asyncrat | 378d97a39ef4c82dbe95adc05f6b5edee49df9c39decea580ecf1faba96c4648

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

资料_install (1).exe
Size

1.5MB
MD5

85df64b647baf466f4621d1be7d005e1
SHA1

c090110069d644c54c8508e8e65ddcfae25949fc
SHA256

5ffe8edc15b6cb41122f6cc2550621e81776bc6914ea6388aecd17eec073aea4
SHA512

52f7676cd7cfd91eda286dabc13139272ac8e809c70ac80c11139193659b5f28ae75876b12845a9cc60215529d780d466c36d4e2722344b7fce870454fd15b26
SSDEEP

49152:tEBdH3KQaSIE1vlbkOAZOEzRT9IynYMHK3zT27yEbYp:mBpPZIUvlkpRCyd2zwylp

Score

10^/10

asyncrat venomrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

v1.2.0

Botnet

Default

27.124.46.187:7415

Mutex

dljruvfxlegfirzzjpo

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral2/memory/4372-134-0x0000000002CA0000-0x0000000002CB2000-memory.dmp	VenomRAT

Venomrat family
venomrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4372-134-0x0000000002CA0000-0x0000000002CB2000-memory.dmp	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	资料_install (1).tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
5044	资料_install (1).tmp
1576	资料_install (1).tmp
2184	lPix.exe
1964	lPix.tmp
2820	lPix.exe
3972	lPix.tmp

Loads dropped DLL 5 IoCs

pid	Process
3516	regsvr32.exe
4372	regsvr32.exe
900	regsvr32.exe
4392	regsvr32.EXE
1396	regsvr32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to execute payload.

execution

PowerShell

T1059.001

pid	Process
2312	powershell.exe
2136	powershell.exe
2136	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	资料_install (1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lPix.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	资料_install (1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	资料_install (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lPix.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	资料_install (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lPix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lPix.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2804	timeout.exe
936	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1056	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1576	资料_install (1).tmp
1576	资料_install (1).tmp
3972	lPix.tmp
3972	lPix.tmp
2312	powershell.exe
2312	powershell.exe
2136	powershell.exe
2136	powershell.exe
4372	regsvr32.exe
4372	regsvr32.exe
4372	regsvr32.exe
4372	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeIncreaseQuotaPrivilege	2312	powershell.exe
Token: SeSecurityPrivilege	2312	powershell.exe
Token: SeTakeOwnershipPrivilege	2312	powershell.exe
Token: SeLoadDriverPrivilege	2312	powershell.exe
Token: SeSystemProfilePrivilege	2312	powershell.exe
Token: SeSystemtimePrivilege	2312	powershell.exe
Token: SeProfSingleProcessPrivilege	2312	powershell.exe
Token: SeIncBasePriorityPrivilege	2312	powershell.exe
Token: SeCreatePagefilePrivilege	2312	powershell.exe
Token: SeBackupPrivilege	2312	powershell.exe
Token: SeRestorePrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeSystemEnvironmentPrivilege	2312	powershell.exe
Token: SeRemoteShutdownPrivilege	2312	powershell.exe
Token: SeUndockPrivilege	2312	powershell.exe
Token: SeManageVolumePrivilege	2312	powershell.exe
Token: 33	2312	powershell.exe
Token: 34	2312	powershell.exe
Token: 35	2312	powershell.exe
Token: 36	2312	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe
Token: SeRestorePrivilege	2136	powershell.exe
Token: SeShutdownPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeSystemEnvironmentPrivilege	2136	powershell.exe
Token: SeRemoteShutdownPrivilege	2136	powershell.exe
Token: SeUndockPrivilege	2136	powershell.exe
Token: SeManageVolumePrivilege	2136	powershell.exe
Token: 33	2136	powershell.exe
Token: 34	2136	powershell.exe
Token: 35	2136	powershell.exe
Token: 36	2136	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe
Token: SeRestorePrivilege	2136	powershell.exe
Token: SeShutdownPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeSystemEnvironmentPrivilege	2136	powershell.exe
Token: SeRemoteShutdownPrivilege	2136	powershell.exe
Token: SeUndockPrivilege	2136	powershell.exe
Token: SeManageVolumePrivilege	2136	powershell.exe
Token: 33	2136	powershell.exe
Token: 34	2136	powershell.exe
Token: 35	2136	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1576	资料_install (1).tmp
3972	lPix.tmp

