hxxps://newskit[.]social/watch?v=mcdonaldsowner

Analysis

max time kernel
476s
max time network
1327s
platform
windows7_x64
resource
win7-20230220-de
resource tags

arch:x64arch:x86image:win7-20230220-delocale:de-deos:windows7-x64systemwindows
submitted
22-04-2023 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://newskit.social/watch?v=mcdonaldsowner

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 35 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 640065002d004400450000000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1031"	winlogon.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	firefox.exe
Token: SeDebugPrivilege	1968	firefox.exe
Token: 33	2788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2788	AUDIODG.EXE
Token: 33	2788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2788	AUDIODG.EXE
Token: SeShutdownPrivilege	2076	LogonUI.exe
Token: SeShutdownPrivilege	2076	LogonUI.exe
Token: SeSecurityPrivilege	1300	winlogon.exe
Token: SeBackupPrivilege	1300	winlogon.exe
Token: SeSecurityPrivilege	1300	winlogon.exe
Token: SeTcbPrivilege	1300	winlogon.exe
Token: SeSecurityPrivilege	1300	winlogon.exe
Token: SeBackupPrivilege	1300	winlogon.exe
Token: SeSecurityPrivilege	1300	winlogon.exe
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2992	Explorer.EXE
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1968	firefox.exe
1968	firefox.exe
1968	firefox.exe
1968	firefox.exe
1968	firefox.exe
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1968	firefox.exe
1968	firefox.exe
1968	firefox.exe
1968	firefox.exe
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE
2992	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1220 wrote to memory of 1968	1220	firefox.exe	28
PID 1968 wrote to memory of 856	1968	firefox.exe	29
PID 1968 wrote to memory of 856	1968	firefox.exe	29
PID 1968 wrote to memory of 856	1968	firefox.exe	29
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1448	1968	firefox.exe	30
PID 1968 wrote to memory of 1724	1968	firefox.exe	31
PID 1968 wrote to memory of 1724	1968	firefox.exe	31
PID 1968 wrote to memory of 1724	1968	firefox.exe	31
PID 1968 wrote to memory of 1724	1968	firefox.exe	31
PID 1968 wrote to memory of 1724	1968	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://newskit.social/watch?v=mcdonaldsowner
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://newskit.social/watch?v=mcdonaldsowner
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.0.295257935\1940939702" -parentBuildID 20221007134813 -prefsHandle 1188 -prefMapHandle 1180 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d10bb13a-adda-480c-a657-63eac13ec1ce} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 1276 149a5858 gpu
    3⤵
    PID:856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.1.147670478\339035515" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8aa0c4bc-5cd2-42aa-9a26-61dcb70c7eef} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 1480 e70158 socket
    3⤵
    - Checks processor information in registry
    PID:1448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.2.435977730\1165642678" -childID 1 -isForBrowser -prefsHandle 2060 -prefMapHandle 1988 -prefsLen 21834 -prefMapSize 232675 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {defd5901-6954-45eb-8c22-92f15bdd5337} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 2008 e66b58 tab
    3⤵
    PID:1724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.3.1478247462\1899395551" -childID 2 -isForBrowser -prefsHandle 2704 -prefMapHandle 2700 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fb7245f-9945-4d14-b933-a09502236753} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 2716 172b0258 tab
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.4.330700250\1181660049" -childID 3 -isForBrowser -prefsHandle 3492 -prefMapHandle 3528 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef44ab52-93d8-45fd-8d4a-25746d8cbe9c} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 3548 e6a558 tab
    3⤵
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.5.933202118\1206911330" -childID 4 -isForBrowser -prefsHandle 3652 -prefMapHandle 3656 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce339af8-aaee-419b-82db-3c5dce6be1ab} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 3640 1ca8c458 tab
    3⤵
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1968.6.1558468048\207654082" -childID 5 -isForBrowser -prefsHandle 3820 -prefMapHandle 3824 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dce9c92d-e6fd-42d4-8edf-aadc040de077} 1968 "\\.\pipe\gecko-crash-server-pipe.1968" 3808 1ca8d958 tab
    3⤵
    PID:2244

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3064
- C:\Windows\system32\net.exe
  net user Admin admin
  2⤵
  PID:2692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin admin
    3⤵
    PID:2700

C:\Windows\system32\logoff.exe
"C:\Windows\system32\logoff.exe"
1⤵
PID:1552

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1300
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\system32\userinit.exe
  C:\Windows\system32\userinit.exe
  2⤵
  PID:2944
- - C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    3⤵
    - Modifies Installed Components in the registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2992
  - - C:\Windows\System32\bk6dni.exe
      "C:\Windows\System32\bk6dni.exe"
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\runonce.exe
      C:\Windows\SysWOW64\runonce.exe /Run6432
      4⤵
      Checks processor information in registry
      PID:2224
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
        5⤵
        
