3d05fee7a89dfce1ad029562fa7b84346bce12d932214cde9b26f266d53ce49c

Analysis

max time kernel
144s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
10-06-2021 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d2f33da036cf7945401ec14ae9ff6ca.exe
Size

568KB
MD5

2d2f33da036cf7945401ec14ae9ff6ca
SHA1

411a5706daf68e47dd828af8c2616d67420b7a94
SHA256

3d05fee7a89dfce1ad029562fa7b84346bce12d932214cde9b26f266d53ce49c
SHA512

77ef687b29f74735eb652277cbc16b646cd0c14e0b2290eb05a9b5b9556b5f41b0a3c6126dee5be5f53485a35d81d454dac9ba5fe3322378ab3b9f061652feb0

Score

8^/10

spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

2d2f33da036cf7945401ec14ae9ff6ca.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 2d2f33da036cf7945401ec14ae9ff6ca.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2d2f33da036cf7945401ec14ae9ff6ca.exe

Drops file in Program Files directory 2 IoCs

Processes:

2d2f33da036cf7945401ec14ae9ff6ca.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\DotNetZip-icvctmbv.tmp	2d2f33da036cf7945401ec14ae9ff6ca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\resources.pak	2d2f33da036cf7945401ec14ae9ff6ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4152 taskkill.exe
4668 taskkill.exe
Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings firefox.exe

pid	process
4152	taskkill.exe
4668	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

2d2f33da036cf7945401ec14ae9ff6ca.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
1440	2d2f33da036cf7945401ec14ae9ff6ca.exe
1440	2d2f33da036cf7945401ec14ae9ff6ca.exe
4888	chrome.exe
4888	chrome.exe
4556	chrome.exe
4556	chrome.exe
1008	chrome.exe
1008	chrome.exe
3208	chrome.exe
3208	chrome.exe
5316	chrome.exe
5316	chrome.exe
5396	chrome.exe
5396	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

2d2f33da036cf7945401ec14ae9ff6ca.exefirefox.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1440	2d2f33da036cf7945401ec14ae9ff6ca.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	4152	taskkill.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

firefox.exechrome.exe

pid process

1372 firefox.exe
1372 firefox.exe
1372 firefox.exe
1372 firefox.exe
4556 chrome.exe
4556 chrome.exe
4556 chrome.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1372 firefox.exe
1372 firefox.exe
1372 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

1372 firefox.exe

pid	process
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

pid	process
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe

pid	process
1372	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2d2f33da036cf7945401ec14ae9ff6ca.exefirefox.exefirefox.exe

description	pid	process	target process
PID 1440 wrote to memory of 3220	1440	2d2f33da036cf7945401ec14ae9ff6ca.exe	firefox.exe
PID 1440 wrote to memory of 3220	1440	2d2f33da036cf7945401ec14ae9ff6ca.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 3220 wrote to memory of 1372	3220	firefox.exe	firefox.exe
PID 1372 wrote to memory of 2104	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 2104	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4720	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe
PID 1372 wrote to memory of 4876	1372	firefox.exe	firefox.exe

C:\Users\Admin\AppData\Local\Temp\2d2f33da036cf7945401ec14ae9ff6ca.exe
"C:\Users\Admin\AppData\Local\Temp\2d2f33da036cf7945401ec14ae9ff6ca.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.0.1492433872\1320420230" -parentBuildID 20200403170909 -prefsHandle 1488 -prefMapHandle 1480 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 1572 gpu
      4⤵
      PID:2104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.3.1613558633\1253004179" -childID 1 -isForBrowser -prefsHandle 5456 -prefMapHandle 5452 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5468 tab
      4⤵
      PID:4720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.13.1632934106\1323996685" -childID 2 -isForBrowser -prefsHandle 5256 -prefMapHandle 5424 -prefsLen 1022 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5296 tab
      4⤵
      PID:4876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.20.914826676\1666593446" -childID 3 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4136 tab
      4⤵
      PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0x84,0xd4,0x7ff8a64a4f50,0x7ff8a64a4f60,0x7ff8a64a4f70
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1564 /prefetch:2
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1772 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
    3⤵
    PID:3156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1008
- - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
    3⤵
    PID:4152
  - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff73213a890,0x7ff73213a8a0,0x7ff73213a8b0
      4⤵
      PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=892 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1548,10748985336983438967,2329767992977540886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2024 /prefetch:8
    3⤵
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C taskkill /F /PID 1440 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\2d2f33da036cf7945401ec14ae9ff6ca.exe"
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /PID 1440
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C taskkill /F /PID 1440 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\2d2f33da036cf7945401ec14ae9ff6ca.exe"
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /PID 1440
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\89.0.4389.114\resources.pak

