hxxps://futurershnhe[.]xyz/x?u=8988256668536257913&is=1679963663&lv=35&rv=0&did=NjI0NDcOCwwMBQMEAgIPAwECBgIBCwUHSw8EBQIGAk4FAgAPCwIHAQAASGtUREo%3D

Analysis

max time kernel
81s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://futurershnhe.xyz/x?u=8988256668536257913&is=1679963663&lv=35&rv=0&did=NjI0NDcOCwwMBQMEAgIPAwECBgIBCwUHSw8EBQIGAk4FAgAPCwIHAQAASGtUREo%3D

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3939936447"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908f80ec9561d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31023509"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023509"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f88fec9561d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386787393"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000eeaf0b09f6eb9b6f7902ff5e84802d49e3696b0a514bb335c4de7a4a535f9f7b000000000e8000000002000020000000752f760fe517aa4c48207e8b4d3b6b05da04f508a87d0f805ebc1d131e5711e220000000e82a7104e8f7536e84171b85cbda9a19ff274c6dbdf5b9b99737a38ad99cf64c40000000497d4b953eea391cee2f490aa9ecc0b3c9a8cc06bd4cb6f3ba2c754a1d10cae41bf615ce85d1c06720b48915b79fd64e1136d815f7d5d184a544249abb00fcc8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3939936447"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023509"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3952844849"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{15BB556E-CD89-11ED-9F77-C2E0088FA829} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c000000000200000000001066000000010000200000003024f54ef5827d8625657acf49946e3cb768bd594529ae8cf5e8d9edbbc96850000000000e800000000200002000000034fd13bcc7670ca619a9168d445465a1fde64611ab9e344de29c8eec855bf19420000000d7ddc7e088f13d2e01b46114eb7deacd9de2097a0b20aadc2ea93cdd99e9434a40000000c3d3423980c43f4179ffa9985981defcaf7fef740e60d2c8e7e48badc5d35a672197f97a9f26b60235b4a35761e522608a777bdc27c58519a61983db855faa57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	firefox.exe
Token: SeDebugPrivilege	4872	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1008	iexplore.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1008	iexplore.exe
1008	iexplore.exe
5116	IEXPLORE.EXE
5116	IEXPLORE.EXE
5116	IEXPLORE.EXE
5116	IEXPLORE.EXE
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe
4872	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 5116	1008	iexplore.exe	83
PID 1008 wrote to memory of 5116	1008	iexplore.exe	83
PID 1008 wrote to memory of 5116	1008	iexplore.exe	83
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4064 wrote to memory of 4872	4064	firefox.exe	93
PID 4872 wrote to memory of 4436	4872	firefox.exe	94
PID 4872 wrote to memory of 4436	4872	firefox.exe	94
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96
PID 4872 wrote to memory of 1704	4872	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://futurershnhe.xyz/x?u=8988256668536257913&is=1679963663&lv=35&rv=0&did=NjI0NDcOCwwMBQMEAgIPAwECBgIBCwUHSw8EBQIGAk4FAgAPCwIHAQAASGtUREo%3D
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.0.802490617\1657162185" -parentBuildID 20221007134813 -prefsHandle 1860 -prefMapHandle 1804 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f2d1b8-7501-4b8b-bfe4-bf3c84ab959c} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 1936 174feffc058 gpu
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.1.861511083\218114294" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2aa4808-8c1a-4462-b98d-510500d96d74} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2332 1748303ec58 socket
    3⤵
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.2.1858374909\660938744" -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8417c169-7c48-472d-b06f-f2c88d17c0c3} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 3240 174858e4c58 tab
    3⤵
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.3.1701713043\1119761157" -childID 2 -isForBrowser -prefsHandle 2468 -prefMapHandle 1460 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed19169b-184f-40a1-95f7-a9af6a7e2913} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 3568 174842f3258 tab
    3⤵
    PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.4.1544947108\1487018485" -childID 3 -isForBrowser -prefsHandle 4144 -prefMapHandle 4140 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b0cab91-eb26-409b-ba1f-b671df4f1a6b} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4156 174842a9558 tab
    3⤵
    PID:4428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.6.1969365433\1522340893" -childID 5 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70b514a0-8508-4ed7-8716-e50d1fa984b4} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5124 174f4930e58 tab
    3⤵
    PID:4312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.7.2071139216\1447393184" -childID 6 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a892b90d-b2ef-4bff-a396-4d6772151aeb} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5324 17488ccb258 tab
    3⤵
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.5.26776772\1221865233" -childID 4 -isForBrowser -prefsHandle 4972 -prefMapHandle 5040 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3158e142-abc7-4f40-91ea-aa186e501853} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4960 17488476258 tab
    3⤵
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.8.1732470998\447280809" -childID 7 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c11aeae-e068-48bd-b844-621d10d4be3c} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5704 17489b74d58 tab
    3⤵
    PID:724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
ec1a8bd1feddd633ab052e24541f94b5

