asyncrat | 358e9cb86fcf5de99d8f859fe0339cf8f7eaa8b5a08f5a075c2b4ddd5f1f755b

Analysis

max time kernel
300s
max time network
306s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-10-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Juicio_Legal_Procesado_N°_47287434..exe
Size

3.6MB
MD5

c3eba8bbad42c6317b472ffd5421a3f1
SHA1

096f13459a3b67c004695edaeb5bcb75b1c591dd
SHA256

154c728c638c6657124307c1b1e4ed0ab7154578ac5fc96042042ff216caad99
SHA512

20f53fd415da44de95fbecaae0112b24b38b5e6c7ed0578193d5d87d71396a413ccbae9d0923f6413846e5c74b3fc23d034425d005331d234295396d1517d3f4
SSDEEP

49152:hWGtLBcXqxlR6SVb8kq4pgquLMMji4NYxtJpkxhGjI3TFE333FLBEPlo0MgNn+QT:jtLu+sqgwh4NYxtJpkxhG1333PlC

Score

10^/10

asyncrat 025-oct discovery persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

025-Oct

999triana999.1cooldns.com:11206

999triana999.1cooldns.com:2203

999triana999.1cooldns.com:2202

999triana999.1cooldns.com:22205

999triana999.1cooldns.com:22206

Mutex

DcRatMutex_qyunchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Juicio_Legal_Procesado_N°_47287434..exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\BurnDesignerEditor = "C:\\Users\\Admin\\Music\\BurnDesignerUpdater\\BurnConvertVideo.exe"	Juicio_Legal_Procesado_N°_47287434..exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Juicio_Legal_Procesado_N°_47287434..exe

description pid process target process

PID 1492 set thread context of 2464 1492 Juicio_Legal_Procesado_N°_47287434..exe csc.exe
Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Windows\SystemTemp chrome.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

description	pid	process	target process
PID 1492 set thread context of 2464	1492	Juicio_Legal_Procesado_N°_47287434..exe	csc.exe

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Juicio_Legal_Procesado_N°_47287434..execsc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Juicio_Legal_Procesado_N°_47287434..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133743611476738342"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exe

pid process

2328 chrome.exe
2328 chrome.exe
6092 chrome.exe
6092 chrome.exe
6092 chrome.exe
6092 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2328 chrome.exe
2328 chrome.exe
2328 chrome.exe
2328 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.execsc.exe

description	pid	process
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeDebugPrivilege	2464	csc.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe
2328	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2328 wrote to memory of 2084	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 2084	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 672	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5504	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5504	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe
PID 2328 wrote to memory of 5980	2328	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Juicio_Legal_Procesado_N°_47287434..exe
"C:\Users\Admin\AppData\Local\Temp\Juicio_Legal_Procesado_N°_47287434..exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff92400cc40,0x7ff92400cc4c,0x7ff92400cc58
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1816 /prefetch:2
2⤵
PID:672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2080,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
2⤵
PID:5504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
2⤵
PID:5980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3760,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4444 /prefetch:1
2⤵
PID:5512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4540,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4556 /prefetch:8
2⤵
PID:1512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4544,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4280 /prefetch:8
2⤵
PID:5424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4808,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
2⤵
PID:5544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4968 /prefetch:8
2⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4676 /prefetch:8
2⤵
PID:6004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4856,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4920 /prefetch:8
2⤵
PID:1640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5100,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4516 /prefetch:1
2⤵
PID:5792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4884,i,5987741727317515204,8711727848679883185,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4952 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6092

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\647e4dce-d31f-4700-9683-e0e659fdf577.tmp

Filesize
9KB

MD5
e8a39c782e039ae709e8c1d614578e55

SHA1
15e81a78e42c60cf049d84229ac34e1dd825ae71

SHA256
6337edb94a724f51b9e62b44d85983123152bffd0f4de7d905ac7523c3bfd89a

SHA512
f6b3fb9331c9d1c913eb01cbec36ec9c26851614b1a5f7885c25fcede9bf70efaf2720fc58282b818c98c25a856b31b19b0d2c05ab5e193a61f63bd0a852268f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cb2ceb2c714b8846044e6c2ca2a0eb92

SHA1
d2d5c6103fbe82fcc0f2f09c481d7c977fb952a1

SHA256
9f6ef3243ce546bf15e2613865c104d8d4685b5d4e81b1dcb124fed9e4c3140f

SHA512
52d2f5270c94b1a7f749b21afc98ef6fff661a19e4368b933a0c3dd79d5067d5baf4ab3c21107299e31d2c96e80f78609870199fbc95d4a29c22b20cbdb6da61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
31d3f5afaea1e53af8c6022bd9629f09

SHA1
f03514fe16781dcc918c8216c7b3bcc995cba7b1

SHA256
6d8214e129676f50e8d2624d95f24b2ec31ece1a3ccf4d15d60cd4abbfa20395

SHA512
2b44f85a71f0b6774432c6c9a18490431ad00cb759a50b24baae756109a86ca63d15b3bf1ceef89564ef8a1f2a33fbdc55634117af0e5748c1ba1203b6b99fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
8fbc3eb66d58583bbabd806b95bb5a4d

SHA1
8615429f809236569daca8c900d40df3e6773f77

SHA256
21afb43696860509223eb90792742b319af0b1f6ed99d855d8e1210096c632da

SHA512
ddebf39422f044a99990330ce199e8b040c400860a7929d5349160be865e236ad1c8d69a0337376852fc28eddac7ac9b7b8f502d337101c0ec8af9ab60ba4a14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
31243d7e49094609e0025f8b7d8ad6ce

SHA1
a38086f6fae6683296402f18d2fec8d2ba7123a7

SHA256
09e25d6e82dbce66510249f785170039ffad450af5d6b1b9ba870d5d2c5032de

SHA512
bfa49f0e7f9d4a08210dff4593c8a3fe1c19104d99e287c08bd463c5664cdeebe86ba46842bb680f49069f14c991f941c53ffa90be29939d9d1486bafe8d0e5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
661f5adeba983f722538c7c7517dd44a

SHA1
0f3daf931e9113c55047a73953ec7da10e1715e4

SHA256
319cd7313f1fb0d63a7987959c306d2c43e33b4d8479691a02e536a062a461fd

SHA512
ef8384f1d519874efe4707a245546040e2e7bb1ac70d221ba8450a801f9cb574e7e9ad6794fa34e9647ffb0c04ab6d91cea4ea908972e2d13ea48e0eb7ba0cea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
467fba5e3b1632deb4e8b40d36b9c5de

SHA1
5e5ba3d1e350be218fd41427d120f44928b3d7b1

SHA256
9fac3050ba27a90b05ff3f09d5a519c935410ddb63b2a03ebb7c1817e6754bfe

SHA512
fa65559f4e05746212b6f7d30cfc54fd33b2be17f6eea4f50cc00f52489a97ce99ea828fc30b793804ac945c4f3385eb8670b7ff095ec3cd50c40fd5e1789893

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
091c85b40072a81d9dd3f1c083c2d302

SHA1
49a6416068f00d1bc99dfc3680c5562e71a0f21b

SHA256
52ac8edfd5b25db0825bcb2b70deccd79643ed4533770b5598c00294f63fedd2

SHA512
05c5dcdd5229cade6e4b6deffb8890adf8b7d001eef72c3eaf3e1ea0d11e0e520060c9fa6be20a9d2eb6e51f3116fd55af20ae1e93374cd0a6c803866eadcc43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c33c0bb5dc885152b7ba6763325d41e1

SHA1
7f4a1e3e99bd8648cb2e5057809b1b6c6f4cf71f

SHA256
5d7bb340f7337fc88794a23af752cf4b5fa1c66c5ee799200f20d9e34e1529f0

SHA512
97686fd1c6d87a100e3c70abd62ff01a3c97f3c76518715d9e35f44c170650b111fadb8c7cb49797416f35bc1aca0616da1ed2bbe1d879dc73a100ba77f586cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
286cdcfb70f18a409cf8c059d645e46d

SHA1
c2361046c3c3b22b48beec1f342f225bb3066333

SHA256
03b2eb500c5a60e7c4f72f84fae5afa88847a0ea89d9fd17d36742026f8e1a67

SHA512
d3afee5b5e5436bb39f5b95390559e0c0788e1ddac2b59c63225d68273db8b187ba03df20cc13c0807469a4ddbf95daad07cc6473e355c044641005e8bd644ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ec0cf0a4e91df3e2577a7908d91613a9

SHA1
5f9d11496f9c7dfa7460460760647159b8434b1c

SHA256
363504a229953f3c7da549713097ae1d59f95c0e6ca27d57365bf1d5014584d4

SHA512
3c4758985b238891e918868132b705aa3ea2b2e55aef8226e66e0a5f0171c254d7b9e734bcb7dbd7cc9338655d859b51f38cba1756299802417ee164995ef542

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
113eab98a20cd9187d858874271f0e54

SHA1
1a3b6435d1c1a027d5db136d885c403b6e893ee0

SHA256
e71c1e46fe3ae570c0b5fbc30699e5a003af9335a7197f24dca9d93712010679

SHA512
09927056852460d98092e710fd4dd7bb5fdab0f36292a8eba8f75f45090cf5f37574386e24af0576cf898183261a0b68bd58fc1a9fe75af0738f22fee3820f28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
471359f92b52b39d8eac2f06c94fdc88

SHA1
bf28eef70ba3fc948ed3c734ffc95bd44cca11a4

SHA256
77c3f196362b0a418d9411d3a4ae40fb25205b88d9c6799d93cbb635e8d7b1b5

SHA512
7c74afcab8c55b8db3457aa6c7fecd133510e34c33187775624a1b8a521b242115c5139254d14d46ab7b30b810584d72b98d10249da90d640162c2b18c2bcadc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e2b6b2a408d67491536ae9dbea5959b1

SHA1
c8430c5bddee31de7837d37e66278a8edc81b032

SHA256
752a924c7a1a5c101a32ab2aa220e5eb35baa165f4b4662fc93d690b1b7cb144

SHA512
b11b845bf23f339609cb77cbc581d8743998743e854af1d258bdc128ebf937bf1fd73d604f12d3c10fceab82a16784587fd48776fe957619ef2a80a40e23db03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5a001161daa908c3ada84dd85df5de02

SHA1
b8177dcae110d26c2629383bc36b8c78f36afd62

SHA256
8724a320dd64a31a1b12f9d3292778f8f020371876e39c8ff6ef1603a4c081ff

SHA512
0dcbb558f7a60bd3473dfa3e2e585956e834d2bfa55deb37075943ca7f43ebf00e225b5ecdbb652bec4c0ad497caffbf02a5a124cdd7946ff495d35b7115a77a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8760613ebfed1f240bbef295326d5866

SHA1
600480730071f988d8681d56e5d0b6bdeec92934

SHA256
c632d4a3bedca1e102e062cd9ba18b2792373cca2a903f39d9b279dff2935dbc

SHA512
28719e59fab41804f56deb7de65f8339c319978f733d4c73a70a986bdb3b7f12261077ff0f03af4a1f38e2399f59f2173d0fb01745a244223d3a54e4552c1263

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5e54ef32a6b2dbdcab1ca28e8b08d78b

SHA1
25e8e23d1a0727c3d4b12989fe5f1b3900cb24ff

SHA256
1e8ab4d0c9d7792cbc3a3d7de1f6a2781d1d38efe7522f46ffd981b58f981fbd

SHA512
d73c49148dea1f2af93d1e7ddea844cc0a6598d00834ef0cc279f9cbf93870d13770398c3c467851127d67f578026ebaa68a037b57c82325f5864eb3cf8f8ebe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e7dc8141b61a2d61febf8e49e6e22710

SHA1
8f8442323d23286dfd3dd0ef2d8a6d6655a2c7a3

SHA256
dd72927fe542388583286182a200948e3a9603b9c9cccc6f51d12a74a7123e25

SHA512
d3364a79060ad24f22db3bb12984661d9b62c333415bd527832b688c9975bd10df821fffea200c594780f92393932d91b666a63721bf0fb0383abfe286d3bb72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7486248bedc6481e1ee52c3fb6946625

SHA1
5aa3bf079b46757167f74eadcfd2d22e5cb6a59f

SHA256
769743eadc422f1b24644b514a8f0cd238edcbe4c27d392e6472b3eb9a9d80a4

SHA512
c872dd479259f1b80aa3442e5f6aa0286503c7b07582c2d3eb92b09ee5c39e1803092db42b102308fad6d6587464b114e411ab4d782cdc56b825e7ba4536b4e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2cbd598296032c6df9c6a3c5c2dd26a7

SHA1
5a72e84bcd05b1cc372c8d129f69ad82e6582a27

SHA256
f443b4d670a677ff091b24872a64ea489b0d0f9ff4c35c3507a64b3aaada21f4

SHA512
40198cbf0441251d372e60f8c75153e715be6af00e5f137e3070a32151bd0a38a9541c3fb02cbfe50730515e0b5bf5c305fadc84c7a542c1f99944bd863d29f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
80c95c495c9d242e4d47c1140f3a89e9

