asyncrat | hxxps://docs[.]google[.]com/uc?export=download&id=1Zx2Er97LP5e9P2FOzVZoNGMY6WamHYFn

Analysis

max time kernel
146s
max time network
154s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
10-08-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/uc?export=download&id=1Zx2Er97LP5e9P2FOzVZoNGMY6WamHYFn

Score

10^/10

asyncrat 2-iconicos-diam discovery persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

2-ICONICOS-DIAM

proyectodos307.casacam.net:8011

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Executes dropped EXE 3 IoCs

pid	Process
1152	Audiencia_Juridica_Preliminar_N°_4271938941..exe
4600	Audiencia_Juridica_Preliminar_N°_4271938941..exe
5004	Audiencia_Juridica_Preliminar_N°_4271938941..exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\KasUpdater = "C:\\Users\\Admin\\Pictures\\KasperskyUpdater\\KasperskyUpdater.exe"	Audiencia_Juridica_Preliminar_N°_4271938941..exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\KasUpdater = "C:\\Users\\Admin\\Pictures\\KasperskyUpdater\\KasperskyUpdater.exeȀ"	Audiencia_Juridica_Preliminar_N°_4271938941..exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 2104	1152	Audiencia_Juridica_Preliminar_N°_4271938941..exe	102
PID 4600 set thread context of 2400	4600	Audiencia_Juridica_Preliminar_N°_4271938941..exe	103

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Audiencia_Juridica_Preliminar_N°_4271938941..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Audiencia_Juridica_Preliminar_N°_4271938941..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Audiencia_Juridica_Preliminar_N°_4271938941..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{BC69FAB5-64D7-4D3E-9FE0-25FE975AD64	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a1a2fec644ebda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 753e5dc144ebda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = cc4d34ca44ebda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{0DE47ABC-A943-4723-ACD4-04192E87119C} = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "430121908"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "705"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "233"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8de323c744ebda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "652"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941.tar.hah29vm.partial:Zone.Identifier	browser_broker.exe
File created	C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941.tar:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4304	7zG.exe
3120	OpenWith.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3472	MicrosoftEdgeCP.exe
3472	MicrosoftEdgeCP.exe
3472	MicrosoftEdgeCP.exe
3472	MicrosoftEdgeCP.exe
3472	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2936	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4032	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4032	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	376	MicrosoftEdge.exe
Token: SeDebugPrivilege	376	MicrosoftEdge.exe
Token: SeDebugPrivilege	3500	firefox.exe
Token: SeDebugPrivilege	3500	firefox.exe
Token: SeDebugPrivilege	3500	firefox.exe
Token: SeRestorePrivilege	4304	7zG.exe
Token: 35	4304	7zG.exe
Token: SeSecurityPrivilege	4304	7zG.exe
Token: SeSecurityPrivilege	4304	7zG.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3500	firefox.exe
3500	firefox.exe
3500	firefox.exe
3500	firefox.exe
4304	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3500	firefox.exe
3500	firefox.exe
3500	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
376	MicrosoftEdge.exe
3472	MicrosoftEdgeCP.exe
2936	MicrosoftEdgeCP.exe
3472	MicrosoftEdgeCP.exe
3168	OpenWith.exe
3500	firefox.exe
6064	MicrosoftEdgeCP.exe
3500	firefox.exe
3500	firefox.exe
3500	firefox.exe
3120	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 3472 wrote to memory of 3644	3472	MicrosoftEdgeCP.exe	75
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 1612 wrote to memory of 3500	1612	firefox.exe	83
PID 3500 wrote to memory of 2576	3500	firefox.exe	84
PID 3500 wrote to memory of 2576	3500	firefox.exe	84
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86
PID 3500 wrote to memory of 2656	3500	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://docs.google.com/uc?export=download&id=1Zx2Er97LP5e9P2FOzVZoNGMY6WamHYFn"
1⤵
PID:2376

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:376

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:2952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2164