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
1056	EXCEL.EXE
4372	regsvr32.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 5044	1652	资料_install (1).exe	82
PID 1652 wrote to memory of 5044	1652	资料_install (1).exe	82
PID 1652 wrote to memory of 5044	1652	资料_install (1).exe	82
PID 5044 wrote to memory of 1840	5044	资料_install (1).tmp	83
PID 5044 wrote to memory of 1840	5044	资料_install (1).tmp	83
PID 5044 wrote to memory of 1840	5044	资料_install (1).tmp	83
PID 1840 wrote to memory of 2804	1840	cmd.exe	85
PID 1840 wrote to memory of 2804	1840	cmd.exe	85
PID 1840 wrote to memory of 2804	1840	cmd.exe	85
PID 1840 wrote to memory of 3296	1840	cmd.exe	86
PID 1840 wrote to memory of 3296	1840	cmd.exe	86
PID 1840 wrote to memory of 3296	1840	cmd.exe	86
PID 3296 wrote to memory of 1576	3296	资料_install (1).exe	87
PID 3296 wrote to memory of 1576	3296	资料_install (1).exe	87
PID 3296 wrote to memory of 1576	3296	资料_install (1).exe	87
PID 1576 wrote to memory of 396	1576	资料_install (1).tmp	88
PID 1576 wrote to memory of 396	1576	资料_install (1).tmp	88
PID 1576 wrote to memory of 396	1576	资料_install (1).tmp	88
PID 1576 wrote to memory of 680	1576	资料_install (1).tmp	90
PID 1576 wrote to memory of 680	1576	资料_install (1).tmp	90
PID 1576 wrote to memory of 680	1576	资料_install (1).tmp	90
PID 396 wrote to memory of 2184	396	cmd.exe	92
PID 396 wrote to memory of 2184	396	cmd.exe	92
PID 396 wrote to memory of 2184	396	cmd.exe	92
PID 680 wrote to memory of 1056	680	cmd.exe	93
PID 680 wrote to memory of 1056	680	cmd.exe	93
PID 680 wrote to memory of 1056	680	cmd.exe	93
PID 2184 wrote to memory of 1964	2184	lPix.exe	95
PID 2184 wrote to memory of 1964	2184	lPix.exe	95
PID 2184 wrote to memory of 1964	2184	lPix.exe	95
PID 1964 wrote to memory of 3560	1964	lPix.tmp	96
PID 1964 wrote to memory of 3560	1964	lPix.tmp	96
PID 1964 wrote to memory of 3560	1964	lPix.tmp	96
PID 3560 wrote to memory of 936	3560	cmd.exe	99
PID 3560 wrote to memory of 936	3560	cmd.exe	99
PID 3560 wrote to memory of 936	3560	cmd.exe	99
PID 3560 wrote to memory of 2820	3560	cmd.exe	106
PID 3560 wrote to memory of 2820	3560	cmd.exe	106
PID 3560 wrote to memory of 2820	3560	cmd.exe	106
PID 2820 wrote to memory of 3972	2820	lPix.exe	107
PID 2820 wrote to memory of 3972	2820	lPix.exe	107
PID 2820 wrote to memory of 3972	2820	lPix.exe	107
PID 3972 wrote to memory of 3516	3972	lPix.tmp	108
PID 3972 wrote to memory of 3516	3972	lPix.tmp	108
PID 3972 wrote to memory of 3516	3972	lPix.tmp	108
PID 3516 wrote to memory of 4372	3516	regsvr32.exe	109
PID 3516 wrote to memory of 4372	3516	regsvr32.exe	109
PID 4372 wrote to memory of 2312	4372	regsvr32.exe	110
PID 4372 wrote to memory of 2312	4372	regsvr32.exe	110
PID 4372 wrote to memory of 2136	4372	regsvr32.exe	113
PID 4372 wrote to memory of 2136	4372	regsvr32.exe	113
PID 4372 wrote to memory of 900	4372	regsvr32.exe	117
PID 4372 wrote to memory of 900	4372	regsvr32.exe	117

