raccoon | 5374d9474834b553f270ec7803560c6618207f67eefb01abc714eea827e44856

Analysis

max time kernel
1545s
max time network
1550s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
01-04-2023 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Latest_Setup1_FullNew_Version.rar
Size

16.1MB
MD5

45389d7df337ce42623655e4b072899b
SHA1

b8434572aa3ec8be8adcce4819465302e3e10086
SHA256

5374d9474834b553f270ec7803560c6618207f67eefb01abc714eea827e44856
SHA512

d13a550d71d1f6624aaa4decdf974c3f64bbc82efd68f7921ebee54b3724a373790d018be64c94934355dbd28725dce296af6462a80e05ebc2ff77c524ae0376
SSDEEP

393216:QaijhO38CogSyvLRP0T1c1DJOD+1EOgeFoqH6z+t:QaWE1ypcTq0Na6t

Score

10^/10

raccoon 13718a923845c0cdab8ce45c585b8d63 stealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

http://45.15.156.143/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Executes dropped EXE 2 IoCs

Processes:

setupFree.exesetupFree.exe

pid process

852 setupFree.exe
2728 setupFree.exe

pid	process
852	setupFree.exe
2728	setupFree.exe

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 6 IoCs

Processes:

mspaint.exemspaint.exeOpenWith.exefirefox.execmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

mspaint.exesetupFree.exemspaint.exesetupFree.exe

pid process

5088 mspaint.exe
5088 mspaint.exe
852 setupFree.exe
852 setupFree.exe
3228 mspaint.exe
3228 mspaint.exe
2728 setupFree.exe
2728 setupFree.exe

pid	process
5088	mspaint.exe
5088	mspaint.exe
852	setupFree.exe
852	setupFree.exe
3228	mspaint.exe
3228	mspaint.exe
2728	setupFree.exe
2728	setupFree.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zG.exe7zG.exesvchost.exefirefox.exe

description	pid	process
Token: SeRestorePrivilege	3268	7zG.exe
Token: 35	3268	7zG.exe
Token: SeSecurityPrivilege	3268	7zG.exe
Token: SeSecurityPrivilege	3268	7zG.exe
Token: SeRestorePrivilege	1068	7zG.exe
Token: 35	1068	7zG.exe
Token: SeSecurityPrivilege	1068	7zG.exe
Token: SeSecurityPrivilege	1068	7zG.exe
Token: SeTcbPrivilege	5028	svchost.exe
Token: SeRestorePrivilege	5028	svchost.exe
Token: SeDebugPrivilege	3536	firefox.exe
Token: SeDebugPrivilege	3536	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

7zG.exe7zG.exefirefox.exe

pid process

3268 7zG.exe
1068 7zG.exe
3536 firefox.exe
3536 firefox.exe
3536 firefox.exe
3536 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3536 firefox.exe
3536 firefox.exe
3536 firefox.exe

pid	process
3268	7zG.exe
1068	7zG.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe

pid	process
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe

Suspicious use of SetWindowsHookEx 37 IoCs

Processes:

OpenWith.exemspaint.exeOpenWith.exemspaint.exeOpenWith.exeOpenWith.exefirefox.exe

pid	process
1932	OpenWith.exe
1932	OpenWith.exe
1932	OpenWith.exe
5088	mspaint.exe
4668	OpenWith.exe
3228	mspaint.exe
3520	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
4960	OpenWith.exe
3536	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

svchost.exeOpenWith.exefirefox.exefirefox.exe

description	pid	process	target process
PID 5028 wrote to memory of 4572	5028	svchost.exe	dashost.exe
PID 5028 wrote to memory of 4572	5028	svchost.exe	dashost.exe
PID 4960 wrote to memory of 4428	4960	OpenWith.exe	firefox.exe
PID 4960 wrote to memory of 4428	4960	OpenWith.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 4428 wrote to memory of 3536	4428	firefox.exe	firefox.exe
PID 3536 wrote to memory of 4064	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 4064	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe
PID 3536 wrote to memory of 3144	3536	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Latest_Setup1_FullNew_Version.rar
1⤵
- Modifies registry class
PID:4920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1008

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\" -spe -an -ai#7zMap10135:116:7zEvent17073
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3268

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\" -spe -an -ai#7zMap4866:184:7zEvent24187
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1068

C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe
"C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:852