SHA1
76726297e161a68382a6b681357e16899be1c286

SHA256
8ec395be57548d1ad74f00803f551b474268f2302405b8e14373ea4d5e155477

SHA512
0e65ef7390c7e4ce8f50de771a740f1acb722a841ba74952aa68d3f4ddb7f074d64c3eaaebe555afe30e55618af3591b3205bb6824e2c913044133b2c1ffbfaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bf352446659314979dffd0f1878aef89

SHA1
e199dcad8635ca0eed3be6fc05c2fcf7036b5c1c

SHA256
339fa4704a9b84409003d5ae3b963fe6314f89890d8bf6f28bbd4c4854399dc6

SHA512
fef24f94da4a0098e88e6308d1c532a49fc47427c1c3ce8114d099943b421d4cb55d4e5d145984b5e47f79e15e31c290bb99f7b9df39774595fb032727611464

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dc215929916e5e04ad19777924614350

SHA1
18dfe6c8bab4ea5c5af21712904c0d87448855f5

SHA256
cb4a6e5e89ab8abbba16d9845882bf639a2c0cfc93de6ea8b5e2dce97ca3bb08

SHA512
52a256c466aa5bc1806a7a0cc346378754b3c283689fd08123a7f1acd9b0ab26530bc6263c8d28604bd4ac8b01bcc32f1922d950c67e615b9d6e1825ad17e3ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a2b5eee4757e5b1cc0b0b4801b18e913

SHA1
6a2bfd7abcab0a3f6f90942668cf882f654b8e80

SHA256
a941726e3fdead1ed49d3199ca13ca37a284f9a26fd50656857f8b4da0e1e931

SHA512
e1567f67818bfd441ea57e91eb86b864682fc7cd144bb953549b21c7d64482a2c4807457a7f490733e43ffa7fb1393e233419a2ec0c977d19375d065e7b2f071

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
457184b12cd97f07005efe7cb5d80f79

SHA1
ffe16e9e6df31e629e1e85c6fa3017ea6ab46743

SHA256
f0660b87d4021fb816b73eb79bb846abeb667505eb3df18e182ba1eb568dd5ea

SHA512
73ca145ed114b9d720f7ac321e0141d475c4a7564c4604573a5c01a3a68c4fe02032a7f83d9a6c14fdd2ad99758f18006418a596b4e5823f3c456c5e72cd0c9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
cbf6b2711750a3cc48200bdd1d47fcd7

SHA1
ae9a4221fd40d6f14498d08314a9febce8867794

SHA256
94ce8cbf7e642e5d157675118d7ffb7a382a066dd55891c896367cf688c7a7dc

SHA512
8c3e18c69955dcd86be3409edbdea8e49c5cc6712110bca8019ea4f7ceef49eab87abe243952057e4460a49bf85966e2291e33676d89d6f430b91ced8723826e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
ffe6ab9527d5644303c1db5961462d42

SHA1
b1b4c6ff238b8f8ae6b2c854a1a0d2380cf61b55

SHA256
be0f4301190e4d645a8b7f97b5f16574ba506440fa59579a26cd362e44d681d8

SHA512
435a9f061cb0515ad74778082a30d0328cdefcf17eed70750076c4bc2218b8f1dbb3c4501765b10d7b7dce7a93a9aad6d27e4650804a91a3313fdc32a6c286f0

Download Submit
\??\pipe\crashpad_2328_SBBQEJXRGMXDMFLT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1492-53-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-47-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-14-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-45-0x0000000000517000-0x000000000052F000-memory.dmp

Filesize
96KB

Download
memory/1492-44-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-49-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-80-0x0000000000517000-0x000000000052F000-memory.dmp

Filesize
96KB

Download
memory/1492-50-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-48-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/1492-52-0x0000000000400000-0x00000000007AC000-memory.dmp

Filesize
3.7MB

Download
memory/2464-51-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/2464-54-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download
memory/2464-60-0x00000000742B0000-0x0000000074A61000-memory.dmp

Filesize
7.7MB

Download
memory/2464-100-0x00000000742B0000-0x0000000074A61000-memory.dmp

Filesize
7.7MB

Download
memory/2464-91-0x0000000005FC0000-0x000000000605C000-memory.dmp

Filesize
624KB

Download
memory/2464-92-0x0000000006610000-0x0000000006BB6000-memory.dmp

Filesize
5.6MB

Download
memory/2464-93-0x0000000006060000-0x00000000060C6000-memory.dmp

Filesize
408KB

Download
memory/2464-99-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download