asyncrat | 3193f135e199228a2d3b3a61e04ff5d82bf8669b1b3380b22f537ed7c7e06261

Analysis

max time kernel
65s
max time network
69s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-11-2024 04:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

rizz.exe
Size

72KB
MD5

b34928c5afd20368c2810613c4a550d2
SHA1

ac281837cacfc3409e7a41b7230989c3774ba4e2
SHA256

3193f135e199228a2d3b3a61e04ff5d82bf8669b1b3380b22f537ed7c7e06261
SHA512

a2661d23e15737fb1e069329f9527dcdc71b2332fc4dd2edd4910c4bccc474702e0c964a92ba4687b62dba37bf1da0935b8bd49374fdd0ceea7e6b1836647d10
SSDEEP

1536:ACyyQm2As0GWzbzXvMgYM51yVKNY9sUIdshOCOwX0ttdk61E8Ygiyw:ACyyZVGobzAAy0NFdsh/OXtdkqBS

Score

10^/10

asyncrat default defense_evasion discovery execution rat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

comment-mar.gl.at.ply.gg:7052

Attributes

delay
1
install
true
install_file
regedit.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x001c00000002ab0e-8.dat	family_asyncrat

Executes dropped EXE 2 IoCs

Processes:

MulitiTool.exeregedit.exe

pid	Process
3536	MulitiTool.exe
720	regedit.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2768	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rizz.exepowershell.execmd.exepowershell.exechcp.comshutdown.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rizz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
2348	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid	Process
720	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exeMulitiTool.exeregedit.exemsedge.exe

pid	Process
548	powershell.exe
2768	powershell.exe
548	powershell.exe
2768	powershell.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
3536	MulitiTool.exe
720	regedit.exe
720	regedit.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exeMulitiTool.exeregedit.exeshutdown.exe

description	pid	Process
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	3536	MulitiTool.exe
Token: SeDebugPrivilege	720	regedit.exe
Token: SeShutdownPrivilege	764	shutdown.exe
Token: SeRemoteShutdownPrivilege	764	shutdown.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

PickerHost.exeLogonUI.exe

pid	Process
2212	PickerHost.exe
5252	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rizz.execmd.exeMulitiTool.execmd.execmd.exemsedge.exe

description	pid	Process	procid_target
PID 2116 wrote to memory of 548	2116	rizz.exe	80
PID 2116 wrote to memory of 548	2116	rizz.exe	80
PID 2116 wrote to memory of 548	2116	rizz.exe	80
PID 2116 wrote to memory of 4240	2116	rizz.exe	82
PID 2116 wrote to memory of 4240	2116	rizz.exe	82
PID 2116 wrote to memory of 4240	2116	rizz.exe	82
PID 2116 wrote to memory of 3536	2116	rizz.exe	83
PID 2116 wrote to memory of 3536	2116	rizz.exe	83
PID 4240 wrote to memory of 2768	4240	cmd.exe	85
PID 4240 wrote to memory of 2768	4240	cmd.exe	85
PID 4240 wrote to memory of 2768	4240	cmd.exe	85
PID 3536 wrote to memory of 1592	3536	MulitiTool.exe	86
PID 3536 wrote to memory of 1592	3536	MulitiTool.exe	86
PID 3536 wrote to memory of 2572	3536	MulitiTool.exe	88
PID 3536 wrote to memory of 2572	3536	MulitiTool.exe	88
PID 1592 wrote to memory of 1980	1592	cmd.exe	90
PID 1592 wrote to memory of 1980	1592	cmd.exe	90
PID 2572 wrote to memory of 2348	2572	cmd.exe	91
PID 2572 wrote to memory of 2348	2572	cmd.exe	91
PID 2572 wrote to memory of 720	2572	cmd.exe	92
PID 2572 wrote to memory of 720	2572	cmd.exe	92
PID 4240 wrote to memory of 3312	4240	cmd.exe	93
PID 4240 wrote to memory of 3312	4240	cmd.exe	93
PID 4240 wrote to memory of 3312	4240	cmd.exe	93
PID 4240 wrote to memory of 764	4240	cmd.exe	94
PID 4240 wrote to memory of 764	4240	cmd.exe	94
PID 4240 wrote to memory of 764	4240	cmd.exe	94
PID 4240 wrote to memory of 4592	4240	cmd.exe	97
PID 4240 wrote to memory of 4592	4240	cmd.exe	97
PID 4592 wrote to memory of 2272	4592	msedge.exe	100
PID 4592 wrote to memory of 2272	4592	msedge.exe	100
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101
PID 4592 wrote to memory of 2160	4592	msedge.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rizz.exe
"C:\Users\Admin\AppData\Local\Temp\rizz.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AbABsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAagBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAegB0ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Better penguin tool___.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL.EXE -Command "Add-Type -AssemblyName System.Windows.Forms; [void][System.Windows.Forms.MessageBox]::show( 'You in my yippe u got this for free!', 'Welcome', 'OK', 'Warning' )"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3312
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /s
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://neal.fun/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f8ed3cb8,0x7ff9f8ed3cc8,0x7ff9f8ed3cd8
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,7674709080711159879,1427506120323664207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
      4⤵
      PID:2292
- C:\Users\Admin\AppData\Local\Temp\MulitiTool.exe
  "C:\Users\Admin\AppData\Local\Temp\MulitiTool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "regedit" /tr '"C:\Users\Admin\AppData\Roaming\regedit.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "regedit" /tr '"C:\Users\Admin\AppData\Roaming\regedit.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp84FF.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2348
  - - C:\Users\Admin\AppData\Roaming\regedit.exe
      "C:\Users\Admin\AppData\Roaming\regedit.exe"
      4⤵
      Executes dropped EXE
      Runs regedit.exe
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:720