SHA1
c7244380a737ba75df1093e7e5e8f7bc7d2ce59b

SHA256
422bcf49599facbf36bab286344c1b4e0e007665342b55d3c4eaec05e3cc2653

SHA512
86f9db12f706ace002fdd9936ec76e67f5d8660953fccf00d13072e49ac99047a1b7c93a53ea8fb9862ef74128e2fe988ef3b0511a510e942f35351ac313bc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
26bbe222827741c57d4daea5307263ca

SHA1
7e4f58c1ebcfbfb15042e95ea92ed2497e850faf

SHA256
b9c9b648a163e8af64a9e08a03a5895fd790fecf96222c5ee36e8d21f30f8d0f

SHA512
924014fb07186e4aa9c0e07d4e5d8ba64b6d2266b25d6aa1e62720e019e40a83688bd3a742751e394f97cb2c7d43dc43abb950a6b4ed7effb03009082cbfb877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
142KB

MD5
5e052c7d831cfea500692a9af6059d36

SHA1
2d0b50554cf632d7623ccf87d1a4fa5d53f35249

SHA256
dfa0ed72b8500d7c9a197b7fb4aa0b7b57cda2b2aeb0bedf6757a213cbb1f51f

SHA512
8db9ab20f5e68abebd4a61e15a024e7a805b5154a222c36628a1514dd3545da4907aa96641d6f007299a589b2854410dbd73200cae749d46aab70169c3decfaa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
5651f245098bcd20ca45df9f163e0957

SHA1
b57512c162ac9f1fcdd7c66b8d56e5092a54af7f

SHA256
0e8fc0e860d32784b04b1770bca484f11939eb7daa448e4f9d93e962756b54af

SHA512
9d92c709c94980e05924e609698af1e202aad0c0d18144b5938afaa62181c6ab792d3b66147d8c50e3e79d99e165060efdb5c98030a460eac2ae726c5607ffdf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
973ad6f8589c0fc9a808cb076ebff459

SHA1
282c002dcd8ec898fe1d5f09f9d53ba550e2c8d5

SHA256
2718b1bbf155718425202fbd6dc25cb8b5263c2756b6f8b0313eb2e00adbf51c

SHA512
d723322d0bf605833d88b3ae50cef1019ff2abb9f0d4ec87162f6a18b73e7f6ad60da537fc786f2d2d0a9026f21eb5e4a971a1071c3874c96da1b3c3ff4c5e30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
a8813df84e891a16be878b539f7d837b

SHA1
d971ba802835d884038a3e910c4e70269a19ed4c

SHA256
7c78de1846e9cd0f223b7373518111d11eb3970de33937de78f673311cf54821

SHA512
cbec2341666daedfd6b6e84a66c16a43ba4151eb78c6b67b7fb6ff626f282c1602a13418258a5369b8fa5f80d20cb6d06032a4e09cf42844d3569f6b52408952

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
79b58060c20873cda1edd0d302d9f149

SHA1
c4bafdd81aaadcb01fc42372d7ffc575836785c8

SHA256
34c479b13d22c1ab716b83f4387912e3541d8cc35e1cf9481a89ada37632596d

SHA512
98647b72c6d7118ed4cbea05340445dfad098b9fb7127b6cc8a8f52f1c34679a8a3135973bf5ba7e17ccd46535191906382bf8ffe6b4743336d0ffe424e12d0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
10a3598a6d633afd29cf3d1d5c71cfb6

SHA1
1e30810af642f4cd56e90826c19a6a02fc7e26d8

SHA256
f8c5a4b5f4819d087ca93f73de2f85db6f15d972a75d64777bd7e2fc823b25c9

SHA512
fec16e3ec70f567ee2defaee34a601eb57499bb8878b64f23ffc54cfe62f156228ddc71a7bb4b8c51b38fe65c9143b540feadb737bd82077604288b5051f7872

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b96aca2cdc51e7b84bfe99c3374b01e8

SHA1
2eacdf0b0340500313153f60c0d506af9d4f6060

SHA256
dc5f4ced62daa6c91fdff7ae06cfbafddbc4b4dd53d4d7885136510153e1256f

SHA512
e03616dbe12de4b3249f00d949c0d0b18385f9f361b0169745ddf9f6daecef0817e769afd290a7eb7ba21a31d6461af173de8a400e4f0c67f63513549a6b173d

Download Submit