MD5
f821c9373168a40378173f2af19112c2

SHA1
cda76f41b912c5407df424a7e3dc9741bc6e1bc5

SHA256
795e05d1b80a0991927a178e1220dc22d3e0b33223fb197a4b205cb7762a3405

SHA512
359491708e03d5e8a9b60ce1df6abc363174af8e173bf605fdb524704c819aac03a9071ec34f3ce685669e1b6a3461ed9af436eddc60e884b9ee118fa5ea7581

Download Submit
C:\Program Files\Mozilla Firefox\omni.ja

MD5
519144c818963ea5fc2ab482dbf1ea0b

SHA1
00cd5dd55eee91ded3e4e17c8fd3dbac963cf556

SHA256
9abf505903203c5673e976b6cf4edd62fb6d8f83f93b1a1b1c9961f1528aa8f9

SHA512
6c2c5883b0096f27a0dc2f9848d8a7b6b5bbdf7ef03c6d636820d1e6a7440bbf90fb3dcd18c5e6b039c336dd51536766ba28f00960f32d63469d8c678d98a7a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
3621eda26da95a4142955f56c5c385d0

SHA1
e597ead68d1ca0171ee532c6ca6e157c8ddea06a

SHA256
e3d07ea541c32c7f419079ed9fc753dcc6452593419a179534bfc60f21d9305f

SHA512
1c8c5aca4e2021ead5016361586ebd5e1a92f039996faa43fc3b88f5aae03d152052df3b92c63f8939c3d709c6dea79d1aaa6f988b646527ed0bba0cd6c0bf4a

Download Submit
C:\Windows\system32\drivers\etc\hosts

MD5
7308e58bf4b9264368e35494e7627965

SHA1
d221abedd37acc45a9ebbd861106a66aee57e595

SHA256
ddb3763958a15ad9d6cedfd472daf9528e93ef5214b9dd4472de26a14705aae8

SHA512
1ed20fad96ae459e82592792038bffdfd4dc009eab84ab8af33ea2f9faed976aacd4937a8b0fec8095b05b02839c96277dccb6c3ca525ce226822d84670e279e

Download Submit
\??\pipe\crashpad_4556_LATUVRIPYQAJQHGR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1008-208-0x0000000000000000-mapping.dmp

Download
memory/1372-123-0x0000000000000000-mapping.dmp

Download
memory/1440-120-0x00000000052D0000-0x00000000052DB000-memory.dmp

Filesize
44KB

Download
memory/1440-118-0x0000000004B93000-0x0000000004B94000-memory.dmp

Filesize
4KB

Download
memory/1440-121-0x0000000004B94000-0x0000000004B96000-memory.dmp

Filesize
8KB

Download
memory/1440-115-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1440-114-0x0000000004C80000-0x0000000004D4F000-memory.dmp

Filesize
828KB

Download
memory/1440-117-0x0000000004B92000-0x0000000004B93000-memory.dmp

Filesize
4KB

Download
memory/1440-119-0x0000000004BA0000-0x0000000004C6D000-memory.dmp

Filesize
820KB

Download
memory/1440-116-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/1680-166-0x0000000000000000-mapping.dmp

Download
memory/1920-163-0x0000000000000000-mapping.dmp

Download
memory/2104-126-0x0000000000000000-mapping.dmp

Download
memory/3156-165-0x0000000000000000-mapping.dmp

Download
memory/3196-157-0x0000000000000000-mapping.dmp

Download
memory/3208-211-0x0000000000000000-mapping.dmp

Download
memory/3220-122-0x0000000000000000-mapping.dmp

Download
memory/4152-195-0x0000000000000000-mapping.dmp

Download
memory/4152-209-0x0000000000000000-mapping.dmp

Download
memory/4236-172-0x0000000000000000-mapping.dmp

Download
memory/4340-181-0x0000000000000000-mapping.dmp

Download
memory/4344-176-0x0000000000000000-mapping.dmp

Download
memory/4384-187-0x0000000000000000-mapping.dmp

Download
memory/4556-137-0x0000000000000000-mapping.dmp

Download
memory/4580-140-0x0000000000000000-mapping.dmp

Download
memory/4668-194-0x0000000000000000-mapping.dmp

Download
memory/4720-131-0x0000000000000000-mapping.dmp

Download
memory/4868-146-0x0000000000000000-mapping.dmp

Download
memory/4868-150-0x00007FF8C04D0000-0x00007FF8C04D1000-memory.dmp

Filesize
4KB

Download
memory/4876-134-0x0000000000000000-mapping.dmp

Download
memory/4888-147-0x0000000000000000-mapping.dmp

Download
memory/5024-153-0x0000000000000000-mapping.dmp

Download
memory/5044-210-0x0000000000000000-mapping.dmp

Download
memory/5112-136-0x0000000000000000-mapping.dmp

Download
memory/5316-212-0x0000000000000000-mapping.dmp

Download
memory/5396-213-0x0000000000000000-mapping.dmp

Download
memory/5564-214-0x0000000000000000-mapping.dmp

Download