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a34855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
7d9270e0a715623ca5ae4a2ac9dd67b4

SHA1
85dcd26ffc7f4546702aff0c6ce94f633b45f379

SHA256
96aac88a6bb77c7adfaf7f04c7494d9d1e637cbdcbc13a76e55c6b1a9e4bad23

SHA512
0e6114a7a858bc54ea407b183d2cc1a4e93c25994d96aa0c3ecaa209c1396b66c257d0c63c59a96bc29bb0a7a6bde974da8f51db866caa823e87ce378900e2bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
332522cad54abd2af7eac7a4c3956691

SHA1
d34410e99fa8a2cce979f465b8ee5283db58d7b7

SHA256
47831d858bed7f435a6885dccc0e2c17b5d87b45b2d5cf2b23c49d0d5dfd8f5d

SHA512
3a4bfb91d1e07fcc1cf0abe80d76a8f7bf910af2ab3ecea26b2e84c3ccb39ba87b0ecf3f2310762310f61f8a90970c4691a804820f8f34e74328d753629ae09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b1e7b09064812ffb9a7fd8231ad111b

SHA1
a7c0eba057e4a8b1420670ebfe227d66878032ce

SHA256
946582f1d7071854e47d5be66bbaf19f275203e78812afa96582d8a5040b576e

SHA512
5434f35e5dbd5459aa5ba242ca2891f55807a6dbeb17410928e23470d8154e5e0a7a7fa6231bc42733bcd6772fa9519371fb83fba518bdf82095ea5c022bcf0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
297698441567857a77c7ff6d788b5dd1

SHA1
7f2f9f130ff1fe119bea0cb8536a2922d5a178d5

SHA256
ec7b27eedff51db7437feaff8f4632b5c66c962733f34d6050f799bff14d5341

SHA512
8ec7192c4f2ab2f2a63999263c83b654ad872e430dc08b74987aa89a762a5a537c53717bf19ad9ffcde7e3634934c9b83a5c83eb92af43afd164209ab14ac56c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e7552d9e61059dbac5659d18515f34d4

SHA1
fe43d509ace5738b9cb36542b8e3bf53970923ae

SHA256
7abd0e22b5bb472206bbae2716a67f97da0b72c5a9535fa81696e7756087b81b

SHA512
929e681bf9a113013855cdd23e99f09ab5842c3557ffef6ca67c0a80f3704ef4d170689c513c873202f9567783627b2e84d0454e3b8284ff49ef9c6387441413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
9c4437f0e02fa41b834f06762d6b3e7a

SHA1
6e91d611ef8b264579be2825d4c3f867ea534889

SHA256
0a4dd07903ebb843470ba6a43812113ba340dcacba24e80e66cc7a4d9b4c4e19

SHA512
3e6fac0ce106495d1417c860a0a65994d0bf6e9a519624523c6fade2d5dcc5a2b8e7d3f39415801db00c3aae31dfb2ea9d5808e85c33698191c0e537d643ea0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Better penguin tool___.bat

Filesize
3KB

MD5
f251a25604847cf77ef2409d23dc94be

SHA1
21c2d6af971aeea1afb8e12c9f5160a1b8d8123f

SHA256
89941ae9dd965d7e526eb452237211afbb74ed5d6448cf96a84fb050893a7c83

SHA512
d1be6c9150427f439b1e8fb986b1683c464063af95b560438f263fe6309d2b5bef00920c6eb976251b295c3add0a19f8eecea2446df05246dd66c420ffa47c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MulitiTool.exe

