hxxps://0nszd44opc[.]live/?d2FsdGVyLnJlaWNoQHRvdmVsLnZn

Resubmissions

22-03-2023 15:36

230322-s2az1ahf56 10

22-03-2023 15:33

230322-szl99abe6x 10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://0nszd44opc.live/?d2FsdGVyLnJlaWNoQHRvdmVsLnZn

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2502745606"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2513995620"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe30000000002000000000010660000000100002000000013609d414438ebcdbf0262a5b8b39cc9e7f37b00f5d3090c15449b3f3b3a0e40000000000e8000000002000020000000727d58fa02a7bd1e4326989ebd56fdb67cc3e4f073321a98c932d80a6348258920000000fed154cbdd46c507e12f9845f622f8fca4af5a1d919db01843728e634a5a073f40000000c598b06cea828b63a27fc7e879d24511d5deec314491f9c8fb0c386efc4dcef031dab9c52c60580e760f205cab7763636657581443a63fa8651d80307cca1ec5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C044F7DF-C8CF-11ED-9EF6-E63637889D5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386267989"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31022300"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31022300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe3000000000200000000001066000000010000200000004cf60bf92ae108f7725db73337955a3393eacaa3ce596b7a84e6c04fee62c3da000000000e80000000020000200000004239ebe9608a7bc2a2d3ab854e5ebe2133b641bf1851a57865c39694113b05b020000000b1ab1655509f08358142e8a64334372891ac7f5c3666034ec1c3891707aeae7f400000001e3b8e1caf9b38606f70da60d572a32895b7e6045d2a3fdcd5aec02978b3e6bbcb649924718daa89afd7b1a9719aab5221c0e0dbfa9c25a5f67d7c90229cfe03	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c113a0dc5cd901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2502745606"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90fe1ba0dc5cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31022300"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings firefox.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 2156 firefox.exe
Token: SeDebugPrivilege 2156 firefox.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exefirefox.exe

pid process

1168 iexplore.exe
2156 firefox.exe
2156 firefox.exe
2156 firefox.exe
2156 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2156 firefox.exe
2156 firefox.exe
2156 firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	firefox.exe

description	pid	process
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe

pid	process
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
1168	iexplore.exe
1168	iexplore.exe
4248	IEXPLORE.EXE
4248	IEXPLORE.EXE
4248	IEXPLORE.EXE
4248	IEXPLORE.EXE
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 1168 wrote to memory of 4248	1168	iexplore.exe	IEXPLORE.EXE
PID 1168 wrote to memory of 4248	1168	iexplore.exe	IEXPLORE.EXE
PID 1168 wrote to memory of 4248	1168	iexplore.exe	IEXPLORE.EXE
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2396 wrote to memory of 2156	2396	firefox.exe	firefox.exe
PID 2156 wrote to memory of 3520	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 3520	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe
PID 2156 wrote to memory of 4272	2156	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://0nszd44opc.live/?d2FsdGVyLnJlaWNoQHRvdmVsLnZn
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.0.28740659\1478500705" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d11135ef-2223-4ff7-9e6b-304d500596be} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1900 1f3d26a5258 gpu
    3⤵
    PID:3520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.1.856842179\1733519622" -parentBuildID 20221007134813 -prefsHandle 2292 -prefMapHandle 2288 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b23a122c-8763-4642-b309-39d9b27a3b0d} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 2304 1f3c4572858 socket
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.2.168193953\1151117117" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3096 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a76f701-2704-471b-bce7-5a0dc8debc5a} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 3156 1f3d1592458 tab
    3⤵
    PID:948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.3.1688048448\810490563" -childID 2 -isForBrowser -prefsHandle 2456 -prefMapHandle 1456 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03bffaa3-aba0-47d7-85d1-07e77e1c1dac} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 1280 1f3c4571c58 tab
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.4.1888958029\351411558" -childID 3 -isForBrowser -prefsHandle 4080 -prefMapHandle 4076 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13617f8f-578a-421f-afeb-b08f8048cd15} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 4092 1f3d631b858 tab
    3⤵
    PID:2748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.7.1902209793\94540541" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70601c9a-5d3c-43c3-b1fc-b9cb01e415a4} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 5368 1f3d7d1ce58 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.6.1651816789\1183805769" -childID 5 -isForBrowser -prefsHandle 5100 -prefMapHandle 5104 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84c727f4-4a85-4208-8a08-6da52a891fb9} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 5088 1f3d7ac5b58 tab
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.5.1578357751\1617771450" -childID 4 -isForBrowser -prefsHandle 4964 -prefMapHandle 1632 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1513dffe-5a41-46f2-8fb6-5452622ebaf4} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 4972 1f3d7806b58 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2156.8.611072431\31330894" -childID 7 -isForBrowser -prefsHandle 5744 -prefMapHandle 5752 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c5a5662-93dc-4f1f-a341-246531f419f3} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" 5776 1f3d8f3f358 tab
    3⤵
    PID:5776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\feo4h2u\imagestore.dat