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.0.475258066\591586223" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1700 -prefsLen 20845 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fa3e2bd-1a77-4217-a1ff-abb1ecd8f9a1} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 1828 1e1a0ef1f58 gpu
    3⤵
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.1.1529446153\2120431842" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20926 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {097f9eb6-57b1-48b1-9fb2-e0cf1ec8c8f0} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 2184 1e1a0df9558 socket
    3⤵
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.2.1917615423\26216581" -childID 1 -isForBrowser -prefsHandle 2892 -prefMapHandle 2888 -prefsLen 20964 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b3addce-4113-441c-866b-80c579fcf207} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 2904 1e1a4dcfc58 tab
    3⤵
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.3.106267517\1869231131" -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 26214 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d05401b2-e82d-401b-82e6-7d476b71e328} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 3584 1e1a3873c58 tab
    3⤵
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.4.1830239962\158287004" -childID 3 -isForBrowser -prefsHandle 4280 -prefMapHandle 4272 -prefsLen 26349 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8afcf0b8-c7ef-4fd2-8f16-22773102bc2d} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 4308 1e1a69a9358 tab
    3⤵
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.5.2011598357\1790727590" -childID 4 -isForBrowser -prefsHandle 4280 -prefMapHandle 4856 -prefsLen 26273 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b401ae1-7bc7-4aa6-8f7f-1bb746ccf5dd} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 4896 1e1a263f758 tab
    3⤵
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.6.1900160960\1537983462" -childID 5 -isForBrowser -prefsHandle 5048 -prefMapHandle 5052 -prefsLen 26273 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71fbfe2a-3342-4606-98e9-dffd439992eb} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 4832 1e1a2640358 tab
    3⤵
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.7.154324111\1900562697" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5252 -prefsLen 26273 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e8921e1-85b8-49d5-8ee1-ed1a682ab7a4} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 5240 1e1a2641258 tab
    3⤵
    PID:5940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.8.1945030471\2070412547" -childID 7 -isForBrowser -prefsHandle 5292 -prefMapHandle 5300 -prefsLen 26529 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c18fec9-b42e-4faa-beec-6106e4260882} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 5288 1e1a36c1a58 tab
    3⤵
    PID:4268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5628

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap24746:148:7zEvent2605
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3120

C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe
"C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2104

C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe
"C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400

C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe
"C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQ9VIUB\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
46KB

MD5
6b44e9761a160240eb4355d258c76ebb

SHA1
055335118d6ab28477e046a88725edec99f7a8dd

SHA256
cc7d149302cf61d1f42ed7d153851d0909229eaae8e26ac904b3f7801f041993

SHA512
029e851dbbf612510378bbbfef19a038735278d7c51ccf9804dc36a3ab276a695a6c1c01c111e312e8650e76d73bfd35e1fe1681c4e33e10b3d7de5ad85ea8eb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HX2ROP11\Audiencia_Juridica_Preliminar_N°_4271938941[1].tar

Filesize
771KB

MD5
b57e2c8ed491e602457597e508e1dcda

SHA1
3ac5ee63bc69b1d5f55aa554dd1741f677afa160

SHA256
80cf0cd13c90ba90f5a5fa571466e15f1148d0db43b3dbdbc68e1e2227d2a9b2

SHA512
2f730bd50b38868ed2bcddf15acb861d7e17f85c8e39e3a865cb0205be0c41110898510c988732b88c78f7cf3565a937f128020bc7ac0243aa138a7ad27e4ea8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\26QIAQMR\www.bing[1].xml

Filesize
1KB

MD5
9cbb69172812d3c96ac225e13ad44d7c

SHA1
adb4017f7f1dcba86bd44c34b53ce4b6838532ed

SHA256
9c519d8ccd8455762e3598d5de7f5125970fa93f4bfc1913f5a59fd6cf3d8d6f

SHA512
0ddeedac42d0b19e387a94f3ee50f205cb3d8b77895e22b305df216e24602c7da54860b09e47e57c9d0f8750dd77b834749186886ad29d756091e42570bfa9a5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TQN7TA8H\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\WX7X2JQR\drive_2022q3_32dp[1].png

Filesize
1KB

MD5
c66f20f2e39eb2f6a0a4cdbe0d955e5f

SHA1
575ef086ce461e0ef83662e3acb3c1a789ebb0a8

SHA256
2ab9cd0ffdddf7bf060620ae328fe626bfa2c004739adedb74ec894faf9bee31

SHA512
b9c44a2113fb078d83e968dc0af2e78995bb6dd4ca25abff31e9ab180849c5de3036b69931cca295ac64155d5b168b634e35b7699f3fe65d4a30e9058a2639bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HX2ROP11\Audiencia_Juridica_Preliminar_N°_4271938941[1].tar

