asyncrat | c69c9b8bfb8f56d263db7b065b6cbdc231b51c3e4ba88a95ed6ec3a091493cd4

Analysis

max time kernel
120s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13/03/2025, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

032000-Denuncia-laboral-fiscal-juzgado-civil-penal-03663_u41xd04c.xml
Size

1.3MB
MD5

5ed94ec725013e918de4ae54a764ced0
SHA1

af2a0a988b354c58b4bc5af02d559a3e2d9742f1
SHA256

b7ccd7e8ef59f2ffa0e4efb794367581fb7150f2fa783fa351cf7ab0f4398c3e
SHA512

ea9bd969a82af1863e52c3f572cf3c9f02910aefc28bd88d6b4f4b8acc1b13beb9c816d8429ff3753411c754af21657b11fb916a03a3cb6e787e6db407537476
SSDEEP

6144:p+g/YHKrD6D+g/YHxvB/rD6f+g/YHKrD6D+g/YHxvB/rD6x:p1g6D6D1gRvBDD6f1g6D6D1gRvBDD6x

Score

10^/10

asyncrat default discovery execution persistence rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

ansy5marzo.duckdns.org:7788

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1976	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	Copia de la citacion demanda penal juzgado de control de garantias.exe

Loads dropped DLL 4 IoCs

pid	Process
2888	Copia de la citacion demanda penal juzgado de control de garantias.exe
2888	Copia de la citacion demanda penal juzgado de control de garantias.exe
2888	Copia de la citacion demanda penal juzgado de control de garantias.exe
2888	Copia de la citacion demanda penal juzgado de control de garantias.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Copia de la citacion demanda penal juzgado de control de garantias = "cmd.exe /C start \"\" /D \"C:\\Users\\Admin\\SystemRootDoc\" \"C:\\Users\\Admin\\SystemRootDoc\\Copia de la citacion demanda penal juzgado de control de garantias.exe\""	Copia de la citacion demanda penal juzgado de control de garantias.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
15	bitbucket.org
16	bitbucket.org
17	bitbucket.org
56	bitbucket.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6ead844da781db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000213bcc3183f56e4c96ba3ff0430f2c84000000000200000000001066000000010000200000006381f46c128840de4623573a644b799e3d6118f30686754b4d6421ea0c7c7067000000000e8000000002000020000000a6d4b82f944b74aaa70a35b94ac9215222c7358d350d9a576dc7f7203941a6d320000000fd0fc80be3b348f8fedf3a3af188071bf6211c47cbcdc1642dfc73897a2a9c3d40000000130b86a35658d8676f0fd077b5e09fd78eb809e9c1e07d5c403265d5dc73b356c8f92c5e2e16570320eec719d03a19330272ffdcfb2f18557adee37e7f9cbc9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000213bcc3183f56e4c96ba3ff0430f2c8400000000020000000000106600000001000020000000574a56eea63433fcd8d3a6aa521d9208817277aaa573256527d025027cc0b3b1000000000e80000000020000200000004f0b09d11a35db5c20c54e12d0f68055ccbd56c2caf6eb60eccc2d70ca7cdbfc200000003f742a24e6a54b87d0f0bfbb59cdcd085faf9e88cca12cc4459e8c87395e683c400000008dc33f5e40d2d22cb0ea078e4a067b34e79584ba4f94040d34ec3725c44c92700d78a680d4c54f9226840212559be006c5472636bc2cab9fa37c9c4c3b0dd166	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203669ccc193db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F71A9347-FFB4-11EF-B31A-E6A44325E283} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f16dccc193db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "448598794"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{C97845F3-1317-485E-A58B-FBA8A1166B17}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1976	powershell.exe
1976	powershell.exe
1976	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4364	7zFM.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeRestorePrivilege	2492	7zG.exe
Token: 35	2492	7zG.exe
Token: SeSecurityPrivilege	2492	7zG.exe
Token: SeSecurityPrivilege	2492	7zG.exe
Token: SeRestorePrivilege	4364	7zFM.exe
Token: 35	4364	7zFM.exe
Token: SeRestorePrivilege	60	7zG.exe
Token: 35	60	7zG.exe
Token: SeSecurityPrivilege	60	7zG.exe
Token: SeSecurityPrivilege	60	7zG.exe
Token: SeDebugPrivilege	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeIncreaseQuotaPrivilege	1976	powershell.exe