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\images.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\images.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\system32\dashost.exe
dashost.exe {d448f385-2f91-4e7c-809540b6d3bdf1e9}
2⤵
PID:4572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\images.png"
2⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\images.png
3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.0.1114438996\872427798" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {328c59ab-3592-48c9-9077-07d98d149077} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 1940 2c79770b858 gpu
4⤵
PID:4064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.1.1947805551\1208561981" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e54507-9dcc-4a61-a7e1-c16423a8e6eb} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 2368 2c789777c58 socket
4⤵
- Checks processor information in registry
PID:3144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.2.1268912440\109957995" -childID 1 -isForBrowser -prefsHandle 3480 -prefMapHandle 3512 -prefsLen 22119 -prefMapSize 232675 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ed26d03-e1f6-46bf-bf0b-94a9949689c3} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 3416 2c79bbcdb58 tab
4⤵
PID:392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.3.768412152\1431981533" -childID 2 -isForBrowser -prefsHandle 3900 -prefMapHandle 3912 -prefsLen 26784 -prefMapSize 232675 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59477aac-93f7-462a-bd00-d2b96b4d468c} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 3932 2c79f736558 tab
4⤵
PID:4528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.4.165675694\431512147" -childID 3 -isForBrowser -prefsHandle 4692 -prefMapHandle 4060 -prefsLen 27099 -prefMapSize 232675 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b53aa846-2ac0-4908-8be2-89590eabd94f} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 4084 2c7a43c8b58 tab
4⤵
PID:4948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.6.1380001641\1996306977" -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 27099 -prefMapSize 232675 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fcdd0ab-faf2-47ec-b7b6-01b4985a3715} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 5264 2c7a43cac58 tab
4⤵
PID:3580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3536.5.1428469168\751004456" -childID 4 -isForBrowser -prefsHandle 5088 -prefMapHandle 5096 -prefsLen 27099 -prefMapSize 232675 -jsInitHandle 1500 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9736d59d-35c6-4419-b969-f3ef7727972c} 3536 "\\.\pipe\gecko-crash-server-pipe.3536" 4084 2c7a43c9a58 tab
4⤵
PID:1956

C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe
"C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp
Filesize
151KB

MD5
891db947045c91f2037b93ebe5476083

SHA1
efdd00cdb6d41a0f5b807acb23576c17de25836a

SHA256
f4a52bbb7798271e0ab1114e444d5d29d71e2c75f990c3a46e02e9fd288185ae

SHA512
adeae64da0f7ce24100c20401fcb12aa890ef180837ce1ef6879f850424e36090a99e55189eff1adffef2c7d1a00b10f53217107867b7e76504d19c5ac6c1617

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
a51b5d7602f604c2028f89b73da621dd

SHA1
06bc6307d08631eefbd38f38c18affc54333459b

SHA256
08cc7e11b879688629bb1ea5cb49d501bf214ecbc43cb79ef9b0bd1e713b5253

SHA512
1ab9ab7c9407f2651e0b9f81ac80b5ff9b09ba011abf5c3c1a0524876e10c342707f071c1c9d6c4042e1f4eba3a4196d14f89012631a617c1eb17b2d515253ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
3db1285b06d9eec00389619b8f666a28

SHA1
21293c8ab974b8f113335f80cd5d7a5a2f292a34

SHA256
3c90c4c0040617bfc974264ce2fd093fd1efdbce986731a766797e21292ad16f

SHA512
50ec9aa921b3e2d4a39977f19cf49e885f94892747ae8dc0ea4fe03700e2f8134a003d29bc0deef2dab3270c0c13cc037b1760ba7d121c6206be0db40daadb4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
8047ff40473204637bf7211621d72eb9

SHA1
072ce708c4445720d07cf87f96424a5aafe5a219

SHA256
8e81c6d88465eab6ef04158ba088771f5a68a81cd62dbfe7b07ef3516d6a5a39

SHA512
76bf42a3c6faec16aad7010b064202d8bf41703cb4c12ba32b736c73eff19641e62e489b898bb858bfb48389351343c82b7a0bc3590ae48c0c8e7754cb82a394

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
4c385ba2a7ae08913357ff7b9cf57a85

SHA1
75ab9eba30e08671d11eb71cb1878f012504b022

SHA256
e5d779074d2401c681fb9b67bc485bacf32d2716239a2e053bce51d09d21bf94

SHA512
f68683ad7fd841428f901b8e427b45464a1bc83335bd32da7d18bf07f7b56695d3857ce0fa501f2bce20cb7c05253004a92c93e55df7484c2b0adcb2658ddccd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js
Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionCheckpoints.json.tmp
Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
596779788bd92d1a6783dd5641a58a63

SHA1
d65eae77967df552c97d92c43106f6aaffb6029c

SHA256
6e7107470459a2990bd0f5030316c522493289529eaf33d6864a4cf7e567adc2

SHA512
6d2172466e4b3e49345c1269abbdb4b2aa7b50f4aa9b5aff4efb0bb43c0e437a2c13f968896686033430e267e5d6c4ec82529d387e2f5f58a7952411757cae01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore.jsonlz4
Filesize
1019B

MD5
5df61d0485c779da6ac1d526ca0c41ff

SHA1
818659e6824acfa5b88fd6746970e6a2a88231ab

SHA256
e3db31f293e5354a51fa5f6a973c09756d0f0e443877640622990e561222da77

SHA512
6c5432814d19681bba48c9fee89a53b487e3d73f831bfe98b8234d67dd8110ac9e4b4724b4300fbbcaf1eaf755161c27adccc15ae13eb48deb3075792a4c10f3

Download Submit
C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey.rar
Filesize
16.1MB

MD5
c0d6df9c2a087ccca431af1c4e3dc5f6

SHA1
6eb55ff3f35810881d336caf08b7cfdd2c90b5ba

SHA256
a3cbe825d36a0dc14e825447e4e16d2d9ef19655c73bfcd729c427642965b7a3

SHA512
adeaec2109f5f26c8705807c032f1710e1f89015a2b1d621b108422ea375e6e7a90276b5b574ad81a91f48fc5ebd023c8b4af2c50326a9891d69788f73c9c6f8

Download Submit
C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\images.png
Filesize
407KB

MD5
31a28a211a08877c876533673e7fb04a

SHA1
3c4255ed0da89390d240bcbfabe77ddb65866c77

SHA256
40ade7b43b94455bdb229a65bc50df91e2e293e6f213900729957ff7b0af48e8

SHA512
d041c79bef114b2bf47ec16706e1b7ddaadd4f2b3981d0c5180c0ed0433fd35982cb1b3081f49578881ce8e81f09846e27a6cc4de48f2ee9db543f0c8616de8e

Download Submit
C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe
Filesize
2012.6MB

MD5
926c3b2ce43dd3e759de21f6eadd1e91

SHA1
828d0003d77be2aa4aaa3e1ddafc4e0b93b22ecd

SHA256
d1022a79b908ac527be90b5319b2c18fc82aaecec0eba50813a8a1de46c1cb98

SHA512
120a2ed09ca2bcb002f8cca67de27690d06e7ed5a14b5de5920f042bb3f629df84c1df68e1d155c2a39b0695d471c957ee44e0ac2babfe8148e50d7714d0c801

Download Submit
C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe
Filesize
2012.6MB

MD5
926c3b2ce43dd3e759de21f6eadd1e91

SHA1
828d0003d77be2aa4aaa3e1ddafc4e0b93b22ecd

SHA256
d1022a79b908ac527be90b5319b2c18fc82aaecec0eba50813a8a1de46c1cb98

SHA512
120a2ed09ca2bcb002f8cca67de27690d06e7ed5a14b5de5920f042bb3f629df84c1df68e1d155c2a39b0695d471c957ee44e0ac2babfe8148e50d7714d0c801

Download Submit
C:\Users\Admin\Desktop\Latest_Setup1_FullNew_Version\Latests_Setup1_2023_UseAs_PaSsKey\setupFree.exe
Filesize
2012.6MB

MD5
926c3b2ce43dd3e759de21f6eadd1e91

SHA1
828d0003d77be2aa4aaa3e1ddafc4e0b93b22ecd

SHA256
d1022a79b908ac527be90b5319b2c18fc82aaecec0eba50813a8a1de46c1cb98

SHA512
120a2ed09ca2bcb002f8cca67de27690d06e7ed5a14b5de5920f042bb3f629df84c1df68e1d155c2a39b0695d471c957ee44e0ac2babfe8148e50d7714d0c801

Download Submit
memory/852-213-0x0000000000400000-0x0000000001A77000-memory.dmp

Filesize
22.5MB

Download
memory/852-212-0x0000000001B60000-0x0000000001B61000-memory.dmp

Filesize
4KB

Download
memory/2728-634-0x0000000001B90000-0x0000000001B91000-memory.dmp

Filesize
4KB

Download
memory/2728-635-0x0000000000400000-0x0000000001A77000-memory.dmp

Filesize
22.5MB

Download
memory/3228-230-0x000001A610CC0000-0x000001A611417000-memory.dmp

Filesize
7.3MB

Download
memory/3228-231-0x000001A610CC0000-0x000001A611417000-memory.dmp

Filesize
7.3MB

Download
memory/4136-215-0x000002378F290000-0x000002378F291000-memory.dmp

Filesize
4KB

Download
memory/4136-211-0x000002378F290000-0x000002378F291000-memory.dmp

Filesize
4KB

Download
memory/4136-198-0x0000023786580000-0x0000023786590000-memory.dmp

Filesize
64KB

Download
memory/4136-202-0x0000023787120000-0x0000023787130000-memory.dmp

Filesize
64KB

Download
memory/4136-209-0x000002378F210000-0x000002378F211000-memory.dmp

Filesize
4KB

Download
memory/4136-216-0x000002378F320000-0x000002378F321000-memory.dmp

Filesize
4KB

Download
memory/4136-220-0x000002378F330000-0x000002378F331000-memory.dmp

Filesize
4KB

Download
memory/4136-219-0x000002378F330000-0x000002378F331000-memory.dmp

Filesize
4KB

Download
memory/4136-218-0x000002378F330000-0x000002378F331000-memory.dmp

Filesize
4KB

Download
memory/4668-229-0x00000120C01A0000-0x00000120C08F7000-memory.dmp

Filesize
7.3MB

Download
memory/4668-225-0x00000120C01A0000-0x00000120C08F7000-memory.dmp

Filesize
7.3MB

Download
memory/5088-223-0x00000192B96E0000-0x00000192B9E37000-memory.dmp

Filesize
7.3MB

Download
memory/5088-224-0x00000192B96E0000-0x00000192B9E37000-memory.dmp

Filesize
7.3MB

Download
memory/5088-226-0x00000192B96E0000-0x00000192B9E37000-memory.dmp

Filesize
7.3MB

Download