        PID:2360
  - - C:\Windows\system32\msinfo32.exe
      "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\UnlockReset.nfo"
      4⤵
      PID:2416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5739758,0x7fef5739768,0x7fef5739778
        5⤵
        
        PID:2640
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:2
        5⤵
        
        PID:3012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:2644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:1220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:1
        5⤵
        
        PID:392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:1
        5⤵
        
        PID:1448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3720 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:2
        5⤵
        
        PID:1496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1472 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:1732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1260 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:1
        5⤵
        
        PID:2856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3920 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:2220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:2360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 --field-trial-handle=1304,i,17943873491805304018,2959033753039526062,131072 /prefetch:8
        5⤵
        
        PID:3028

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2840

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2952

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2336

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6f3313.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
6c803fbd76dc3601dc284ea305115d0b

SHA1
48aa9414b2f0f95c7e9b181f0bd66939ffd803ba

SHA256
d5a0b27c3c5076add101d49409e1139bf324140216de375e604b7cce28e70943

SHA512
94b796ee61098e995d818e14def88699e1886b2256f34e6e58240c88a3ec2ae80c8ae916de2c34461acb0272afbddecf600df01bf93092ae5afe08bdfc16f1b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
190975b83a9319169c82aa90d9c90734

SHA1
5b442d6f9385fb526ee9a51fd18a54fa828cfaa6

SHA256
52ffe83ca7632415cba4d298f07e5528a5af2e181f52bfe7c4c10466d19a8d02

SHA512
a9ed375104bd261b2c559a378279c050ca83bd650191680d82e1edcbfb9f116d1539222e4389eed7e020d06a0e930022dc67a5e9b57601b318d5a1c188924e95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\841yyxv3.default-release\activity-stream.discovery_stream.json.tmp

Filesize
148KB

MD5
ed0185198805f8ca8678c6e915e2ab0b

SHA1
b3a9824a4f490ba3f8bc9465e761609adb9508f0

SHA256
bae61212492d009e454fcd8c81153c8996662d171ac719fff38bb4707cf11f5f

SHA512
2b44441c1383ebf3164f968b5847c2c11f0e88c2cafcc06b73afa01bf0b04a37f643a7daf95f883e582f9ae387e86d85fddeae5f66515dd8b14ca8684d18179c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\prefs.js

Filesize
6KB

MD5
af5e0d0f83969aaeb4fa6e78d6f95a24

SHA1
2bd8d80e93e21ac00bcd76ace582b012c30a7e66

SHA256
ea920c40489f3fe7fc1e02d86070da051c38ac5ef6950a15955116f7bf2e0891

SHA512
7124e5e077ff990e53c23f8b4c87ccb485ea2f7e28b1e465846aa2f1b4190fc1ccd905a8a2d10b7c7373f0bb5e4a4f0b37da769e5fb877099b61201fbed50b52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
937B

MD5
cb94cffc06cf86d2b961857014c3e66e

SHA1
4284eb81a72bccd3789e00ac345339b6b796e55b

SHA256
7f7534cbd7e4dbbd0795cf9651a49f51659134b3353cbc49001d26c56c6e9ef9

SHA512
fe5bfc218e880fed7e3719011398ec8d35c8f4c30d37a7301f82bc390648dee02e352f71169d0c6949fcb627f55dda64731b97ef1cf53d6f87c6a0e2d7da342e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\sessionstore.jsonlz4

Filesize
405B

MD5
7482464e8710ff69af3025ecac45d991

SHA1
944e39e1625d3d19432cc7e3160a0b08ffc163b1

SHA256
81446f0d050ebec5b79672e7d7a16277411453a93cff595e0816c8fd4bbdfbb7

SHA512
a2a82e63307c71442444cf44e613b591ceded6dd81eac7e0e7fc63bbf36099f9174f9fde8e112048c4eb854c5c006a17e29ac616135dae422e0456ec29e58c9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
2a48c93f6e80d3db2dbb31544e1772ee

SHA1
9bece495f40849902266b2074287b1390c66563f

SHA256
84148e2e5162bb191feb358bad138ed7eeac5d059ce8bf29ade690359218416e

SHA512
1dff93d2b80db14e1acf5b43524598554dc3a75fd73e668c550a62d66dd59b3eeb657d06a1f8344765bdf6dab230c83fe894a0f9e416ea2c7392ec254833c009

Download Submit
memory/2076-263-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download
memory/2748-262-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/2992-265-0x0000000003D20000-0x0000000003D21000-memory.dmp

Filesize
4KB

Download
memory/2992-266-0x0000000004250000-0x0000000004260000-memory.dmp

Filesize
64KB

Download
memory/2992-268-0x0000000003D20000-0x0000000003D21000-memory.dmp

Filesize
4KB

Download