Filesize
40KB

MD5
988673b0a32ca9ecf203d176f7fc1718

SHA1
b7049404662c32437aa0650cf551e39d6962f388

SHA256
356edbb4661291aae952cd90e0ed591c7218d6fb8eed6f8cc74fbd187c1544b7

SHA512
cf6b1ef99623ae42647c60fd8f562a8d9391bb3cb8023e15c70f4edc90544efc4a7c28afc7fa93c6eab6ed4d0455a23448a4a284cfa9dde687bb5f7e5c648212

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6fa297e1e3adc1d826dd641a5281715a

SHA1
349a856d7ce8b807b7163b44fd109ffb8182c90d

SHA256
6f929941a2f075b806affc42a206d88dc5cf6c69d491937e675c274a174979bc

SHA512
5f7d32fa4e0868b074616001622cd127656a8b5cc580ac986b674cd3f81eeac7f3111728eaf17c6ef4c4b731522d5ca5548cc1a03012a81f4f4359b4ef3f77f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\62950b21-b740-42cd-8ba5-f5b2e7fdd311

Filesize
10KB

MD5
aadb3b5d28b4854d24ab1754c0fd7820

SHA1
04f585088f2a26f160731393273294bdbd8212f2

SHA256
b8ae4be97052dbf01a89a5f5e221a6283f0c2eee6b119f8c82ff5118705e077d

SHA512
2119f6c0bc7fdb089282be9a3107d8c05ed961541f9abd007175f8d03f09401c0ab7222d33f3a675c340f919edf9c7d88bf77ad51d9ef9f36b745f7846472912

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\75fe54dc-7e12-4c35-b8be-9a9ccda964dc

Filesize
746B

MD5
6322aa793fb806d2186d61ed86ea46f3

SHA1
653aa30859c29cc0aeb0393b56a534aa0112606a

SHA256
b558990d76ee7b1656ca9b125497db10483836fb059482b94320c15dfeb9be80

SHA512
b37edc82db707e0dbb29eff970f9104be6228bd2bdf65ccca6b99b110e61d387c56ab6d258999eb04bf9760bbf58c14fa2d9afb1c63ab5036377a1dbf45073a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
5dc83acf50b3640497cfeee3cc0f459a

SHA1
efb6ed29231b344e48c1ef2e609150365182d755

SHA256
e3d7fc3a4ac4335486014202340406e455fdd309c1424841409441a28a62d1fe

SHA512
7b1c0d5f71d45d4a45a13afbb1b75e0bfa6c49f507d684e7401761f918a1dda583b9ef97c41e59eb64039353fdebb2692be6d2de21c209c98a296626d0d16df5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
eaeff43329d5d021cfa6d30e25bde09b

SHA1
86271fc8b39305ad92843235fc3bcb4e990b7ce8

SHA256
30fe55b8301f1e0ad4c22b4d187c8736645f113f1e77f85f8acfdfa90680ba77

SHA512
757cab94fffe25b210e5c0670756bfe3647071f323175ea87cfc08285d0a2b3f723f4d1b70289858331ffc13f30f4f51ce25a9ae30c38923114d6c3c01d85e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
ed85419d2b742f1df252e492b0f09fd3

SHA1
a434b1f5a90c54cbae30e880b0e8f47038c2ed39

SHA256
690bc5350e4f27df685461787c7bf6f7db90b1f02201b294286e9db7b7666989

SHA512
703e0226f47152ea3e47113b7afd349729178a4e2497c329f76cb68abb9e30bcfaf657784ca3036d4ee0e85918f478954537c4843b56064a9584566fa39577b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
17019fbfd6d8ef4049d6ec9e70742fef

SHA1
d354bed354667f779e56cbca57693f5dbdfee876

SHA256
5b17397ed86463d014ebc1464196b19e030df9d999240bc49f0e82871a1cf10b

SHA512
69a3d4960f126d47233fdfa3e585935e4630ca4256590d6f354f5470ee0d74054cb3de9a974057320bdb9a9e56a441cf9f1bde697e04eac00770aa02ddab2b48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
46e58959c67b29f94fe5500db50e2273

SHA1
9016a091d1f5766e90c9528814912220a7e8287b

SHA256
5b3fbdcf1c110832a2e54672c6e4a5621bb6cc266109cfa9a06f03f3140f1517

SHA512
754c783c8b4b6999975938f0b131580499ec803c91b16cc5b1a9c887674b483a8b28b779da6c0ad0d00855c87a710761324293ac4d10b246d2a2004c6696a99a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
39f0bea834d0094083b500e2121e8a82