Token: SeSecurityPrivilege	1976	powershell.exe
Token: SeTakeOwnershipPrivilege	1976	powershell.exe
Token: SeLoadDriverPrivilege	1976	powershell.exe
Token: SeSystemProfilePrivilege	1976	powershell.exe
Token: SeSystemtimePrivilege	1976	powershell.exe
Token: SeProfSingleProcessPrivilege	1976	powershell.exe
Token: SeIncBasePriorityPrivilege	1976	powershell.exe
Token: SeCreatePagefilePrivilege	1976	powershell.exe
Token: SeBackupPrivilege	1976	powershell.exe
Token: SeRestorePrivilege	1976	powershell.exe
Token: SeShutdownPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeSystemEnvironmentPrivilege	1976	powershell.exe
Token: SeRemoteShutdownPrivilege	1976	powershell.exe
Token: SeUndockPrivilege	1976	powershell.exe
Token: SeManageVolumePrivilege	1976	powershell.exe
Token: 33	1976	powershell.exe
Token: 34	1976	powershell.exe
Token: 35	1976	powershell.exe
Token: 36	1976	powershell.exe
Token: SeDebugPrivilege	4264	AddInProcess32.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2492	7zG.exe
2492	7zG.exe
4364	7zFM.exe
60	7zG.exe
60	7zG.exe
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
928	IEXPLORE.EXE
928	IEXPLORE.EXE
928	IEXPLORE.EXE
928	IEXPLORE.EXE
4440	IEXPLORE.EXE
4440	IEXPLORE.EXE
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE
928	IEXPLORE.EXE
928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2080	4904	MSOXMLED.EXE	84
PID 4904 wrote to memory of 2080	4904	MSOXMLED.EXE	84
PID 2080 wrote to memory of 928	2080	iexplore.exe	86
PID 2080 wrote to memory of 928	2080	iexplore.exe	86
PID 2080 wrote to memory of 928	2080	iexplore.exe	86
PID 2080 wrote to memory of 4440	2080	iexplore.exe	92
PID 2080 wrote to memory of 4440	2080	iexplore.exe	92
PID 2080 wrote to memory of 4440	2080	iexplore.exe	92
PID 2080 wrote to memory of 1500	2080	iexplore.exe	104
PID 2080 wrote to memory of 1500	2080	iexplore.exe	104
PID 2080 wrote to memory of 1500	2080	iexplore.exe	104
PID 2888 wrote to memory of 1976	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	110
PID 2888 wrote to memory of 1976	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	110
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111
PID 2888 wrote to memory of 4264	2888	Copia de la citacion demanda penal juzgado de control de garantias.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\032000-Denuncia-laboral-fiscal-juzgado-civil-penal-03663_u41xd04c.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\032000-Denuncia-laboral-fiscal-juzgado-civil-penal-03663_u41xd04c.xml
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:928
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:17414 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4440
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:82960 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3696

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\" -ad -an -ai#7zMap243:194:7zEvent3313
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2492

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4364

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\" -ad -an -ai#7zMap13328:328:7zEvent23071
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:60

C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\Copia de la citacion demanda penal juzgado de control de garantias.exe
"C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\Copia de la citacion demanda penal juzgado de control de garantias.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\SystemRootDoc' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4D1ED785E3365DE6C966A82E99CCE8EA_4FF21E9CE9761A304E66D2F0263F90A7

Filesize
471B

MD5
9e469e4d7715aa1360dbed195fa6831d

SHA1
9396f02ed3cef3c2ba3daff788404281aad076bd

SHA256
6a6b3fc62bb481662872a46ffd36b9334c2d760d40fc15b9c76b417ddfd059f3

SHA512
38810d1ba2c636bb76e453c1696815f8e9fbd3bdb2354ca317ced6ea8adeeb3d03f7e0b292b2c342c88b40f0bd57c1cb47eb9eb671573608d0e793abf01b9cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Filesize
1KB

MD5
428d6b8e7f377b851998eb3dd1e35819

SHA1
3621befc0472e5d832e59f2ab6d4dc14d13f1f3a

SHA256
e1e1d9a3174eaaa8a6877cfe8304fc897aa75a4d1c713b6d3a1a1c679560058b

SHA512
11e67a84f1e54d07bd6366193ed0f64b1232548fd145d38ec783a7394050a3559cd373e9f19aa33c35e7040668ef7589395a4692f4e2f632e43471bcad56f0b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
cf21f644e97627f92a1a1d1663524d53

SHA1
12c3ee23dd2e5d27a240865aa3121d7acc05c3ae

SHA256
1fe2a1e4b5e96d27414846926ec21b35d7537532a51a19a4c9c903f530ba8bd4

SHA512
c3cc40a39e1e538c56f3f7d984f6cbbb43768136526d278aadb5bc8d7964f696532d6b29fd606dfd20f28d07cdf31026cede98c4000f633783acbe984aa43160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
7172614abd8bd499906ab0b7fc408e83

SHA1
cc34a5fa0ca8a5d12d082a684b446b03a9d45656

SHA256
0ce07b4a43bfbdc6f9448b238a87fc56c7650fe4207c8ecfc158fff134316bd1

SHA512
833d9a86e56d67aa3971397f2c8ba85c7eaa9a5db9122e8840dcef1ea06315e05ec9a1a6cb770572f1e08fca70e5c3bc50a02b9ca023781755cd67c53acbf32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_5201C9F0FF1BC3F361EC506AFCE136CA

Filesize
471B

MD5
b5dff213464983a647e5f136e719dd12

SHA1
df10a4819e407650af3ccb551d2df7f8e92aecc8

SHA256
0bb77a8fa92f188256b786add84680bce945ee38b0a34ce27cbd2c4964b38b8f

SHA512
2b14a65dfe806c4a41f1a471d29fc7ba8b0e4de014061571b822b11cdf5e5bb7f1f995f1d7b22da252c9311ce9ec620990ba2aaddc3e0b66c51acfd270038f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
e504e5c22a606a06e8531a46cadc4d73

SHA1
6cd67f1822fc8f87dbabcc1942c10392e5dea95c

SHA256
2572701c2e867d400c726deb08b6e0912b9bb0507baa406fa2f4beaa03386728

SHA512
7e6134377c331192e8c99f062e80c4a5a1dba6c27fd860ede3b455868c284049f32628fa24fc3ef19ea647ad1e66eddfd70b04790bde29b90abdd646df59e94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4D1ED785E3365DE6C966A82E99CCE8EA_4FF21E9CE9761A304E66D2F0263F90A7

Filesize
400B

MD5
ffcf0a52254a6f54b38c7fa49ab136b8

SHA1
6d1060f7c9965342f94838d7b06a8768284221bd

SHA256
83bbc04d604517c62c1c86f2db919782c0115c64eeb56e5926031e4571adaacf

SHA512
65e539c6d457102367205f3721d9c73c579c641852866d6c6d6e8e25c0cad4765d8f18fc27faba766727bec2625c1027b3486cfcac90a374e883dd040b651d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Filesize
438B

MD5
e1bf79bb1fcd4d6178e83da0cef7a187

SHA1
6d5546ac1226228b4c3ebb3748669238a0d2b2d9

SHA256
2f41ca7fc9699e6b5e7233ea53fab426064072d5e1293fbcd7f9b858bc0864b4

SHA512
2fb9ec9eb4a9208cd010bcbfa918a77d60662b2ec109fe81ccce3cd63486da41531a6961beaf1dc9e5344c801f2e399516c1986f2340fc3edb037c2faef15a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
c755d42fe6c1d091cdb95bfda68a18a1

SHA1
ea8095e34be76f393b61c183ea86efeff9c70b51

SHA256
85c1d5f4d5ea841cb9005bf1d7bd5a79db23b31a5537670d1b7f1532d573b2e6

SHA512
b1dd49e88eea0ff1fe834426321af050b9809b1c04ae244579cface30b5030da2047353674d5d925530af3487de571872ed50ea320a0d15b6af9717959ad6f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
25854132dd11aab7ff52780996da0e14

SHA1
ea97b3d97e8431c709118c492047f81dc18be186

SHA256
9044d8b5abb53351bc33fe18de3dfb397577e41c55ff4a58d1a6a71ce2e1eb87

SHA512
6245d6394d65f338f4bbe0505cb95a75a789527bfd445e5fc3f58112fa661db1527a14e19a9d7e240f02f1a925b42b45697f0a705d10d85565554f407933fd73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_5201C9F0FF1BC3F361EC506AFCE136CA

Filesize
418B

MD5
425f5a591e9d517d7d10b92ab9e7d253

SHA1
5dd2e81dbc3635112e9fbcd54ed20504c61745bd

SHA256
df141ac5ed8a919c3d38aadbd88f02b2a021f648d6285240890f947c9e4c5af5

SHA512
a08f9d20c6b5e9a2ff1882c84c27fc505e21b36e3c66c8df3353bfb54f39641229255e6027957f9acb2715f619015e66152da283488e566233e163b573619838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
54d9499afe58f10d93f33e65b3e80f51

SHA1
34421ac8e400e374a9678f3383721538b96e8ee3

SHA256
cd7baf720900b45a02168165c63cb8f1bab60051fa7d52a72185021b56da9c65

SHA512
8704706bb5588124e965567d24629e2a3b4d0a5bf09e1c8152682d923797b40a4a1f6db5d4bfb0ddab42a974aecd62bbf010dd838c5d005af96c8e8cc2e79580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
f42859e110eb193673491df4ff5efea8

SHA1
2a9c817578157fbce235d2ea3b1befbe10031dd8

SHA256
6b751e9fc4fa7ada5f78ef91ab8dfcac8d5b5bb17b739b5d5a0095dedf05ebde

SHA512
aba86a5a207dfe45311225a26634eeda1de75403f1f4f86bb9728bc6592d6753b7b7b5b87994b6e42e4b034169062ab11bf03200a827edb21d79c89fcc2bf032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQNUL0UI\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xehg0foo.i3t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias.zip.p5tv81f.partial

Filesize
4.3MB

MD5
1283b5a48d8688b9983faeeb00ce8743

SHA1
c5033245c41c3f5de36405e585fdb317a41b55d2

SHA256
e2f8db1c89206eaf66506ca645ce44d0034946968d7fe2b6050dd15c8318b7da

SHA512
f6822d606a36373d452a53306d0b673c3041896c4baf862da989fa9a712c9742c9a01475c217a7fa3b97ddc890d9584c7f2950ba239b3be5106571d314c92696

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias.zip

Filesize
4.4MB

MD5
ba66d83549185145bce8bde2e722830f

SHA1
a07f798d672a9ca0ab7e8b6ef87b465ddf8f1a61

SHA256
41fa031156d209765834398cc8fb0d494f3b2da66c8d7ebe85ad0058f3632e3a

SHA512
ca6176fd764fa11535cdb376ac0d690bce0e7e37ac4dc474fa734754ae11628eead1040826ef1445f454541a67bd186c8895cf5f4029c7edf91739f6c5f09c94

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\Copia de la citacion demanda penal juzgado de control de garantias.exe

Filesize
74KB

MD5
4ee7cfe6a087a135baa788a6b70374cf

SHA1
b653e606d802e6b59acff266960a18608c2d82b6

SHA256
b74c06dcdad4f92f40c9074c458a12d7943d121f2ea43f30c854a6a7827418d8

SHA512
fd77eec2730da3a3809abf083918a1e0ba40a3105db9d087a39da53646895660e2eec1a53441de8fafb15220f2836857b22feb9ca907af5b105a24e2ea4bbfed