C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe
"C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\is-HL81A.tmp\资料_install (1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HL81A.tmp\资料_install (1).tmp" /SL5="$602B6,1145727,235520,C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe" /VERYSILENT /SUPPRESSMSGBOXES
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe
      "C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe" /VERYSILENT /SUPPRESSMSGBOXES
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\is-UAEOB.tmp\资料_install (1).tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UAEOB.tmp\资料_install (1).tmp" /SL5="$40112,1145727,235520,C:\Users\Admin\AppData\Local\Temp\资料_install (1).exe" /VERYSILENT /SUPPRESSMSGBOXES
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1576
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\lPix.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Users\Public\Documents\lPix.exe
        
        C:\Users\Public\Documents\lPix.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\is-K83E2.tmp\lPix.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-K83E2.tmp\lPix.tmp" /SL5="$802B6,544961,235520,C:\Users\Public\Documents\lPix.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C timeout /T 3 & "C:\Users\Public\Documents\lPix.exe" /VERYSILENT /SUPPRESSMSGBOXES
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 3
        10⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:936
        
        C:\Users\Public\Documents\lPix.exe
        
        "C:\Users\Public\Documents\lPix.exe" /VERYSILENT /SUPPRESSMSGBOXES
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\is-G9GVM.tmp\lPix.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G9GVM.tmp\lPix.tmp" /SL5="$401FE,544961,235520,C:\Users\Public\Documents\lPix.exe" /VERYSILENT /SUPPRESSMSGBOXES
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll
        12⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\system32\regsvr32.exe
        
        /s /i:INSTALL C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll
        13⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll' }) { exit 0 } else { exit 1 }"
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{EFF11FCA-251C-49D8-9A47-AB5692BD08FD}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
        14⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
        
        C:\Windows\system32\regsvr32.exe
        
        "regsvr32" /i:INSTALL /s C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll
        14⤵
        Loads dropped DLL
        
        PID:900
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\LDcA.xls
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\Documents\LDcA.xls"
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:1056

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll
1⤵
- Loads dropped DLL
PID:4392

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll
1⤵
- Loads dropped DLL
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7b83052d233778f3041cbe528da041ba

SHA1
06a90380d32a7671e40af152f9d7f760012f95b9

SHA256
1b8b2000241fefe3e07d0b47e9ffb20a797bc91ae7bb298d0dc509f8f8785654

SHA512
d524cd16f51d7e0c64f38347e2916fdc3ebad834d77a2de8627211980105fc0bf68afc3b81d48f456f8f64876132909c4e38d998cc7bfed05250689f8b0685af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_preup1pg.dfd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BQ5QU.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HL81A.tmp\资料_install (1).tmp

Filesize
1.2MB

MD5
cf45d17c6928f460e9c66d8efd61d15f

SHA1
04f45e51c5ee587ac54084e051837cc4688f3fea

SHA256
a87c544e201116ebe9e5aa748f1a4d91d4aadb18d7a2c24c27a9cf5c881b400b

SHA512
178d1f8df6f98246fa579d49af62a526a7b3ba34532ed0e160b82148bb5869192408562c2a7b4d5602cf7b907acea1f2b716c77b8eff912a930619f6cf70a596

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K83E2.tmp\lPix.tmp

Filesize
1.2MB

MD5
bef5bad133138ce27f0c6e73d5a2e5f9

SHA1
1cfc9e170e100fc23073cdfcf590594e18598314

SHA256
55adc6677700e166913c9f26a213d93244242b17331b4f9a606760117b698b65

SHA512
f8d3d971a58fdc2d7585c61c70c41d0625b2cbda9698f7a26ed009374d9f4986effc9d69dd1579f38f22bd7e7700d714702df663dfcc195c11b6fc2d0b315f2d

Download Submit
C:\Users\Admin\AppData\Local\unins000.dat

Filesize
3KB

MD5
5eadc1f79f4f377ac3d2160bdb304f80

SHA1
728d27a2dc8d38634216d06bd59e7315cefd3037

SHA256
27cbe0caa71624bfb472402b7da15cd6fa876aaa517dd6bedf4cc80bba138a0a

SHA512
7b090395faf391d551b79918753bf6c7b39522dac143c18a5cc56aa061b68dfd153b9490b9645f440e61d7280a379f6618600342f69dfbf5fc1f914881f87756

Download Submit
C:\Users\Admin\AppData\Local\unins000.exe

Filesize
1.2MB

MD5
7d32e1d324403f5baf3443502f6732b9

SHA1
583a56865861c01413abda1daa132b577920504c

SHA256
4b6b8555cca21071bf3c90dc7d8a74e2fa2d1bf5bf85aab0b88a7a19962cb313

SHA512
8880c8f087a848964a777430c72d5ae52c9ff2d82a59b79e9df3084a26889ee5526de02b2b13fd43074510129f0898b093d397e23127cc7330896f10fc6d3e0b

