65f5d46ed07c5b5d44f1b96088226e1473f4a6341f7510495fe108fef2a74575

Resubmissions

31/03/2023, 21:28

230331-1bbgvaeh41 1

31/03/2023, 21:26

230331-1apm3sde99 1

31/03/2023, 21:21

230331-z7r9sseh2z 8

Analysis

max time kernel
214s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xyeta.zip
Size

75KB
MD5

213743564d240175e53f5c1feb800820
SHA1

5a64c9771d2e0a8faf569f1d0fb1a43d289e157c
SHA256

65f5d46ed07c5b5d44f1b96088226e1473f4a6341f7510495fe108fef2a74575
SHA512

8e6b1822b93df21dd87bf850cf97e1906a4416a20fc91039dd41fd96d97e3e61cefcd98eeef325adbd722d375c257a68f13c4fbcc511057922a37c688cb39d75
SSDEEP

1536:0Nm7bj9DAfxcbnnOOPjaW7S3ayJpOGtz57MC4Wlzy1vG1NyY/:qAbj9EerOOPjV23ayeGpM+18c

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5968	5304	WerFault.exe	115
6128	5456	WerFault.exe	123

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5392	taskkill.exe
2760	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Evascape.zip:Zone.Identifier	firefox.exe

Suspicious behavior: LoadsDriver 18 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: 33	4548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4548	AUDIODG.EXE
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	632	firefox.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe
632	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 772 wrote to memory of 632	772	firefox.exe	97
PID 632 wrote to memory of 3076	632	firefox.exe	98
PID 632 wrote to memory of 3076	632	firefox.exe	98
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4196	632	firefox.exe	99
PID 632 wrote to memory of 4596	632	firefox.exe	100
PID 632 wrote to memory of 4596	632	firefox.exe	100
PID 632 wrote to memory of 4596	632	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Xyeta.zip
1⤵
PID:3920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.0.1230924702\423720352" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89588054-c85b-4345-a209-727529b9ac94} 632 "\\.\pipe\gecko-crash-server-pipe.632" 1932 15fa4d16258 gpu
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.1.1881120306\931429932" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {945446c2-6163-485e-a541-23cf624222ce} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2316 15f96d71958 socket
    3⤵
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.2.932631076\1947940073" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3112 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1626d017-a09a-4359-93f0-baa478894c20} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2964 15fa79fd358 tab
    3⤵
    PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.3.1612161707\395233509" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3488 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59c8f4cd-323b-45a5-9f52-7873fc5dd920} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2476 15f96d71058 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.4.1928125240\1889088244" -childID 3 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27a507b-454b-448f-ab12-0e3c55239c0c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 3792 15f96d5c758 tab
    3⤵
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.5.933089560\2047448431" -childID 4 -isForBrowser -prefsHandle 5048 -prefMapHandle 5064 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fc82fb6-ee64-4a0f-8f9d-1c08df8a261d} 632 "\\.\pipe\gecko-crash-server-pipe.632" 4968 15f96d2f358 tab
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.6.379617065\1021102550" -childID 5 -isForBrowser -prefsHandle 5264 -prefMapHandle 5268 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {caa4c6a8-083c-47b2-b4cf-9958b8cbad59} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5256 15faa27db58 tab
    3⤵
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.7.1472430016\232578074" -childID 6 -isForBrowser -prefsHandle 5552 -prefMapHandle 5480 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8d01d65-e293-455c-9378-5a878448ce63} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5560 15faa2c6858 tab
    3⤵
    PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.8.165319484\58696017" -childID 7 -isForBrowser -prefsHandle 4536 -prefMapHandle 4548 -prefsLen 27020 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc05bc42-043c-418f-9d58-e91546de8b66} 632 "\\.\pipe\gecko-crash-server-pipe.632" 2980 15fa9d05958 tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.10.396995747\1592170250" -childID 9 -isForBrowser -prefsHandle 5232 -prefMapHandle 5144 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {907810e5-a9a2-407e-93d8-ae88f2eebc06} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5224 15fac088758 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.9.1290062522\1028856495" -childID 8 -isForBrowser -prefsHandle 3672 -prefMapHandle 3556 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dccf7c9-f05a-47f1-844a-ea64fcc7ad00} 632 "\\.\pipe\gecko-crash-server-pipe.632" 1448 15fac088458 tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.11.543922409\753114403" -parentBuildID 20221007134813 -prefsHandle 3528 -prefMapHandle 5192 -prefsLen 27331 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87a7c418-898f-4118-83fd-846d5315393b} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5528 15fa4175858 rdd
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.12.207881263\1476398416" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6172 -prefMapHandle 1400 -prefsLen 27331 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f120425f-517e-4b6c-a637-bda37bdd44e3} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6180 15f96d69658 utility
    3⤵
    PID:2528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.13.342968556\1449358215" -childID 10 -isForBrowser -prefsHandle 6376 -prefMapHandle 6372 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dfad9c2-ef18-43f8-84a6-25e32277828c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6500 15faaba1b58 tab
    3⤵
    PID:2476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.14.1172993727\399107823" -childID 11 -isForBrowser -prefsHandle 4156 -prefMapHandle 5804 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe0a1e52-099c-4f99-a81e-3e58f5cec049} 632 "\\.\pipe\gecko-crash-server-pipe.632" 7020 15f96d63258 tab
    3⤵
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.15.1907696601\1506304467" -childID 12 -isForBrowser -prefsHandle 5996 -prefMapHandle 6000 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a865fc-2602-4867-a911-d614350ee392} 632 "\\.\pipe\gecko-crash-server-pipe.632" 10848 15fa6622358 tab
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.16.562297667\75643884" -childID 13 -isForBrowser -prefsHandle 5432 -prefMapHandle 10848 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31220e4a-6e9b-4784-8d06-7194d1588841} 632 "\\.\pipe\gecko-crash-server-pipe.632" 5608 15fac84f258 tab
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.17.695308568\1123605093" -childID 14 -isForBrowser -prefsHandle 6608 -prefMapHandle 6604 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff7eb2f1-3179-474a-9733-098dfb07415c} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6596 15faac57258 tab
    3⤵
    PID:968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="632.18.1244773741\1665757512" -childID 15 -isForBrowser -prefsHandle 5180 -prefMapHandle 7032 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3e4bb85-8e2b-433a-8dd2-a97318609553} 632 "\\.\pipe\gecko-crash-server-pipe.632" 6904 15fa63af558 tab
    3⤵
    PID:764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 5304 -ip 5304
1⤵
PID:5900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5304 -s 2868
1⤵
- Program crash
PID:5968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 5456 -ip 5456
1⤵
PID:6120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5456 -s 2916
1⤵
- Program crash
PID:6128