Filesize
63KB

MD5
867d3df9508a810a4b6498db145508ce

SHA1
f7321cd91e4de91b7da39d5a2d25f126a77f6eb0

SHA256
bab521830c4069c60079884232777609ad392d385f323981eefb2c949a55d41b

SHA512
06e039153a01549534b62efb8e9a4d0bc57bc22b050a9822edf5cf42d2c77400657f73fd4ea4a9632e0cbb62d638e9983adaecd180d9d9835093c2874ad51712

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2lufxleh.x0g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp84FF.tmp.bat

Filesize
151B

MD5
50f60bac16c6ded4579ae396031cccee

SHA1
42b50dae24d42d89fd6f013fd56240c3fdeee3db

SHA256
4e285fecfd50ade7759050758b3a737f2c5230779151a5216ca46885febc7045

SHA512
df5ea935b03b14c33eafb255fd38244efdf2ca97422545ebec93a6bf271c8d070ad3989dde792c8dba97dbcee29240b3b2d9589ba1b16687ab04ba788f43a7c5

Download Submit
\??\pipe\LOCAL\crashpad_4592_HXQBKEOARYDXLWHZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/548-21-0x0000000073B70000-0x0000000074321000-memory.dmp

Filesize
7.7MB

Download
memory/548-18-0x0000000002D20000-0x0000000002D56000-memory.dmp

Filesize
216KB

Download
memory/548-45-0x0000000007500000-0x0000000007534000-memory.dmp

Filesize
208KB

Download
memory/548-47-0x00000000744C0000-0x000000007450C000-memory.dmp

Filesize
304KB

Download
memory/548-56-0x0000000007540000-0x000000000755E000-memory.dmp

Filesize
120KB

Download
memory/548-57-0x0000000007560000-0x0000000007604000-memory.dmp

Filesize
656KB

Download
memory/548-20-0x0000000073B70000-0x0000000074321000-memory.dmp

Filesize
7.7MB

Download
memory/548-19-0x00000000059B0000-0x0000000005FDA000-memory.dmp

Filesize
6.2MB

Download
memory/548-64-0x0000000007920000-0x000000000792A000-memory.dmp

Filesize
40KB

Download
memory/548-41-0x00000000060C0000-0x0000000006417000-memory.dmp

Filesize
3.3MB

Download
memory/548-66-0x0000000007B20000-0x0000000007BB6000-memory.dmp

Filesize
600KB

Download
memory/548-67-0x0000000007AA0000-0x0000000007AB1000-memory.dmp

Filesize
68KB

Download
memory/548-68-0x0000000007AE0000-0x0000000007AEE000-memory.dmp

Filesize
56KB

Download
memory/548-69-0x0000000007AF0000-0x0000000007B05000-memory.dmp

Filesize
84KB

Download
memory/548-70-0x0000000007BE0000-0x0000000007BFA000-memory.dmp

Filesize
104KB

Download
memory/548-71-0x0000000007BD0000-0x0000000007BD8000-memory.dmp

Filesize
32KB

Download
memory/548-74-0x0000000073B70000-0x0000000074321000-memory.dmp

Filesize
7.7MB

Download
memory/548-15-0x0000000073B7E000-0x0000000073B7F000-memory.dmp

Filesize
4KB

Download
memory/2768-24-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/2768-63-0x0000000007360000-0x00000000073F2000-memory.dmp

Filesize
584KB

Download
memory/2768-58-0x0000000008220000-0x00000000087C6000-memory.dmp

Filesize
5.6MB

Download
memory/2768-46-0x00000000064A0000-0x00000000064BA000-memory.dmp

Filesize
104KB

Download
memory/2768-44-0x00000000075F0000-0x0000000007C6A000-memory.dmp

Filesize
6.5MB

Download
memory/2768-43-0x0000000006020000-0x000000000606C000-memory.dmp

Filesize
304KB

Download
memory/2768-42-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Filesize
120KB

Download
memory/2768-23-0x00000000059B0000-0x0000000005A16000-memory.dmp

Filesize
408KB

Download
memory/2768-22-0x00000000050E0000-0x0000000005102000-memory.dmp

Filesize
136KB

Download
memory/3536-16-0x0000000000790000-0x00000000007A6000-memory.dmp

Filesize
88KB

Download
memory/3536-14-0x00007FF9F8223000-0x00007FF9F8225000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads