hxxps://we[.]tl/t-VCeNt9Cn60

max time kernel
155s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://we.tl/t-VCeNt9Cn60

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

BluescreenSimulator.exe

pid process

5688 BluescreenSimulator.exe

pid	process
5688	BluescreenSimulator.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{304EB7D2-D0AC-11ED-8227-6E4EC519A222} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings firefox.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\BluescreenSimulator.exe:Zone.Identifier firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\BluescreenSimulator.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

firefox.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1700	firefox.exe
Token: SeDebugPrivilege	1700	firefox.exe
Token: 33	5820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5820	AUDIODG.EXE
Token: SeDebugPrivilege	1700	firefox.exe
Token: SeDebugPrivilege	1700	firefox.exe
Token: SeDebugPrivilege	1700	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exefirefox.exe

pid process

4472 iexplore.exe
1700 firefox.exe
1700 firefox.exe
1700 firefox.exe
1700 firefox.exe
1700 firefox.exe
1700 firefox.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

firefox.exe

pid process

1700 firefox.exe
1700 firefox.exe
1700 firefox.exe
1700 firefox.exe
1700 firefox.exe

pid	process
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exeBluescreenSimulator.exe

pid	process
4472	iexplore.exe
4472	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
1700	firefox.exe
5688	BluescreenSimulator.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exe

description	pid	process	target process
PID 4472 wrote to memory of 2004	4472	iexplore.exe	IEXPLORE.EXE
PID 4472 wrote to memory of 2004	4472	iexplore.exe	IEXPLORE.EXE
PID 4472 wrote to memory of 2004	4472	iexplore.exe	IEXPLORE.EXE
PID 1700 wrote to memory of 4736	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4736	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 4756	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe
PID 1700 wrote to memory of 3584	1700	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://we.tl/t-VCeNt9Cn60
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4472 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.0.1362468726\1491960878" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a13188cc-25d2-4657-9f83-ad10e1025c63} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 1952 1ce92d17758 gpu
2⤵
PID:4736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.1.513006422\1432037529" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50b0cd34-4fb3-4f41-b949-95be2f80a240} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 2332 1ce84e72b58 socket
2⤵
PID:4756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.2.1588238131\1349257327" -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3292 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0871f70a-e86a-463f-bcef-62d1eff27775} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 2904 1ce95b43958 tab
2⤵
PID:3584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.3.225464519\616563664" -childID 2 -isForBrowser -prefsHandle 2320 -prefMapHandle 2472 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f23ea3ea-2de0-4a0d-92ed-393ac8067584} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 1264 1ce84e71f58 tab
2⤵
PID:4828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.4.1230938911\1828591327" -childID 3 -isForBrowser -prefsHandle 4032 -prefMapHandle 4028 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01060894-8967-4876-ad1e-6b9439fbc87b} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 4044 1ce84e62558 tab
2⤵
PID:4732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.5.50485468\2020587264" -childID 4 -isForBrowser -prefsHandle 4424 -prefMapHandle 5056 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bfe93d6-96c1-4cd6-87c5-a6a11a787c99} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 5008 1ce94528b58 tab
2⤵
PID:1188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.7.2003483326\207484521" -childID 6 -isForBrowser -prefsHandle 5028 -prefMapHandle 5024 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2da62efd-6073-473c-abe8-5e8464ad08f8} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 5136 1ce97ef0e58 tab
2⤵
PID:5004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.6.1897137909\433808474" -childID 5 -isForBrowser -prefsHandle 5068 -prefMapHandle 5072 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {804cf6e4-7c1d-4898-9a14-b11705aa2858} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 5032 1ce97ef0258 tab
2⤵
PID:1256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.8.1813747135\174936813" -childID 7 -isForBrowser -prefsHandle 3124 -prefMapHandle 2836 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {988d730a-0949-4540-9fc6-545699f667bc} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 3068 1ce96158c58 tab
2⤵
PID:3268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.9.669219799\1517463067" -parentBuildID 20221007134813 -prefsHandle 5708 -prefMapHandle 5908 -prefsLen 26930 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {015e0ec4-e6b3-469f-b3d7-0a918fd5e71e} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 5956 1ce98dcee58 rdd
2⤵
PID:2376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.10.856406349\1401660036" -childID 8 -isForBrowser -prefsHandle 6148 -prefMapHandle 6084 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c1e68aa-cf77-475a-84d2-736f9c79929c} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 6160 1ce99a20e58 tab
2⤵
PID:4636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.11.1115403389\1477489292" -childID 9 -isForBrowser -prefsHandle 6380 -prefMapHandle 6376 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {012050d6-61ed-491d-b1cf-a9ea91747eb8} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 6392 1ce9a48eb58 tab
2⤵
PID:4488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.12.1286913936\1302071675" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 1676 -prefMapHandle 1672 -prefsLen 27195 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31055300-a419-4460-8972-fa0d739c3be6} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 1636 1ce84e5f558 utility
2⤵
PID:5412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.14.1160836741\1899115890" -childID 11 -isForBrowser -prefsHandle 5864 -prefMapHandle 10200 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a525332-5287-462b-afb0-344b9a5e6b54} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 10084 1ce98e14458 tab
2⤵
PID:6012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.13.779045424\601343702" -childID 10 -isForBrowser -prefsHandle 5376 -prefMapHandle 9484 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8b8d488-56f3-45c5-b8f2-501ab4805fa2} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 10220 1ce96991e58 tab
2⤵
PID:6004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.15.500951007\1393962436" -childID 12 -isForBrowser -prefsHandle 9768 -prefMapHandle 7372 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e5f5e37-fed8-4342-9a0e-64c3c7c9cd6f} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 7420 1ce9a76c858 tab
2⤵
PID:5920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.16.1732695712\906333654" -childID 13 -isForBrowser -prefsHandle 9456 -prefMapHandle 9460 -prefsLen 27195 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {956adff4-5dfe-4966-a528-8b27b9c7de61} 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 9608 1ce84e6ae58 tab
2⤵
PID:2388