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\libbrotlicommon.dll

Filesize
6.4MB

MD5
768674839b66dfd650581cfce00110a4

SHA1
0bfba401735276f8bf6e7929ca1285e80d76413d

SHA256
59abc5ac444c711bd2fc21c44dadb8f4900899ce9b69989d84598cfbb6ad4f8a

SHA512
49c276d1995965711ba64178182419a69f1d6455f7c5721977650193880687dc88db05b0ba8ba3234653df5ac86bb5c50b5f9eb09e9996507aa1fe98e6249deb

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\libbrotlidec.dll

Filesize
69KB

MD5
8c764cb1fc89c84eed611e4ad44a2be6

SHA1
58d8cfb7b8a5b114573ea2d8c6bff742200e78ae

SHA256
2f8ea3439e11ee1b2888ee71d3698fd46bd7772b6d361a27b7c8d76b159bdf5c

SHA512
4ab0b378a6de1c5093b3f78b006be3d5f7495b2241440cc484ab77a02d67bfed03060a26158d481c400e4fb511ad40b8f3f787b3c3c1adb1cfcbdce9d03eef51

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\libbrotlienc.dll

Filesize
738KB

MD5
619012390cc5742d62bf04f687fd4fd1

SHA1
5001768f66c9b5cb62c62b4b2a69d4ad2e7832bd

SHA256
2bfa7da17a87607abcaffaba1dd4addf25c7c3abcd7767cf23a6d065bc03cfda

SHA512
309b7e8dea684a7d5fc6246f2943d494e3734109600f7bb79e545489d1d9010b02fadfbac4de43fd7372d4f77166a2ddc90446c842b67b6950b8937dd7a67c94

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\msvcp290.dll

Filesize
2.0MB

MD5
105b8f7dd45ab1446bbe5fd282665fb4

SHA1
8c6cb8555acfda1dcb9cadb1e73838de5c1f5130

SHA256
fde57d4b3de1e806b581d215d5073a3163a0fb9c8c64e34574a23b3b66a74f41

SHA512
81da8058b3fdc169cc2c58b31687f25584682506106f16c33524a8d24615b42fc7601d8c65b52e9c34b78416b8eb1b24c133f4795300fcc1dc1a83fdf32382d4

Download Submit
C:\Users\Admin\Downloads\Copia_de_la_citacion_demanda_penal_juzgado_de_control_de_garantias\Copia de la citacion demanda penal juzgado de control de garantias\nasrallah_x86.dll

Filesize
63KB

MD5
ec3b35b248d2ca566cc3468238ec6130

SHA1
d924e29f7c6213cea489b2a30238d496de82af1c

SHA256
49ba053330eddba725dac7003d8d83a6279306c0ef62c70164ecbae527a3356c

SHA512
fde7ee986766f513725bc411b84f72e38e47b6bf6fc1fefd2be622b574340511d86de371ab87329402721f576e082d79ea98a9ba33a88431d09b7745e488376f

Download Submit
memory/1976-117-0x000001B8CFA70000-0x000001B8CFA92000-memory.dmp

Filesize
136KB

Download
memory/2888-106-0x00007FFF97810000-0x00007FFF97827000-memory.dmp

Filesize
92KB

Download
memory/2888-107-0x00007FFF96AF0000-0x00007FFF96BAE000-memory.dmp

Filesize
760KB

Download
memory/2888-105-0x00007FF690230000-0x00007FF690248000-memory.dmp

Filesize
96KB

Download
memory/4264-122-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Filesize
408KB

Download
memory/4264-121-0x00000000063E0000-0x0000000006986000-memory.dmp

Filesize
5.6MB

Download
memory/4264-120-0x0000000005D90000-0x0000000005E2C000-memory.dmp

Filesize
624KB

Download
memory/4264-104-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4904-15-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-11-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-5-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-8-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-7-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-6-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-2-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-10-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-1-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-0-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-9-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-4-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-12-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-19-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-18-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-20-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-17-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-3-0x00007FFFA67AD000-0x00007FFFA67AE000-memory.dmp

Filesize
4KB

Download
memory/4904-16-0x00007FFF66790000-0x00007FFF667A0000-memory.dmp

Filesize
64KB

Download
memory/4904-14-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download
memory/4904-13-0x00007FFFA6710000-0x00007FFFA6908000-memory.dmp

Filesize
2.0MB

Download