asyncrat | hxxps://gofile[.]io/d/Wrsxqb

Analysis

max time kernel
147s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-01-2025 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/Wrsxqb

Score

10^/10

asyncrat default defense_evasion discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:7000

127.0.0.1:62240

Mutex

dfnefgnodkfgnopekrnfg

Attributes

delay
1
install
true
install_file
AudioBootSrv.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x001a00000002abd4-70.dat	family_asyncrat

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5900	newestonerealnewyears.exe
6060	AudioBootSrv.exe
4156	newestonerealnewyears.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\newestonerealnewyears.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1668	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 838741.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 502108.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\newestonerealnewyears.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
6080	msedge.exe
6080	msedge.exe
4076	msedge.exe
4076	msedge.exe
3168	identity_helper.exe
3168	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
5900	newestonerealnewyears.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe
6060	AudioBootSrv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5900	newestonerealnewyears.exe
Token: SeDebugPrivilege	6060	AudioBootSrv.exe
Token: SeDebugPrivilege	4156	newestonerealnewyears.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6060	AudioBootSrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 916	6080	msedge.exe	79
PID 6080 wrote to memory of 916	6080	msedge.exe	79
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 1760	6080	msedge.exe	80
PID 6080 wrote to memory of 2736	6080	msedge.exe	81
PID 6080 wrote to memory of 2736	6080	msedge.exe	81
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82
PID 6080 wrote to memory of 2476	6080	msedge.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/Wrsxqb
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc68d83cb8,0x7ffc68d83cc8,0x7ffc68d83cd8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Users\Admin\Downloads\newestonerealnewyears.exe
  "C:\Users\Admin\Downloads\newestonerealnewyears.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AudioBootSrv" /tr '"C:\Users\Admin\AppData\Roaming\AudioBootSrv.exe"' & exit
    3⤵
    PID:2088
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "AudioBootSrv" /tr '"C:\Users\Admin\AppData\Roaming\AudioBootSrv.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE86C.tmp.bat""
    3⤵
    PID:4312
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1668
  - - C:\Users\Admin\AppData\Roaming\AudioBootSrv.exe
      "C:\Users\Admin\AppData\Roaming\AudioBootSrv.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4152
- C:\Users\Admin\Downloads\newestonerealnewyears.exe
  "C:\Users\Admin\Downloads\newestonerealnewyears.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11188874446725716901,3184227994574946994,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\newestonerealnewyears.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
74KB

MD5
6e3d577c3ca714cfb99d078c43cc6b76

SHA1
6202d137a3fb54f82125b5c9fdb10ea582127a00

SHA256
58418d560c647df2b93fa47a6632b4b0b47ede7ea3621a2f6972e1b9aa8ddf58

SHA512
004b7a65306d0a2b48c56ee5c55268cfb998bedb3b783e6f669a211dc04b30f24958071582c3480ea4eb9448af6799b138fd306ed98e244b17457c99ce533e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b18e74af872fcb1a80dd0c337eebb34b

SHA1
ee6ac8062b602299d3ea97a5ba721bace27b1ac7

SHA256
fe7fe799d75a3733c44084426dd3e838c43db6e96c7743a8477fb49de1980a4f

SHA512
e11eeff5603b971adcf09b17df5cdccd35e48399757b6bbd20123952989752de28e5655801f572ca4bf0b8ed93b51d49aa26e2932866e5ccc4164ca1206fa30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
7c0d79b95ae2cf3dfd2a4054af266439

SHA1
c632524bc5141e51619f1bbab0149e8c9ad7660e

SHA256
482f5001679264f5a3f2a293accc44b07e092ea861755a66428fadcb0ff43d6d

SHA512
e2f8cf3582f48b0886ae7299646b1029f36c0e081fad45445b4a99f04b5993106fe7a0288842c50eb4ee10ad2dd32c98a848849b52e190c869144d5701804411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4410ba392f07c232c481502c47f12cad

SHA1
16c553dc1aa074e5685bc63f640fab94f6c49a02

SHA256
86f39879d3bba0518c7f5e9ae5b9b8a9eca2f2e45941dc0428b49d9d9ff9cc0f

SHA512
5ab14227076b384a0ad1320aea5675c78e366017bb7f2b8788f6402b52552d2f103d71d4429c5b0f404037f261db8ae6e2ccd1463ea331fa711de103ec036588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dba5f461526a1c74d5bd0a88ad9ef72d

SHA1
4028970f2e1ea3026ada6afd5cbdd63beb2a201e

SHA256
027aa1b6a89f6fda06c540477b0f9784331455bf72bac140ff9689261d8e7443

SHA512
525a2184446b8bf5c875f6f2c8e8db5803837454bf8d13b3ac8245caeab53786241eb29c9401aef6ecbbff853639814a82112fbad4219d05a6c6cbd18bbc070c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6844f003cb859611fb0e91431c3ae6eb

SHA1
18014c0272e5e1c8a70d6bb297dc274d206533fc

SHA256
7e1fe093163a7221d2c208242bf668d1708c188deef83dde378af87e3f11f868

SHA512
7be005978f4b7114de86aad259fe78d5ecbe5171857693148bce8796943ef1ea40e5f0f1d01ecf78a7338f71e93d7fd0b5b8f488ae1cc71389167774b5d1adc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8006e0aa796f383f49127dabdbd0c35b

SHA1
cdd6d045ed1a74f68ecc86ecf0533bd61aaad58e

SHA256
48564e69df31476296b4cf82df73df62a140904842390244ac95244ecd991882

SHA512
b772ff55169a458b87686ec70111fa128316d7d66953502283a5d93a1cc629ba5c4f51150ed9438908bc7500b7e28429a69fc5d3bf2f161d16046cd54697ced8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE86C.tmp.bat

Filesize
156B

MD5
f1883cb6a45aad1715d0974d54316229

SHA1
96e6e6eec9a121e675faf0a1e41339c06081d90f

SHA256
27780660bdfc387bcc0730f41f71e1abfec67b06fcd43dc19fa10d7c6adbae49

SHA512
44a3b54113cc646341f734eb66b343eeaa9440c654f30b65edbcebce85ee8d0fab5ed6fc4c4380316ff73a89af23d55c02f2db2eba3bec32119f29d1595cb380

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\Downloads\newestonerealnewyears.exe:Zone.Identifier

Filesize
168B

MD5
6b585e0937a48e4cacedec27adb2759b

SHA1
b44773ab44194ee5d1d5144ba04479e062fbfc51

SHA256
18821f4d96912619deee44a4748d623f6a62209ad393bf94b0d0290ebe051ecd

SHA512
429e7430b6dc760bc3bec4803cae8a25ac5f11160481286092d412fcf8f76ca2c3bc6230f61b2923d19b871967382b7e914f64a17d38ac2a09494e08b188f13e

Download Submit
memory/5900-97-0x0000000000A80000-0x0000000000A98000-memory.dmp

Filesize
96KB

Download