C:\Users\Admin\Downloads\BluescreenSimulator.exe
"C:\Users\Admin\Downloads\BluescreenSimulator.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x340
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\activity-stream.discovery_stream.json.tmp
Filesize
152KB

MD5
885c7bf2cd1f16a14fe2fd5c50e71bc4

SHA1
74cbb920d239d21582d2e4c0655b04bddc4f7475

SHA256
4d7b74cc1df53f8ec8a7b431732a1c90d2f5f8346b02a4a09270dfb49dc5a1e4

SHA512
617acb0865a157dc7a3613bed1be1cf02b31807b098a72a41108505faceb2fce014ae0cce1a904f348effe3be80e02ef316b45add8396452554724084a7f5057

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\doomed\5912
Filesize
17KB

MD5
4fbbbc23ec458ebf578dcdea9e5af07a

SHA1
10d198a72637c140c92c24b01f7cc6410ae50175

SHA256
f660b4c7e331638a85f716f7c535c104c1335dc6145b8d07588536ff9de992ff

SHA512
ff9f3baaac731e24162697e1380ad4b56e83c445e6936b319e4bfdc2cf725b9605459dad72f8bb1d17b3ca4e23b9d77ab2705ac280e9e9bf16974bbed57c4f33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
f1f494bc6e5879ae6e046fbce9fa51be

SHA1
b60ae8fa28e25d454f5eee0440b59ffa47059903

SHA256
c47a660ddeac85ac8d46d137b0e85b27c188b1bef0956058f583c5f132c64456

SHA512
f04284c44846c6a0b336fb4175dd5306f11f9f9adc98e61f1656a328643309465d9c66b281399faef8131345a93f008a9fcceb53b2b686f68fdc1a2c8c4bf7be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
62aeccc9979e2c9d8150ad2585c38238

SHA1
f1829a62bcf054a95980e10eddee0f51d91978e2

SHA256
d40ce15d30acf09e1b12b5fa87342051b7ef39d854631e70ea0e89c0c57aa7f3

SHA512
2ff7ac74f33bed1af449046e4c9276fef5ecafd30e701387d011e2da6393c56ff5e1b2303c74fa4fdd051be58411159ad90cf5b8cbdd92b78cb2ae418d2fb1b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
6KB