SHA1
dfa890b6f83129dd77b5430c73662b2db283cd51

SHA256
c8c7ade6a58bddee210b2c77a6da3d1aa371eb4532cb7f3eb1e17cf573b4388f

SHA512
204ac9278a9029132e4b5035787fbf12dd1cd088d10d7b95575c429f290818acb7cc28c5d5bb310f76470ee44763300001dfec1641942129dd25c9d55f8b9ca4

Download Submit
C:\Users\Admin\Downloads\Audiencia_Juridica_Preliminar_N°_4271938941..exe

Filesize
1.9MB

MD5
4e875a3ff28c0ef04fac6d93452183f9

SHA1
752ba98fa8471cc6c269bf9263a0335ab1c570d4

SHA256
449149eabd216c3b638afae9af82fef24b69ede7f6cd9060ed8d85c4f5c97d98

SHA512
ae90d5a955260ab2b0b2dd80a3015ffc36a9756ccb5793a5887ceadc2b1fd289cde84131414c2afd37c16b1e315bc0bdee80c1d80c502e8e94c031f8f5c09d0c

Download Submit
C:\Users\Admin\Pictures\KasperskyUpdater\KasperskyUpdater.exe

Filesize
18.3MB

MD5
61ade4b69ee9ce60d25fb034df4f2eed

SHA1
a175d47c1ef3ebdcf3e8aee3d1d328571675d4ed

SHA256
27d64059901f426141eba7554570835a28c6368ab98feabad09819a932231318

SHA512
fdb350df6317c876074c2fba0db19af892abf067771696345a8c84b35ed9c5b22f302a0136e696621d09d0c130ecfff4b0e5f9ac8efe388f6a80319a283ba2e0

Download Submit
memory/376-35-0x0000020635540000-0x0000020635542000-memory.dmp

Filesize
8KB

Download
memory/376-16-0x0000020638120000-0x0000020638130000-memory.dmp

Filesize
64KB

Download
memory/376-0-0x0000020638020000-0x0000020638030000-memory.dmp

Filesize
64KB

Download
memory/376-94-0x000002063E650000-0x000002063E651000-memory.dmp

Filesize
4KB

Download
memory/376-95-0x000002063E660000-0x000002063E661000-memory.dmp

Filesize
4KB

Download
memory/1152-493-0x0000000000400000-0x00000000005EF000-memory.dmp

Filesize
1.9MB

Download
memory/1152-494-0x0000000000400000-0x00000000005EF000-memory.dmp

Filesize
1.9MB

Download
memory/2104-496-0x0000000000E00000-0x0000000000E12000-memory.dmp

Filesize
72KB

Download
memory/2400-507-0x00000000006B0000-0x00000000006C2000-memory.dmp

Filesize
72KB

Download
memory/2936-45-0x000001A7D7700000-0x000001A7D7800000-memory.dmp

Filesize
1024KB

Download
memory/3644-78-0x000001955B150000-0x000001955B152000-memory.dmp

Filesize
8KB

Download
memory/3644-72-0x000001955B050000-0x000001955B052000-memory.dmp

Filesize
8KB

Download
memory/3644-76-0x000001955B130000-0x000001955B132000-memory.dmp

Filesize
8KB

Download
memory/3644-74-0x000001955B070000-0x000001955B072000-memory.dmp

Filesize
8KB

Download
memory/3644-70-0x000001955B030000-0x000001955B032000-memory.dmp

Filesize
8KB

Download
memory/3644-68-0x000001955B020000-0x000001955B022000-memory.dmp

Filesize
8KB

Download
memory/3644-65-0x000001955AEF0000-0x000001955AEF2000-memory.dmp

Filesize
8KB

Download
memory/4600-505-0x0000000000400000-0x00000000005EF000-memory.dmp

Filesize
1.9MB

Download
memory/4600-504-0x0000000000400000-0x00000000005EF000-memory.dmp

Filesize
1.9MB

Download
memory/6064-332-0x0000023376F50000-0x0000023376F70000-memory.dmp

Filesize
128KB

Download
memory/6064-327-0x0000023376CC0000-0x0000023376CE0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads