsnVdg4:w9x9CbtG5NkcyvSw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 28caed28cd8fc5b7ceac960f2e80308741c43d5a3d4e245cc815070eac385330
MD5 590cf5ae1f0b1a5879e4b07110e75e1c
SHA1 6929668b356010ad1a938eefa09941388cd0dc46
SHA512 e8b7c2656ad0def9c2ca879005a509e9eccf9acd9d4f7f164a763cf1b2789b68dce334601b863ecc8ff5ec2984cfad0d98e71afb53dcde528f23c18c15fbb38a
SSDEEP 192:w9xk0zLerb9HV+Fb9i0ks3EkwN0Ka4NPo6yIsnVdg4:w9x9ibtG5Nkxyv4v4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 28f244a7268833781d8640feeb57d60b698761c9f987552791e617210e8d7486
MD5 fa73502e38211c32e0afddf12b4f8d28
SHA1 d88c1e64677caa2fc6a04dcd3f7d2cc7221ed7e6
SHA512 5bf8e0facc8b80200e6143c2faa333ac42be7cbb62ef962af183dfe9f6937bef3af121f176861a395bb7a9803cc171018809de77cb1a05711ecedc8b78c6f57b
SSDEEP 192:w9xk0zPeVb9HV+Fb9i0kv3EkwN0KaSNPD6yIsnVdg4:w9x98btG5NkcyvSw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b6e2e90336637bbaea489aeaf1634ad1d3f0986667b973b6ce62d03519eeaa35
MD5 e2e4334826f85cad0fe129c50e11213b
SHA1 978f2740145a69e1b1009cee5f91f1691fefd9a8
SHA512 ba575e8baf1603c34635763e33881d21898cde24d164740fa39fbf59d4dfb40c7e8761a2f38ecb2e2dc62e2339f6ddcadb904afb4eac42926ec142cea1b5f280
MD5 SHA1 SHA512

Submit Download

d2fd33a3-f08b-4780-b4a5-b569866d52ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2fd33a3-f08b-4780-b4a5-b569866d52ab.tmp
Size 15KB
SHA256 239122fd2938267802c39868a26f305e9ed9e78b16deded81fdfff1a84251b46
MD5 3ae792ace085db3ac7706df8e7312677
SHA1 791881bb13396ecf35c73238cfd353b7449154e8
SHA512 cac773662fa6c2da657fc28ae4dbe10deacb2b91bc606884e8b97cd5b7638df2622988b971677d48fe152d128b82def97680c4ab6f24cf3bfd44b7cf34ab8f03
SSDEEP 384:ckmm7pLhLcEvkNXyP1kXqKf/pUZNCgVLH2HfPE1rUYaHG2tcCG:cfm7pLhLZ8pyP1kXqKf/pUZNCgVLH2Hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 151KB
SHA256 d02a9223b7acd6069bdc9d5e36651cc9f96e4dd96b4a61f5d226eccd7bb681d7
MD5 40164109ebf1ef6fcd2e6d672dc5ed52
SHA1 55acf4f84378c081ef4d25975f9ec8532b6cacf6
SHA512 8adaa84b3c647355682e3e68494d8f1e3439924edbece58b6d450e66f0b8da99c13ad1f4b8aa4fb8af6e35338cf025e07f7a1372b88c4d74fc9d05ae2af738a6
SSDEEP 3072:qi3vTnQ5iEeihVbYwOLjkdRq4m9t5iWUEp82vQ0QaD9W3aPc:L/zeiEeqNYFjYVmMWU8H9W3aPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

d8062147-4361-4e39-ac12-3ef42ac260de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d8062147-4361-4e39-ac12-3ef42ac260de.tmp
Size 151KB
SHA256 94b53007124a696b7e8d3e261f1cb433ce64bd5ae65e6a59887154dbd27fdef2
MD5 5821c286ffb38658913d3924c50e28bf
SHA1 835cfc1c1b6f83b5c54f7d741f9510495948f8a9
SHA512 07897b3a362cd50c8c3ba91403114f9e34d02b28912db1d68a3679901347d05282b0d06822c9ab1f34178676fcf2b5fd599752dbe74babe590ce4a683e454045
SSDEEP 3072:li3vTnQ5iEeihVbYwOLjkdRq4m9t5iWUEp82vQ0QaD9W3aPc:M/zeiEeqNYFjYVmMWU8H9W3aPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp449A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp449A.tmp.bat
Size 148B
SHA256 e462644adcd5efd89a992bd4d98c6d752aa420bbd6ca4786ae51bfbaf49e1f1a
MD5 2e06cbf5ced1407a197cb36b73e97038
SHA1 6f88bfe9d8b69fe1a84c10ba9f9ae7df0bb09711
SHA512 e18198ea930c2fefcc069132fec36c5714d060e485d851e0f35b06996dfa2e1041740a2552860a182a7da26ee6098de8c27d916839578f2b4853bf183744cfd2
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

DataLogs.conf

Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
Size 8B
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
MD5 SHA1 SHA512

Submit Download

test.exe

Path C:\Users\Admin\AppData\Roaming\test.exe
Size 74KB
SHA256 916049b956a4db4cbcbdfb612f7cb13413e4beb2282f6cddee30038378ce3748
MD5 041009ada3c0371d1fcf69a8ed984e3f
SHA1 dd2265310cf6bc59a770609b1cd405488125582d
SHA512 c408aaed60e453aa965054421cb3a2344fea093504d31af4477d57caebac37660dff61db9aca24057531d69b607fb03314d1e960fcae442abef492f9824464f2
SSDEEP 1536:/5U1AcxqXPC/2PMV1sIM+rYYYPYYYYYYYYYFSYFYY6MYY99bzYYt4IGX1bs/fMQ0:BUKcxqfs2PMV1bM+CX1bssQHBY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-8-0x00007FFA2AC00000-0x00007FFA2B6C1000-memory.dmp

Download

memory/1964-3-0x00007FFA2AC00000-0x00007FFA2B6C1000-memory.dmp

Download

memory/1964-9-0x00007FFA2AC00000-0x00007FFA2B6C1000-memory.dmp

Download

memory/1964-0-0x0000000000CE0000-0x0000000000CF8000-memory.dmp

Download

memory/1964-1-0x00007FFA2AC03000-0x00007FFA2AC05000-memory.dmp

Download

memory/4780-17-0x000000001C7D0000-0x000000001C846000-memory.dmp

Download

memory/4780-18-0x00000000029C0000-0x00000000029D0000-memory.dmp

Download

memory/4780-19-0x000000001B8A0000-0x000000001B8BE000-memory.dmp

Download