MD5
7064793e983ef235d793f63a3d64172e

SHA1
371bd2aa241c278594c831bedcff433cbacf4663

SHA256
66c40a0b98cfdc262f3b1151d22d4fe45e2039c0354140d7ac5a37da29b001fd

SHA512
ad06901e6847268733e318d612f5c1a3e1abc6700f764b0cfdbf1fd36788507d30f83bbe0020605d8c779fdd6c22c7bcadeb51337b8228fda895ec5dd5444a35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
7KB

MD5
f44f53362049f86592cdf67cc1e88bae

SHA1
68cae80b222c277f176df9586afbae48802cbc3f

SHA256
7420fb8b0139aa1244c6fa78c08444fdd767b59b74233d7b828d2d740692089a

SHA512
6d3f063af46f9f4963e5a767608fcfb7d26561143287b9e996bc1b50101944ecd9d92dee92f77d602b2233aedf70c76ce8f1ee0ad852e5a72203e7f682c91299

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
7KB

MD5
a0c44670ddc9f77ae7962f291572cf91

SHA1
24e32683e599c4bc1cc614beded682dacc852520

SHA256
c5714ae0c188291f77c838c41df8c02534b2346cf332340fafe92f39ac4082ea

SHA512
4ad5bb2d5422a7f69b8c1e3233b9d5cde7217ab5ab9bff1b7e1b2aff4ab066ffeb651edad9b569e6bf0a37678bf86bfe097c03b7c6122a8b223704190a68ff92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js
Filesize
7KB

MD5
c9da58d6bd68a9fd44bdaeff3c40df01

SHA1
c2373b374e4b27244a35fb4d18c4d22898242327

SHA256
0f651bbf7bf503a011d64e4ecf0f99b87296a4d7bae4cea6c7c4f51ce3ca227f

SHA512
0d442ab7008616877d4194840bd06d004d224fceef63140869df8ab818aefc90dbc225ec28fadbab55d5c7fbf77f81a6229cac2082cf448631124d966fd9cf0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs.js
Filesize
6KB

MD5
fcd5f37e5e4066f7cffe8eb106b6ce19

SHA1
b0a1c4d3d5c96271429fb09cb71055d177c13402

SHA256
38dbdb91f24f8e138803d71d0f7e4758fbb78e7f657208325fe30a501e225c67

SHA512
afdf7697bc784c3c85f30a8a1e4caa32459cf7f19c1ffacde04f62f089218ff1899ffe69fc465677d719546c8f91bea0d04807b13d58096f79aeba8eef0a0a15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
5a8d9ab77cee5be7af308d4770a6f068

SHA1
deb6d5d4abc702c8994db05f1400270d5760f5fd

SHA256
9791788a0d8d5c968dfca99ca6df19740e458a0e7173369e34dbf138f6d97f00

SHA512
96f66e7bce3e5bee6feacb53b8edd62473d975c5dea41ae79f0e87b6b9b96794da4892b5888783b6a933a7a0ea56d92b513a9ac77b2867a1102421c1f5b87f4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
6c77c7f064da95aadb8ab8b53cd61949

SHA1
4a863a42cbd452c79c3fc168d4f7dbab33236881

SHA256
a08b0ab7826f5ca9af3eb9aa9aeb2eb678ee5b26015b90722c7a3926f015f390

SHA512
41f9792ffe78d82747aefdf770aca8a3207eab3fbb86d7f6b01013b91dfe759dc1171a6b40cc6de02c4d59090be4c6eaaaedc9c8ab3c40fadd5abb98f3d8cd3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\storage\default\https+++www.youtube.com\cache\morgue\21\{a7a2568f-09bf-42d5-bea9-1b1974d89515}.final
Filesize
3KB

MD5
a76a1ef08f994fce90414ddc2d8af810

SHA1
fb8df8c5211164679cda0a90d83f39f199537e24

SHA256
2abeb622562208d095adb44c2e2103436dd04f640b62dac3a754046759acb10f

SHA512
13fe5d0c133d0d8f54c2ab67902751893fddea2c203213bb1b0e6c711d758aebbdebe6a4bb814f0a9034f3503cc7310ccd41140b1dae7dcc113c71c837abde14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\storage\default\https+++www.youtube.com\cache\morgue\99\{fc87f6ed-1f97-4964-96f4-1ccad3bc1863}.final
Filesize
64KB

MD5
e1f93f9cc564b5a227aa41b797261cb3

SHA1
98d500996d18d5d63ae3a35a2e81fb78176d691f

SHA256
54cdae72539f281a758826b0d190ad34eaad2829d339e1a2389337d369b1043a

SHA512
ae570fc5a69a7e3bc2f0ec194b3599a07acedf2ed5230581188c7bd7311c7b5a4793b93eaa936e1df3c17d0526efffedf4f5e97098a5cb372c53afa687d04e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal
Filesize
8KB

MD5
1a4bdfda8217d71eebc3dad2d1ccfa5f

SHA1
e637eab1c8c8de9daca8772ace19db4a917964c8

SHA256
2c258596599611800713c6ebc80829b2a71d25adba72960ed35e0012ffd3fb1b

SHA512
a404be90f8aded75fb4f0cb8eaba45de28714583c7a890f00ec06db14a2b573a612ea6723331b644808949d139bf9c62d1f6a4ef2a773ef617e34d677a290ba8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\storage\default\https+++www.youtube.com\idb\949220738PCe7r%sCi7s%t8eandtfE.sqlite
Filesize
48KB

MD5
83b738a9a0a18a3ad42b6cee7c1f08d3

SHA1
f4bee9ec978bff93d15e65b4e38f79a4ac2c3c32

SHA256
902ec2da5c3e3be900875a6a48fecb1044e07f341e556a556e53f5171744f399

SHA512
23ebdf6f36aa4238a1b0ce0794f15ea28e9bfc9ce35d0ef380c67561378f66e596e726ffcf05ecf260533570eafb7a84871470c1fb4dec6342bbf7cb898d388b

Download Submit
C:\Users\Admin\Downloads\BluescreenSimulator.-AuIeShA.exe.part
Filesize
435KB

MD5
c729d1244f267a4a9ee8d565b9d3d973

SHA1
6a2990aef82674312751d68737f19309e0a06504

SHA256
31e1a16d982e4415d8161baf6817038b8dee191c996d5470338026b7f9fcce1f

SHA512
a935bfdf0c46a7e1bb2276731374227c4ff01e1fb9813e458d3b110a50c563fd4ab38628ec81044ab927b34e90f39309b29cac94528358b5662181436ee93146

Download Submit
C:\Users\Admin\Downloads\BluescreenSimulator.exe
Filesize
435KB

MD5
c729d1244f267a4a9ee8d565b9d3d973

SHA1
6a2990aef82674312751d68737f19309e0a06504

SHA256
31e1a16d982e4415d8161baf6817038b8dee191c996d5470338026b7f9fcce1f

SHA512
a935bfdf0c46a7e1bb2276731374227c4ff01e1fb9813e458d3b110a50c563fd4ab38628ec81044ab927b34e90f39309b29cac94528358b5662181436ee93146

Download Submit
C:\Users\Admin\Downloads\BluescreenSimulator.exe
Filesize
435KB

MD5
c729d1244f267a4a9ee8d565b9d3d973

SHA1
6a2990aef82674312751d68737f19309e0a06504

SHA256
31e1a16d982e4415d8161baf6817038b8dee191c996d5470338026b7f9fcce1f

SHA512
a935bfdf0c46a7e1bb2276731374227c4ff01e1fb9813e458d3b110a50c563fd4ab38628ec81044ab927b34e90f39309b29cac94528358b5662181436ee93146

Download Submit
memory/5688-1094-0x0000020F67900000-0x0000020F67972000-memory.dmp

Filesize
456KB

Download
memory/5688-1097-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1101-0x0000020F6A180000-0x0000020F6A1F6000-memory.dmp

Filesize
472KB

Download
memory/5688-1107-0x0000020F6A120000-0x0000020F6A128000-memory.dmp

Filesize
32KB

Download
memory/5688-1113-0x0000020F6D040000-0x0000020F6D078000-memory.dmp

Filesize
224KB

Download
memory/5688-1114-0x0000020F6A170000-0x0000020F6A17E000-memory.dmp

Filesize
56KB

Download
memory/5688-1125-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1126-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1166-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1167-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1178-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1195-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1196-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1255-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download
memory/5688-1256-0x0000020F69F00000-0x0000020F69F10000-memory.dmp

Filesize
64KB

Download