asyncrat | hxxps://docs[.]google[.]com/uc?export=download&id=19CC_9zA8khspUlQaA1MO2ajTZSGXtEGW

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/uc?export=download&id=19CC_9zA8khspUlQaA1MO2ajTZSGXtEGW

Score

10^/10

asyncrat gorra discovery persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

GORRA

94.103.125.231:2626

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Executes dropped EXE 1 IoCs

pid	Process
1544	NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CorelPDF = "C:\\Users\\Admin\\Videos\\CorelPDF\\Bin\\CorelPDF.exe"	NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 2212	1544	NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe	130

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
1748	msedge.exe
1748	msedge.exe
952	identity_helper.exe
952	identity_helper.exe
2004	msedge.exe
2004	msedge.exe
2724	msedge.exe
2724	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2212	7zG.exe
Token: 35	2212	7zG.exe
Token: SeSecurityPrivilege	2212	7zG.exe
Token: SeSecurityPrivilege	2212	7zG.exe
Token: SeDebugPrivilege	2212	csc.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
2212	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2176	1748	msedge.exe	83
PID 1748 wrote to memory of 2176	1748	msedge.exe	83
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 4288	1748	msedge.exe	85
PID 1748 wrote to memory of 2628	1748	msedge.exe	86
PID 1748 wrote to memory of 2628	1748	msedge.exe	86
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87
PID 1748 wrote to memory of 4828	1748	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://docs.google.com/uc?export=download&id=19CC_9zA8khspUlQaA1MO2ajTZSGXtEGW
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d9846f8,0x7ff83d984708,0x7ff83d984718
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13959931511816024492,13845199566252240176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4888

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952\" -ad -an -ai#7zMap21543:168:7zEvent26392
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2212

C:\Users\Admin\Downloads\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe
"C:\Users\Admin\Downloads\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
b64b0ebd89f96c0a171a1498ea686fce

SHA1
35c52d8afce799a8f8b26ec2498a6cfaebb38bbe

SHA256
5e0702fe10b21a8b873c5a8ed0368b03bfb81ae00b6b4779605dcd0ac7a247d8

SHA512
c8e52667910f60e2ea9a06cd0ce58d93133953c578d9fba76aa8572c5629915745ea900200b70d48adc14bf20b4263801ea5a589e731d40a003ed139fe0c7428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f1ce84c603fe18813258c8aa0abcd4e

SHA1
d9e37ddc0237bb34550a63851b852f0237f663d4

SHA256
be0cdcc546087c2fe019f4027b22eb8132d14ae65d91b98bba9205d727a24bef

SHA512
2868e19dbe97046c500cdb6b544e4f642096291ac09177f333627e4a4ece7c29fc07ec289a2319635bab5b989b77b3fc70a1398ad259600eafd8c296582b25f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4ca53f977230b7a1c9a8c8484a47207

SHA1
bf2c1accfa500d3cd9c36038e9281065e0f63ab5

SHA256
6316c691f5514208e3a9e51b4df5ec3a42cf50fbec58e55b24af4a555b004ca8

SHA512
cc57c0ea73133bdc03c5ecdf5ce633116ce739d970bfbe17ad246ecbb5ede9ddca3af5688fca8d176827b43580a43df4c3b418a0f78bc4a0390dc985a7069f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dc1d52000eaf3aa38212bced7066fa2

SHA1
b335f03148070d192487299dd88198e49f9efe52

SHA256
5d60c6b77707cb68417f44a7251782fb2cc6b00ec6045e75b56ec669fb32ed39

SHA512
dd0016b34f17a8d0516131d5b6fc98eeaff7b3c8a3f200c4bd25c2f815f3168344db810a629851910cf3e90880012b49b10bad825b49dd35df85f48a427bc7fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47d72bc6a9f08a2e95ee8855f0199022

SHA1
02f12649cb3df72787fdd875b44083cca8cad4b0

SHA256
2c667c2f65f345c5ba649972ada7b8f5805fe0fd8ec7e81f247d4b3b3837d46d

SHA512
85970fa6b2735f51d033d1cb7db98badbd35a2d90da6797acce3c0cecfd4758e75b3769114375599f428d2435c68632182b5fd79ebacc66b39c560ada7ed401d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be47c9524fe978958add869e4aedfa62

SHA1
201907365901df87bee09bc70d733e040381b5af

SHA256
800876397476916dcb9efebc047f0b2f7362f44ceceab8d48f29cc01ba7a4a46

SHA512
210ddb88ddfde03c60ae318c8af3e91b56527235488e1903ffe5c33ac4622e86e18ef92ce7519804f5ef9384a16d1d8e0213c1bef67ca01d6b29700c53a6d784

Download Submit
C:\Users\Admin\Downloads\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952\NOTIFICACIÓN JUDICIAL ; ADMITE TUTELA RAD. 2024 00952..exe

Filesize
1.6MB

MD5
8ab21403f6935629c7685e341b2dad7f

SHA1
eb94ac71923401db278e1d58d5dc0e59cf634e57

SHA256
055b26f8df8fd3f1fab62c1c3754db2ef3409dbe809482c70c9e33e1bd938e69

SHA512
8b159eb14c33ff9c3704f93f41c33f0d9bba1a641ab6b31a8b8d3b81cb87bc71d8edaa175ad7ba48d6fa063d94fae330f81f86ab12710c37ed0aac16cdf0e5ac

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 338713.crdownload

Filesize
966KB

MD5
2f0ecb466962e25610f90cfbbf18186d

SHA1
34ef10e1877029665be090adda002510f5330f60

SHA256
062351269bab6115d680bdcef1ac7f649b0a10b80e89a8d283c6ec16d5a345fe

SHA512
7cf6fde7656f2b022738beaffabb9f09c0b8f440a0865227c51cf535ccca7cb65763f5f258e0ef57da84b01e7a52512929bba500efaa510cea2d2725e175be0d

Download Submit
memory/1544-138-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/1544-139-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/1544-137-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/1544-127-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/1544-141-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/1544-142-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2212-140-0x0000000000B20000-0x0000000000B32000-memory.dmp

Filesize
72KB

Download
memory/2212-148-0x0000000005DA0000-0x0000000005E3C000-memory.dmp

Filesize
624KB

Download
memory/2212-149-0x00000000063F0000-0x0000000006994000-memory.dmp

Filesize
5.6MB

Download
memory/2212-150-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Filesize
408KB

Download