Filesize
17KB

MD5
58a114f3d5d15f83514110fbe41ce598

SHA1
f0a233a5b09073a112c3acaf828f7e7f48864fb7

SHA256
f1ab07a3b3a410c368641eb61f4bee1246db678e00b2eab1aaf541877f85b363

SHA512
8174f236cb3cadef9015ff3f0ff3b6cb4af7527ec7d10b06157852306b23f611c77dd27823d11150e2a0e2a2b595926048c4484c58a70b01bd42a678268fa34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\feo4h2u\imagestore.dat

Filesize
17KB

MD5
58a114f3d5d15f83514110fbe41ce598

SHA1
f0a233a5b09073a112c3acaf828f7e7f48864fb7

SHA256
f1ab07a3b3a410c368641eb61f4bee1246db678e00b2eab1aaf541877f85b363

SHA512
8174f236cb3cadef9015ff3f0ff3b6cb4af7527ec7d10b06157852306b23f611c77dd27823d11150e2a0e2a2b595926048c4484c58a70b01bd42a678268fa34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\favicon[2].ico

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\activity-stream.discovery_stream.json.tmp

Filesize
140KB

MD5
e988d968566dae7737c669c2e376142d

SHA1
92f2180f8dce2d9aa90164253ed610aa38c913bc

SHA256
35cf7d44f519bac01a5049f95869c6913d3d770284904ffff442aeda7189c6a9

SHA512
9e8c57dc151efb6f6cce4e3a9e85c8cc8157402359ad99f220e697831b1617c371847e86c90b7d273269b1f6b073e0205b1f3f2bc4776abac19f7f2f0870cdb6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052

Filesize
14KB

MD5
0345bb70f8992149ea58a6650341dafa

SHA1
0dfcd51efd22c5dc48bb904fe3fa38f4d6263ddb

SHA256
2ef43095eb3f8595a5ba0f035bca7e2f1371d7bd8603a32c763c49b0f32d1029

SHA512
fa449818a61b97c99a176e1b3cfbee483416169729dacd9e83e70ba67344cba7c28e83d116c3b0810292a8eb88c95c4f26318816ba625f0138686433d4b00942

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
ad9e7e59bbe1c1a8150071075dd77512

SHA1
8e244c6a8b41943ecf8622df15553b8af3006754

SHA256
377f53a198a0930faca614f834aa1cf9dd48a96d468785a4e5b5881cd2189457

SHA512
967100407fa91f1b3653b1a4fa8137de2ea639d3d0097a2d8b677fcd928b2b7bd254a424cd0af1dd77b054363d1e0b505d3e46eb06ef4646255d6729baf0caa2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
c7383f1192d4663a6dfedc7478cac450

