asyncrat | 6e6577761b13f6a42f212419a8fcca10f35ab9315f24e9be39c8fc5cdfcfea10

Resubmissions

26-07-2024 02:34

240726-c2n9matgqc 10

25-07-2024 23:17

240725-29tlravajg 10

Analysis

max time kernel
299s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26-07-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78-CITACION DEMANDA EN SU CONTRA -JUZGADO LABORAL 04 CIRCUITO ESPECIALIZADO EXTINXION-54.svg
Size

365KB
MD5

80193d67d0da94a9d928fe4bc5b3a7cc
SHA1

ec3b1f52e184dd87dfe9ceb2eb5cdca6f96f5dc4
SHA256

6e6577761b13f6a42f212419a8fcca10f35ab9315f24e9be39c8fc5cdfcfea10
SHA512

b376e9152c6ec0b45d8e9fa7d4f298a8ddf2d873c3b42b3f7d60704dbef3c7a4967a6e32fef5cd8fa0019bd6176401c2b8fcc0698437c2ae8082bfacb9088957
SSDEEP

3072:RCkLBpCoMXyV1d/Cl+XlwdgrJGwS4BHKlgeJtonukwUwPsWw5wzwQw6qmPwOhuqZ:RfBpCoK21dE+XlpJGwSsKldhLsuCY

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

melo2024.kozow.com:8000

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
AnsyFelix
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4980	01 NOTIFICACION DEMANDA..exe

Loads dropped DLL 6 IoCs

pid	Process
4980	01 NOTIFICACION DEMANDA..exe
4980	01 NOTIFICACION DEMANDA..exe
4980	01 NOTIFICACION DEMANDA..exe
4980	01 NOTIFICACION DEMANDA..exe
4980	01 NOTIFICACION DEMANDA..exe
4980	01 NOTIFICACION DEMANDA..exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 3844	4980	01 NOTIFICACION DEMANDA..exe	93
PID 3844 set thread context of 4608	3844	cmd.exe	96

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01 NOTIFICACION DEMANDA..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133664349022642027"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4980	01 NOTIFICACION DEMANDA..exe
4980	01 NOTIFICACION DEMANDA..exe
3844	cmd.exe
3844	cmd.exe
4608	MSBuild.exe
4608	MSBuild.exe
1844	chrome.exe
1844	chrome.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4980	01 NOTIFICACION DEMANDA..exe
3844	cmd.exe
3844	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeRestorePrivilege	4964	7zG.exe
Token: 35	4964	7zG.exe
Token: SeSecurityPrivilege	4964	7zG.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4964	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4608	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3176	4924	chrome.exe	74
PID 4924 wrote to memory of 3176	4924	chrome.exe	74
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4968	4924	chrome.exe	76
PID 4924 wrote to memory of 4716	4924	chrome.exe	77
PID 4924 wrote to memory of 4716	4924	chrome.exe	77
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78
PID 4924 wrote to memory of 1348	4924	chrome.exe	78

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\78-CITACION DEMANDA EN SU CONTRA -JUZGADO LABORAL 04 CIRCUITO ESPECIALIZADO EXTINXION-54.svg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffba209758,0x7fffba209768,0x7fffba209778
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4152 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4996 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4452 --field-trial-handle=1828,i,6090514900118284888,12206221906911940595,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4712

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\" -ad -an -ai#7zMap10938:236:7zEvent3466
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4964

C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe
"C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f9c2766-c7c3-48ca-b5a8-27f03009a35f.tmp

Filesize
5KB

MD5
76fbd8988a5e5eb24134695f54bcf290

SHA1
e99a5cc43d4e9ab3b1660479232ef195a2e52c9e

SHA256
7a13b3e20a49509ca56a6d536c9d0c8c35f8c50cbd4a800e0795c59af9507171

SHA512
df403a476aa65ac28a8a8f93ea55e1b84f47d17b88204416cdd55969edb952e8aa847b3feac01ed42bb1605456c340abf27bebb2f9baebd840dbb483a9802116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ab8d2fb-40ba-4334-a9db-34dff73363d7.tmp

