asyncrat | hxxps://drive[.]google[.]com/file/d/1NJOFZv4nMp6JZCKQhEYovJOTLcvmKrPu/view

Analysis

max time kernel
361s
max time network
367s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1NJOFZv4nMp6JZCKQhEYovJOTLcvmKrPu/view

Score

10^/10

asyncrat discovery rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TypeId.vbs	VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe

Executes dropped EXE 1 IoCs

pid	Process
5760	VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
12	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5760 set thread context of 3628	5760	VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe	134

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1132	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
4676	msedge.exe
4676	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
968	msedge.exe
968	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4100	7zG.exe
Token: 35	4100	7zG.exe
Token: SeSecurityPrivilege	4100	7zG.exe
Token: SeSecurityPrivilege	4100	7zG.exe
Token: SeRestorePrivilege	4048	7zG.exe
Token: 35	4048	7zG.exe
Token: SeSecurityPrivilege	4048	7zG.exe
Token: SeSecurityPrivilege	4048	7zG.exe
Token: SeDebugPrivilege	5760	VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe
Token: SeDebugPrivilege	5760	VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe
Token: SeDebugPrivilege	3628	InstallUtil.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4100	7zG.exe
4048	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 332	4676	msedge.exe	83
PID 4676 wrote to memory of 332	4676	msedge.exe	83
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 1948	4676	msedge.exe	84
PID 4676 wrote to memory of 2144	4676	msedge.exe	85
PID 4676 wrote to memory of 2144	4676	msedge.exe	85
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86
PID 4676 wrote to memory of 2664	4676	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1NJOFZv4nMp6JZCKQhEYovJOTLcvmKrPu/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffa302e46f8,0x7ffa302e4708,0x7ffa302e4718
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,11926040747095389412,4303962370274120431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:584

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap27063:418:7zEvent8466
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4696

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap21003:418:7zEvent11183
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4048

C:\Users\Admin\Downloads\VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe
"C:\Users\Admin\Downloads\VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF16C.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6084
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
18d4be2e57989671b56cc769216d9115

SHA1
7b821121619cb7ec451f03257547eca6d6dde147

SHA256
3e17d907f9ee65722b7e818c193e479d737f75eda763cf3bce900739392e17f2

SHA512
fc064627a3d83c5627081a1e4ec17976c4b5519c61a8f631a38320eaa388ca3f3d3c19dbd89fd847ca8619f498ee4cee91656b01b39378b2329a0e5d0676c537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1967044a268580fda9f1622b99048b7a

SHA1
201a3ca7d87f1010c967ffea4200e707093a8e6c

SHA256
b5c37d42450a3c98a2a4c20e84a64acb8de0c9ea9a1b1fadeaadbc5c6467fd6a

SHA512
96bf8df184d5f566367bc24115d8d1e1c87fca049f53d48cfbb65a9d9733749959edb31bc4e8e48877010d330a70e09a3884dd67885cc5f3d8efeb0e4cdac0fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2b963209c97d80c98bcba53cb691c324

SHA1
5dc6da041680ea8d15d405ee96a30f4e5860e37a

SHA256
be00351686012afe1b3c126d0302e927ffe36b1a2c098e864a86378bbf363774

SHA512
065c67c4a29afc3306c0cabe4ee951c75af2cc0bd5d479e39d1195a90852065e1c941f79bda6efa420b67d4a0bea25851af7cda05b7ced020adc4ecfc368829c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2f707e999b1f7881b22e94109c19295c

SHA1
98ff65d51cc1304641bbb495664b7e68de07c106

SHA256
004f848a3e0cdefb9bf4e5e6972ee61f74ced3ff6f86b245efd763ca5f707627

SHA512
235d184ff38d6775cdde779096b0b64db582098f30f973012416f1575f16fea708489eec3f907ab7085816dc4aaa12b047e2ed77c217851b165695de3aabd032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
de9ed2021c5fc57fcedd46339f245376

SHA1
b019b013417b919de59fbe3ba18c2613f91c5be6

SHA256
4b1cfc7c59cebeb987689c97b71c8366cb04132b21cd5a71a27047f4279ddb58

SHA512
6b0001baafecd024275115a7b9e2616b95cad547581862a22ae82cef00e40bf18ebbd378fb09ec822f12b5c259dc160b7f07c4f42a4dcf59fdad7d4d7aba2121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dbd724fc3c67fe1306a898d44f103a4b

SHA1
8178c25dee78b3bf0ddf08ba20ce0883fb031c52

SHA256
6796322bdec1e2ad658d6c6dad29fd49bc914e972a155b7602479c8e1bd1da55

SHA512
4f5108895b11cd29befb3ad65588422cca1dfb65c856b1faf74725d4b6c475a1cd45bb71b12886416d04b75a177e90c85a4d888653eb6f47cb2ffb652d05c784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dce8493e5f2afdb15754b3a6c1501214

SHA1
3770b527f4edc476b98f79ced76c570b03b84610

SHA256
c64e3477a9c6eda3ae55f6ab56bfe3a57535bebecfb2fe25dde9d53fa5f82ac9

SHA512
676ea402238252c199da86ff376f4e334a83663bf5b24dc68617fbb2aae370dd55715b27888a5cb75ae3f93c50e92e746df09114192a68fa202d964f16d22226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
228e8676251bb00a3460871b861e037c

SHA1
fe8c161f81175c435be082c348b9465f52c5d018

SHA256
af3c7bfbd3a8b37901d012b6a41d20cf6b973a20295fbe15e962a98c387b597a

SHA512
df747cd37cf2526121f4e6e64c343c70ce053d516ee30c978ac64152c1779d3ab36cfca9f2267d5fe42669da3d3fccdcb87b7b45584f22ac3f8b46ca6d76150f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cac0f46318c5be24a230a78ba0b40575

SHA1
00e06f567e12a4fa5d9c1830fe0ce4576e48ffe2

SHA256
b0cc75cac631164b48ae072e15b1b82002629d196d3ec118d3f78089f6532225

SHA512
34baff11d8ad8d2d73e6bf4f36e326e53941ba42bc0f4b2c073b26e85309829a083f105e3e52d6c06b609578839a2ccbce6fb31974fe9171daaa78bbbf825fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d696034e73a8cda99326edd4e366f02

SHA1
5c2eafb6acf7fa0996603d01635e186f4fdc0aca

SHA256
a6d70aa433b40661dc4b26de6432ff1e46e9a19b2d107057b5939fae235be28c

SHA512
390660f0c45a6d9d113126694b4ba3853f8f8ceace3447f4a236b211f160a428c39358e5ab866887fd88f172274bf1ed3fdff5c11974aef6c3c6b7bcd9cc30b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3f633856db33500bd6b73e1df5c0ab4

SHA1
f4823f9f4e19865f40c58adcb87a7004bc99cb34

SHA256
3e629e72e6bbd630523cb033a3034b15b02867a2298c4d7cb1722a46c053d05d

SHA512
22825d742560432f55d6a390c9a67450501c279ba37881b02b0b5e16d4eacd9e810c94b251597b02d2feb422db599493d8578984e63d5e7a64bc5838fe77c1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF16C.tmp.bat

Filesize
175B

MD5
cd376b5f8b56ed9f23aefc87f3c6feb4

SHA1
f26502e83cfe8703352b39cc42ef8f07661968f0

SHA256
ffb2a74240625cb05cacf8d74f1117f4b6e7a7b3921679f367cad7a9f7f42c82

SHA512
59ff2f4954ef6b2d0331b428fc324f3fd1f4d80d0f926977bd3611c8da2d8972b2a9a14ba589d230bed4620627a196f630744eddb6995bc5229b788f4c380dc2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 983760.crdownload

Filesize
1.3MB

MD5
a67ea84dee0d81573f4104120ff5bf5e

SHA1
2bfd029c6c7a4375f8f693599ba50134aa38f5f7

SHA256
2faa864db17be870885bcc9a957533cc8fdffbf567ebe0e32eee7836dcc73704

SHA512
aa461e69ade58c698f974fc97dbace95e151a8fa964dfcc6ab9eb53888d24fda75196ff50c9b71ddb2cffc095143298d33db802774bc5f4c76b3859c597eeaed

Download Submit
C:\Users\Admin\Downloads\VISUALIZAR APERTURA DE PROCESO JUDICIAL; EL CUAL ESTA VINCULADO 900.145.579-1.; ESE SURORIENTE CAUCA; RD; Radicado 20018-70-43102-2024-11180-00; ÁREA JURÍDICA ESE SURORIENTE.exe

Filesize
2.3MB

MD5
7de6a82fe9e24fde1c311c1b9d05f6ac

SHA1
2289a148829568e0878e61fea3fbf0b2d98fe98d

SHA256
60108d6c8987a0b5960233758000da2880aab7288d25015d28b08c812462d36c

SHA512
24b5589c96b0eab1025cd440005c52d32524a03e5b8050667123ab6e1adeb713b48c1be9ef537be7490788f86be847f1552d10664abb22f1087bf1403a0fb846

Download Submit
memory/3628-1365-0x0000000006100000-0x000000000611E000-memory.dmp

Filesize
120KB

Download
memory/3628-1364-0x0000000005250000-0x0000000005262000-memory.dmp

Filesize
72KB

Download
memory/3628-1363-0x0000000006150000-0x00000000061C6000-memory.dmp

Filesize
472KB

Download
memory/3628-1362-0x0000000004EA0000-0x0000000004F06000-memory.dmp

Filesize
408KB

Download
memory/3628-1361-0x0000000004D90000-0x0000000004E2C000-memory.dmp

Filesize
624KB

Download
memory/3628-1360-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/3628-1359-0x00000000001C0000-0x00000000001DA000-memory.dmp

Filesize
104KB

Download
memory/5760-292-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-326-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-304-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-302-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-298-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-296-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-308-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-290-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-288-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-287-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-284-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-282-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-278-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-276-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-272-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-270-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-268-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-267-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-318-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-330-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-328-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-306-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-324-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-322-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-320-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-316-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-314-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-312-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-1341-0x0000000006490000-0x00000000064EE000-memory.dmp

Filesize
376KB

Download
memory/5760-1342-0x00000000064F0000-0x000000000653C000-memory.dmp

Filesize
304KB

Download
memory/5760-310-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-1355-0x0000000006580000-0x00000000065D4000-memory.dmp

Filesize
336KB

Download
memory/5760-300-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-294-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-280-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-275-0x0000000006080000-0x0000000006166000-memory.dmp

Filesize
920KB

Download
memory/5760-266-0x00000000063F0000-0x0000000006482000-memory.dmp

Filesize
584KB

Download
memory/5760-265-0x00000000068A0000-0x0000000006E44000-memory.dmp

Filesize
5.6MB

Download
memory/5760-264-0x0000000006080000-0x000000000616C000-memory.dmp

Filesize
944KB

Download
memory/5760-263-0x0000000005F10000-0x0000000006006000-memory.dmp

Filesize
984KB

Download
memory/5760-262-0x0000000000D20000-0x0000000000F76000-memory.dmp

Filesize
2.3MB

Download