SHA1
53ce63b4dbb1ecd349666b3c0bb01b504303072e

SHA256
4d9123673ec2030c4c81640334ee5cd15de01de1dd5c73e003a9c42ceac9bd33

SHA512
3474e308b0870ab33d790328c4d02bf616475739210b4b2039e2287396d04e23861214400aa7f5728cbbebb4fd0115570795c152e6b0f2b8edc424f3224f4c43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
7KB

MD5
aa9cb6d7e04caabde78723979427995b

SHA1
f8260e6e43ed4842d411e0a7b3a7c65b26815f11

SHA256
7c9c0616f9c35f8aa6ce4f5036ada9537661bcc2e8f8eaebf9a3a647e8e7ec01

SHA512
1339b36da52485bed4934dda50091b6a833ffae9e6c0c8f40d83578a2f3c46d917947b2daae746bcf93d7968fe546938254657ed9d81d0f47e42575880f6c2c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
7KB

MD5
c75c207c66a6bbe6557353ef3d61b0a2

SHA1
6c11d7c50904425289fd609b226c5bfce55c45a1

SHA256
2836a3fdd39c63c164dcc392d19a88ced4dc4db5d4e9068aecde731ee9b183d8

SHA512
b5e3d4eae49f997812c5e216d1e085adc707df1469b84ff36545386148614e0b1ad2d712a53ce9aeb160d14ac731dbe97e2d77e7a9e564d03a9b5ba2ee77f554

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
9KB

MD5
69e0cd2e7d9dad4cd2514f9dac5aea75

SHA1
6f3dc5feb92f3451c5eed420efc624ba6c48a3d6

SHA256
595065aefdc2e76eedca65528bae5326087dfc3a35e1d9b187d3ce7b39cf9ccd

SHA512
200298001370333d2c2cbfff2f944e25afd355b852a725441904fbb91674e5e9b72b8ec78704f083471d25138db7ec07eb79f58864244461638c8c967b9ff471

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
07926fb54284122981e741e75d473765

SHA1
63226ac889335b2182fc16e996c15d32a898c166

SHA256
2ed412fd33184640e800749ce2598b57c00ca4df28a8521ccfe5f776f5f0a179

SHA512
134ab3523f5070419f4792318eb9c2bd2d3b49e6cd0048a07054eeccab57bacb969213ec2a2cbc626db0715e42ec90c301bbc8081e0b8e82b23e80b671b1ac5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs.js

Filesize
6KB

MD5
feb8a52858c8167a58f36caa1b37f116

SHA1
7ae7f9d2721ae3c579f9e18e4fea679e8c848158

SHA256
adbc4c7b5e775c3d401ae811d5be5a69b844f5937e3d0a416d374dd5a7ec227a

SHA512
109d42ec5b9744b3561d29a9cabdcf2ffb81233935fa5c2d80c39f27b92ae55366c3c51ae3d26cc1a8936635662acbd11af89e54efac374aceaa279f13e7dc16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
5b08348381ef963d448f00561a7c82be

SHA1
463299b44b64221098bb4e90cceb8ebf07558ecd

SHA256
cc11025c041109dfa7298c02d2294eed8b3e40e5708390eac26a7e36f1992236

SHA512
9718989da45f13cce3ad02a3a7c81e35eefed095c5f7e9ddfc5b149742757a4bb3e2cf0d5f180abec32c95876e0f330f042898783fc786def3789d3903527261

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
517b322cfa9d9df88a6fff1f02988e50

SHA1
cb78941fab5c681f1ebb6391ca9609c50f2b4b1e

SHA256
4b27664c9a0f4eebc03ab9b2d9fed256c64876203f1042ff8f9707aea3dae1d9

SHA512
f52e09cbdcde261552386a34ccf6073785bfa73af98f9f2790a97ed1f2181f832cf4d03412346be3da352c8535b34a32f68c19bd338a07457b14cbcc120629a2

Download Submit