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c0 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1608

C:\Users\Admin\AppData\Local\Temp\Temp1_Evascape.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Evascape.zip\[email protected]"
1⤵
PID:2460
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp

Filesize
153KB

MD5
8538216de3c61435c5972fc2027b1835

SHA1
eeeb0fa5b9ba931af073ebd721af989013a6b72d

SHA256
256bc194e12ff00f7d41ebdeaab3bbd7bb0b76c7c17f457f3c45ce8a6dd39910

SHA512
c1f7f15247c920bdf1765195039caecff5cfc74bfa30e7a6068ffd1a092edaed6f7c16db386f06fe6bb314cb9b2e19c2254398b08e8c1c4a41cf1285bdc8f1ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\11699

Filesize
27KB

MD5
ec3f56f1d91bd3eaf48f8193cc4b8c00

SHA1
1b356ceb84a0548bd744b86b969abeca85373ed6

SHA256
f048202a45a75187980d1c04534b95d7965268b737fd7c0ba454063f72c08789

SHA512
61937b6cb9b2c53df582eb365844e74f7312eb346490f6b7c42a4ec1b674e32d537bf81d6baf367cc19fe4a07b4c410a39ec5535f851fedb76921fe7fbce0d24

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\17896

Filesize
12KB

MD5
ffc9344d2382274f4a9b71377edfe68d

SHA1
26cef203d32e9b74e07397acb5365c991ea8ecad

SHA256
ef7b588d6021ae728d50d560606168e433be4e80a7d7b310044756f2cdb3ff7f

SHA512
8b695e62bcd545e8da2f9261a2a3df7dc23cbfa9f45e24af1480c565f141e42561d6f4218092b6748b49ef557563ac4a311790290923bf8237bcc860976a91d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
5a5725daf41b2cb379f43c5e17604f6b

SHA1
8e5dd70c9396246f6a9c327d01e9e90f3bb6c516

SHA256
39b9805966c3403ec01754b3476559d2ff470d54b88a0cff22c9d26d8e9a9b0a

SHA512
29655d01070032dbb5bf4c1f5c0bd22570a520f49d51e1c88fb4f3d9f16c52688fec812010eec66622c459b9f179add0b2fa968ab8bd0256250ebf42aee62508

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
527a00adf07162f86810190ac999a93e

SHA1
aec3af29bf3c6cc1087a1ce6743187694c820503

SHA256
70bf75e24a0ba739d6d34c6a4536fe7693fa58f72e2cf8ad9aa6aea9fe474965

SHA512
ba6acef18835c68c3a263840dd7ea9fbd6c8e2e7f2574749e6ba7e1810512629c6f67e1bd37949ace4e040424e282b8964f2d63ab262d5e259fc654192c56d5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
ec40e1103f3c2cf6c0ded8147efd36d9

SHA1
3d1c333495beea4552fbc2cae5c88ab0f3de3a95

SHA256
abbb2b572fd65175ecfe2de74b87a08b0f4c428281bcb2c9b7f1b810f9708b6f

SHA512
0d4b1a67d9df126ab815bae7aac944513dbe57d966e4e3eb0d8b751175e0605c6167cd0dd330b408616931e065fbdce70db54002b6353b58c224d0fd3bc996eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
788a033f647159a8634c4a44298c99d0

SHA1
12cf55f3226157329cf05d31813a103edabd8d89

SHA256
cbad0e48092ec604938b20b55162bad7d885682110fc71be48d619f467ccd0fc

SHA512
485d0728cfb043a6898ba51069a95f725f7f2830e3a9cdd3d20c541e5efb4546f17e6f782f3391949397bd9effdd41959b1f0ccf8356aff593d83b4a613c1ae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
e422fa2e1675a2f22b06172fdb1871d1

SHA1
86ef61541a845f86e022d54053fb573d1c2e9477

SHA256
7214e49cd59a63190679bdca3d573e2aa4438977cc194ba113dd58a974a411fd

SHA512
86abb731f0ab4a8d660afb963fef19e86e1d019d4d3de48adb92976dddfe64d5828291eeeb4e16b1a05d9d100c90ac77ae85557308c61c79882fe64bbb1ee3d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
52d4c0e962ccfb8f5ed081389b1fcc7a

SHA1
bd4c51b8c52c017d9dd3859ada3893ce8fd93de3

SHA256
63ef85a1c677b2f1c94260c8ddce88d09e2aaf67a56fcae233cf8db5a3a5bb5b

SHA512
1b52f7ecb28e6f3d0fe8ab264e9f2c93c1dfbea3e6eaad43c2dffcd668ac9bc3c71c7b88f63dd323ff2df76eb4caf374714271bf02510657dad8962b735204ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js

Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
ca797951212c81d96c7fc1e9738a2c74

SHA1
8a2d0386cad119b3738beec8e5375cb93925c094

SHA256
6979c59c60707b8812ba3b35bc330dfd348fbe59eaa3042483b8e0ad0545b5d9

SHA512
5b786306fbe4cebad87c22e5f97edaaed4fc6ae05a250e8aa3da2bdc85000bdf85ad35c7ad332e1e292b581477a2bf2e6e2c6f4c4ce4d54cf8f49c614b098ce3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a52555bb20d2f199bb418cfb6100ea77

SHA1
eae4cecc01c9dfbe3f10a443d4c8eb72b682d250

SHA256
3a741912225726696fdf6d333315886fdfd779ee66bccb329b759778d88d823e

SHA512
45e25b99222f515d8b34d31efbb3fcf2b06c7288081b97a59558f8cc32cff2c6130859f47c5f1dc6b1aea4f6a80c65dbb5db2a41316a2d081f2ff536106ed41f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\cache\morgue\197\{22bb8008-2b66-4b47-b968-c8ed1cbfd6c5}.final

Filesize
3KB

MD5
da26b59e9976bc71452710721ea46f0f

SHA1
5abc9a34e55d5b41b03ba983ac34fa1818bcca5c

SHA256
faddea5193102d5073bfcfc831a36362354f0fb9dc47db7c4d82fbe3b3809baa

SHA512
144c7a315b59615ce9785b9b98d8ff949b9506943e0f271d44cd3e2cccd6e3a53b9df3c95747034fce2d8cb1bbb0479147c23d0991273b91cc3fe3aaecc20bc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\idb\2900098231yCt7-%iCt7-%r8ebs7p2o.sqlite

Filesize
48KB

MD5
baff760bbe2427f32fc71cf13e72d0e2

SHA1
deade45701ffebfab84b55d028f5cf920f642d17

SHA256
6d033b9ebb4d4959355988814768f49992feafdacc294e92b44dcc3b5dc66a5d

SHA512
c9a605b6ea2a23093fcbc5e571a523d6c07894c9a6e219f7d135b94c5cb24d4443cc160a6cffe8b0afecf8bd15f54df42821918215e33d38f24c33c804405cf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
8KB

MD5
dabcaa07e55f0a83332163625f044192

SHA1
47eda24673f43b54bdf56e65a5bb37fa9158aa74

SHA256
5361d6488e34efba173826bd87cc418f5f1453344e376644efbea43a68cff527

SHA512
bbb7e9e4423878b39078e337d938fac81dc8e05879827b88464f8149f39c176278cc29702e7ecbff5692961445f7df5af5f718d4766f17b00aa894c594672e61

Download Submit
C:\Users\Admin\Downloads\Evascape.aPEIm18X.zip.part

Filesize
100KB

MD5
85777554219739d04c4d99d8dbbad385

SHA1
fc3c85d18876b421e29609b637ec221d22a16deb

SHA256
727c05868071a907251b99b58090d2e360b270fcf21e7c319304c9ef47ad2ca2

SHA512
7a2017ca1d8cc13a8c8151323126c73e1d4d5263c7f84a72a67a77044767801dba2474a84e6cd9837dfa01989eaca87a52ef8f0d55e97b9bbdbc24973484a712

Download Submit
memory/2460-2286-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2460-2354-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download