Download Submit
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeBed.dll

Filesize
722KB

MD5
385e36fd28d88b4fe7051de59bcd616c

SHA1
0c6bac3bda42f8dedfba7559d092da5baaac81b4

SHA256
f13c09688c8f5e11c57680a446d2ab52918a53782cf2827ca768652e1013b2f0

SHA512
5ea5505dceb529ef4aa40fd13c23646fc36c74e3a0d86047ae66e1d1b70865f24279b3ea1d5a28f456e44a258a7c75516171ee201049e53420a34e69186ba86f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
249B

MD5
7b3019794f46e10207df78cec074ba84

SHA1
37f7f1155da5707f25499c7d4d76c91145ed46a3

SHA256
b1ff13890a938534620e0a0bdd61ce9472ddebb9d2f50066ebf3751b98d5e9c1

SHA512
bd76b729281187d65d1208dfb6ec719d5a663e5996c5ebd6d985fb21dc3137561e22ede0a3af2d932be813d58de371e68446a612da8b5c548d6a111e4bf845a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
3599f10e9bf06bf22909d060cec58b4e

SHA1
cf29fc283d1b9983809b2b5bd235c70425b46b59

SHA256
39fdeaba350fa7db11fcc331045b2a7c2590ebb2c92e44476b612ec15d30ee03

SHA512
e37b5d254a757f90598d83b8b7ca518efa7f4c404e25278745e39c2bb68926e5709592a6eb9bf829042bf4acfaea2789e99125d69376e398aa11c58f24c9f6be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
683B

MD5
0170f9d1ae30b86da109b1cf5677b240

SHA1
920fbb8dd889b5fa11bcc6da54a19ff5ff684afc

SHA256
b453070c92b022034d16fed311e704ed415d30fe737aba70df3f428d33b55574

SHA512
d93ad956e04709868dc58c786ce2c3919f27ae0bc512a2116b10eded79ebd2ee4e62bd84c95d053308a65b37d01ef824922d9d7691fe97cfdd1029ab5a9c3ac8

Download Submit
C:\Users\Public\Documents\LDcA.xls

Filesize
18KB

MD5
d1ff725260128c439f9bce6f7a26f5ec

SHA1
a22f5c06fd34b59daa1475789f659e324368a76f

SHA256
dfa1e555ec717a30d1ccccc87e64cc143f0f2d436c8aa07221143482045df00d

SHA512
41e4876cea614c602953f40f835172fb80db5b8b241b0bb522eb9535a97c4e2365cfd335395bdbc87245290f7b8331539d43aec2c1be4de2bb3e7e925ea0696c

Download Submit
C:\Users\Public\Documents\lPix.exe

Filesize
985KB

MD5
8cb4b8edf79a9edaf533920c9a4d2757

SHA1
8d5b6701db176148d9bbe8cc97338798c518201c

SHA256
c09f6cc092879d5b34f8668114453cdace4d3a6f303214baeca9a32d62bde1c2

SHA512
82478f5c7592a2555f67608d9564d7b31bdde10443ea6a480d991712c6e2eaafefbb2401746f862960deb8796cf31aff0f3410caeb05fa933d8ecb402581d2e0

Download Submit
memory/1056-47-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/1056-48-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/1056-46-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/1056-49-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/1056-50-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/1056-58-0x00007FF950B50000-0x00007FF950B60000-memory.dmp

Filesize
64KB

Download
memory/1056-59-0x00007FF950B50000-0x00007FF950B60000-memory.dmp

Filesize
64KB

Download
memory/1576-32-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/1652-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/1652-41-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1652-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1964-103-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/2184-42-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2184-104-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2312-110-0x0000027C5A2A0000-0x0000027C5A2C2000-memory.dmp

Filesize
136KB

Download
memory/2820-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2820-102-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3296-34-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3296-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3296-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3972-100-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/4372-134-0x0000000002CA0000-0x0000000002CB2000-memory.dmp

Filesize
72KB

Download
memory/4372-154-0x00007FF96D930000-0x00007FF96D9CD000-memory.dmp

Filesize
628KB

Download
memory/5044-37-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/5044-7-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download