Filesize
6KB

MD5
fa771c489b4c8624e6c3f4ab126406a5

SHA1
b103fb6694cb0ce962e19f84fd6ad86a7813f9db

SHA256
37429eebaa521be42ef459682bc96eb98e9e8055539ec820f759fd251d7c2fa1

SHA512
3d926bca0eb11a7bd2eb1566990706f6172c57683f31784eacc4548c5f32e3afbd89f8c3c09c081aa973e083bec6bbb56da88c550ff0da4ed23dbdf37cae58f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
818B

MD5
e1cd2924d5f43807f05402ec6d34a213

SHA1
c6519dd9ab00a0fea277517c12efb35fb5c861ef

SHA256
570002ab5569899f3c693882bbc726ee9c1b82b3c270d51aee43c595f3fcf3a0

SHA512
916e82eec11dbbcc7c0dd3e4dc7faac1f014d0ead2807a43319b2a881c33d928e9ec726d124b13765af6f0740920c8074f8d9bbd8a53fd04694b2b70558d3d0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1014B

MD5
fd18d4ec19092e41af62096cad75c1c1

SHA1
3c7729266a865632f6d8fc6bbc346eda1fb3292d

SHA256
986b2f4352d29aba2aaaf0451314bbc25fc12c4344c529bfcb59935ea77271c6

SHA512
d670a08c59801e75f8f43fe57091df95a01bafac82af4037478007f6d0cef9e68f58e55b902e75790895c7e0bbacc0e8448764877ce6c7c372a47a124e2b886f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
21e76dc862019aa7c7ad6b358a9df590

SHA1
a13a05f712d7815c54e8b60c272e8c1c8f70d0fd

SHA256
27d4db234d7f14cdd9a29f8389b04a7fbe8cd142ad277da4bb0e5433e2a200c8

SHA512
a8ea07ba98aa808b666d24fced8d01ac2974624dc02eae72d3e298538e58783a53e4d875d9518151930656ec64512ca9cd6dcc116005051e069994424e7b57f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
cbad00bb4b5c149f6615c1ccf4e0151b

SHA1
c80c8ea3853ef6cd9b139f11d71836a364bbeb82

SHA256
0b82f09cb6bebfb9661209d7178d12789e085ba92f41e6e7f9ad85433b53a40b

SHA512
76b25b595facdf4a0aceec3be716a014aa57b9d4de557ead49d95f06c79369e76aa905052f05a175a963935ec9e416ffc61302f6db16aec2fd081c85a6c23c5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
04939af99e4d65f541aea0029b2c1641

SHA1
1d31695c5fc0a5af64a366be24bd80d722880c24

SHA256
c8da9aa0dcaf10eddbba11c5efbdd8de9589dddd78dae38042ddb3470fd9781f

SHA512
ab0b3c4fe82931b80442e7828f69fba34649fe9fa3c1897f970e4aab4773203fd7472379dac52d486119e8a30723c9496d4076cfd7fa7a72e198b8b0ec17e53f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d50892bce743274af69e9e3f85d3ae9d

SHA1
b3a3d7ae63173d3b0338bb6a38dc6056e3e43f2d

SHA256
c3c2c8455207bec311283ff0e393ba3d3266b1908a91d521b2528f19f9ae3820

SHA512
a7927337ba61087ad4c6c871d23f044b25802862dab1da5c300872c46d8b3d47c4b8911a2833db3e09154ca207e4140bda4533ca065e7a36945bd02763def571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
5314e13625abd0719a79e32fb14ea856

SHA1
e2e2c04d884e17d0dcf4db1f3f03780a9d08e167

SHA256
473449b818a908d1821e92b34a8a3b0f12dcb493e629e414df62126817682725

SHA512
dde85bca201624c3e604e570f09793bc85a48c3e4c09a8c2f3bbd9afdaff945b5de93f8ffed7587b5293d523e7e3189cac311e165d51df249910cb0454559673

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
ac60f79087c55d9e7b7bbfb012bc1bf1

SHA1
9c33638163bea0729374e0a0953bb7f4fe3b9446

SHA256
9ed27565bbe2ff9af5dd24b2e1f02bbd7b24f96302e0007a82529370228ce98a

SHA512
d6101803b45f0d06479995bed3a146167d802911b78dcaca5bb0fd4d1ad24d0e0c9775112138f8c7f7515125a61a1a94fa4f6231217e45d850ab8e249b3c9c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e03e.TMP

Filesize
93KB

MD5
97bf77d6976d393195b05cb2790805f2

SHA1
619dcd89becb8e51aeefcbd05e6d6d7e4f0fb926

SHA256
1fa26d1529c5238e0bc4b32ab981fefa4bc88cc20aeb8f4c562feb813abfdb2f

SHA512
628674d7e94a2be34fb2868b199b443bd4f29d9dd88645d1fb03cb54d274a7ba757d275472a3125e032ebb6bc4d2897d7a00b27757ae19f9faac2aab3c71f2d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b55b0a

Filesize
774KB

MD5
41d655d9ef03a7a553e9638acdd7ca18

SHA1
38ecb8cf9568be081f1e5d8e2bf5081f34199316

SHA256
b3369e5e94b1f520f22eb7100571210b900656030b0165f33fb92d7ed227b0b0

SHA512
07c07faeb81930481ae35fca7e5514a63d82799180432066215bfffa7e89cc9bdc359be2a94dee427f0d66c9ff347dda5cb40515b177e2d58d6db92f49f95864

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01.zip.crdownload

Filesize
6.7MB

MD5
da0f823b67bc093b75d381f2a105ecb6

SHA1
11e82222f4070fbadc8c4c2f194ba65d9fa60ac5

SHA256
ed88b5c4a8be75f5da0400817a9514bdcb38e602aa3fe463d39cec523dcd3268

SHA512
3d2986bf2b9d6fc9c7251934f68eab8995dc33b1cf3886c2360afebdc2f9f35a088a2e0d92002a3c225a07095a5213677df78a4bf95ed77842d98a998b1e1016

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01 NOTIFICACION DEMANDA..exe

Filesize
2.3MB

MD5
5d52ef45b6e5bf144307a84c2af1581b

SHA1
414a899ec327d4a9daa53983544245b209f25142

SHA256
26a24d3b0206c6808615c7049859c2fe62c4dcd87e7858be40ae8112b0482616

SHA512
458f47c1e4ccf41edaacc57abb663ee77ca098fffc596fad941bbdea67653aeabc79b34d607078b9ee5adb45614e26f5c28a09e8faf9532081fdd5dec9ac3c48

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\aigret.eps

Filesize
650KB

MD5
b16a26aee27cdc91b7f545e03877f9c0

SHA1
7eb68256ac0a97e4ee0ddc1db648968987406910

SHA256
b3abdc2b792cb4b0160bdcc291dcb13b31078d852bd20ae01ae0908a0b46b72f

SHA512
25b8a3155c9b30df90b64690b8f4d16b1de1dd321efe05f9c8e5e939e0884acd2e4cf07797dc7f1a87600793246640ef6e5ff3b2a82229406cce674fef15b446

Download Submit
C:\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\barrette.accdb

Filesize
17KB

MD5
3de728173727b206fe14724ba05a28c2

SHA1
407ca05387c9fc1ac22cd409df1f0899d49a7cde

SHA256
f923b85549cf4d2f87c11f4cdeb5abb408974aea8235aa68acc849736ebdde28

SHA512
33b6e43f6bdaf31b7387ffa683e9581afb4d9b170767e6c6a51180608568db9675fb16643ff462dfd53c6ca76789902553d9bb6e834734fbd8ce4f8726b76206

Download Submit
\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\madbasic_.bpl

Filesize
210KB

MD5
e03a0056e75d3a5707ba199bc2ea701f

SHA1
bf40ab316e65eb17a58e70a3f0ca8426f44f5bef

SHA256
7826395127e791a883359ea81308174700da0af8052cc9853b19fd29c2e4badb

SHA512
b0a3cfb6b34832f048fe0fc70c6fa76ae16a2cacda930f6529a83a967d6e8de1c69b93e0de3dc2126c5385d85e814687e695a0a4131399a69633141cad98da2a

Download Submit
\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\maddisAsm_.bpl

Filesize
63KB

MD5
ef3b47b2ea3884914c13c778ff29eb5b

SHA1
dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0

SHA256
475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87

SHA512
9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e

Download Submit
\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\madexcept_.bpl

Filesize
436KB

MD5
98e59596edd9b888d906c5409e515803

SHA1
b79d73967a2df21d00740bc77ccebda061b44ab6

SHA256
a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

SHA512
ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

Download Submit
\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\rtl120.bpl

Filesize
1.1MB

MD5
1681f93e11a7ed23612a55bcef7f1023

SHA1
9b378bbdb287ebd7596944bce36b6156caa9ff7d

SHA256
7ed5369fcf0283ea18974c43dbff80e6006b155b76da7c72fa9619eb03f54cef

SHA512
726e8f58648a6abaf1f2d5bebcf28c1d8320551a3b6e7eef0cf8d99f9ef941e30e7004c24c98e9b5e931a86128d26de7decba202390665a005e972dcbe87ab93

Download Submit
\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\vcl120.bpl

Filesize
1.9MB

MD5
1384dcc24a52cf63786848c0ed4a4d1b

SHA1
ea63180c94ea2d0417ad1860128980dd18c922ef

SHA256
d19f51871484cc4a737196bdb048193ad73f7f6bd061ec813766516eba26e406

SHA512
d405911672e3ea7abcbc898d7b807b9bc1dcbf4f83663d70bd8adab075960cf3d904b2710adbdafbcbb99ba4a41b9a40c64b7171e845255a91a042871b1ce8a3

Download Submit
\Users\Admin\Downloads\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\01-CITACION DEMANDA EN SU CONTRA -JUZGADO PENAL 01 CIRCUITO ESPECIALIZADO EXTINXION-01\vclx120.bpl

Filesize
222KB

MD5
3cb8f7606940c9b51c45ebaeb84af728

SHA1
7f33a8b5f8f7210bd93b330c5e27a1e70b22f57b

SHA256
2feec33d1e3f3d69c717f4528b8f7f5c030caae6fb37c2100cb0b5341367d053

SHA512
7559cdf6c8dbea052242f3b8129979f7d2d283f84040f1d68ae10438548072715a56a5af88b8562aeea7143194e7c5bddac3fdb01ded411a0b1cac9f0c6eef3f

Download Submit
memory/3844-168-0x0000000073430000-0x00000000735AB000-memory.dmp

Filesize
1.5MB

Download
memory/3844-152-0x00007FFFC8460000-0x00007FFFC863B000-memory.dmp

Filesize
1.9MB

Download
memory/4608-176-0x00000000051E0000-0x00000000051EA000-memory.dmp

Filesize
40KB

Download
memory/4608-175-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/4608-174-0x00000000055D0000-0x0000000005ACE000-memory.dmp

Filesize
5.0MB

Download
memory/4608-173-0x00000000009B0000-0x00000000009C6000-memory.dmp

Filesize
88KB

Download
memory/4608-170-0x0000000071DC0000-0x0000000073143000-memory.dmp

Filesize
19.5MB

Download
memory/4980-130-0x0000000073430000-0x00000000735AB000-memory.dmp

Filesize
1.5MB

Download
memory/4980-144-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4980-145-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/4980-146-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/4980-147-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/4980-148-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/4980-149-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/4980-142-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/4980-140-0x0000000073430000-0x00000000735AB000-memory.dmp

Filesize
1.5MB

Download
memory/4980-131-0x00007FFFC8460000-0x00007FFFC863B000-memory.dmp

Filesize
1.9MB

Download