hxxp://instagram[.]com

Resubmissions

24/04/2023, 17:36

230424-v62pmadd94 1

24/04/2023, 17:34

24/04/2023, 17:31

24/04/2023, 17:28

24/04/2023, 17:25

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2023, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://instagram.com

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.instagram.com\ = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\instagram.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1829324649"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{97EDF0D9-E2D6-11ED-8227-7ED0DEFFEB6E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\instagram.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1819439598"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1819439598"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051d6db365ce0f843a8e6cfaf226c4d2b00000000020000000000106600000001000020000000fa627651e37d0182d9f5bc835a2621fd3b8e2fdc9ad42cf659fbfcb600f02bfc000000000e800000000200002000000048c5a1398ed7640c5d749baf97018028d4083dc15a2d37225635c679ab907e9d2000000026326d7d29407dc72ca1c57cebd965ae5a99fcb7d2cee802136beeea1c49c56d40000000f3eabfce817d4df70127a4610a5dc19c45f662807a41267227485495095b9b78efa9de826e43dcea58e476547e8d625b0e0cfa01e96e75a33ea76dc913b01a8e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3030ea70e376d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\instagram.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.instagram.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\instagram.com\Total = "27"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.instagram.com\ = "27"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\instagram.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "27"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051d6db365ce0f843a8e6cfaf226c4d2b00000000020000000000106600000001000020000000cac84786fcc91dcd69a84f04746a70645ad4f7fdea7bb9f83a52c0de1af15416000000000e8000000002000020000000460002e649f26e236bdd23e4152193ea82f7f3ac8927cb47582ba867e8bae68c20000000c9cb9f6cc6d686040c0f44d396c943c2d54324c346c951d41fd406f47d49942340000000b96167d1189fc2551cec7cc87ce349d511bb89bd842bbe5bc4e240b23b7e2bbcd7b7cb58b8d6fae197090b1217c36f9774e36801b91e45582572dcd1bfe7401c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7090f470e376d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389129658"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\instagram.com\Total = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.instagram.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028963"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31028963"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	firefox.exe
Token: SeDebugPrivilege	1256	firefox.exe
Token: SeDebugPrivilege	1256	firefox.exe
Token: SeDebugPrivilege	1256	firefox.exe
Token: SeDebugPrivilege	1256	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1252	iexplore.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1236	1252	iexplore.exe	85
PID 1252 wrote to memory of 1236	1252	iexplore.exe	85
PID 1252 wrote to memory of 1236	1252	iexplore.exe	85
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 4284 wrote to memory of 1256	4284	firefox.exe	88
PID 1256 wrote to memory of 764	1256	firefox.exe	89
PID 1256 wrote to memory of 764	1256	firefox.exe	89
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90
PID 1256 wrote to memory of 4676	1256	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://instagram.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.0.986107404\1495475279" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df46eab4-ae87-464c-be18-655d5abe2c30} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 1916 1bd96816258 gpu
    3⤵
    PID:764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.1.2019676013\884844173" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2140 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4ca1db6-5e3f-43c6-bd1c-b7ed09ffb5c9} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 2316 1bd8886f558 socket
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.2.525965525\1937107183" -childID 1 -isForBrowser -prefsHandle 3144 -prefMapHandle 3160 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9d5d85d-20d2-4b61-89a6-6e835f379dd2} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 3132 1bd95794558 tab
    3⤵
    PID:3252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.4.116721018\1055844504" -childID 3 -isForBrowser -prefsHandle 4032 -prefMapHandle 4020 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e795045-cf3e-4efb-8570-65d972c73baf} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 3860 1bd9a4e4858 tab
    3⤵
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.3.109064917\446577071" -childID 2 -isForBrowser -prefsHandle 3856 -prefMapHandle 3852 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b50b59bb-c95b-4f0c-98e6-895faab000c6} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 3884 1bd99bc5c58 tab
    3⤵
    PID:3980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.5.535429019\431401199" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4369e310-dba0-4e49-ae6d-1c55664a4c60} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5008 1bd8882d558 tab
    3⤵
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.7.955905548\913117169" -childID 6 -isForBrowser -prefsHandle 5336 -prefMapHandle 5340 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccc2501c-d9df-4848-9915-5fb516b92710} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5328 1bd9bceb458 tab
    3⤵
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.6.763627033\222012401" -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6f7d6e9-481d-4a95-9dfa-bafba9574d7e} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5140 1bd9b9ba258 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.8.1800642253\597562929" -childID 7 -isForBrowser -prefsHandle 5732 -prefMapHandle 3092 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03f8c3d1-26d7-4e53-bf40-53c76b4d9c38} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5696 1bd9b7ea858 tab
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.9.1364151469\1436273982" -childID 8 -isForBrowser -prefsHandle 5060 -prefMapHandle 5056 -prefsLen 27116 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2505b0d1-b7b4-44a7-89ad-5c161ac439ae} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5048 1bd9a7f1258 tab
    3⤵
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.11.1220110035\1172595051" -childID 10 -isForBrowser -prefsHandle 6112 -prefMapHandle 6116 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09be39f6-99e1-4701-916b-755d9a967ea4} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 6100 1bd9dc2e958 tab
    3⤵
    PID:3744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.10.1799100508\1880569289" -childID 9 -isForBrowser -prefsHandle 5920 -prefMapHandle 4124 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a5e09e3-f8af-468a-8d86-973c446979e1} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5084 1bd9dc2d158 tab
    3⤵
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.12.1752413358\1731645666" -childID 11 -isForBrowser -prefsHandle 3900 -prefMapHandle 3856 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e1a0d6b-795d-4b9e-9984-1efd7ab71e46} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 4480 1bd9da42b58 tab
    3⤵
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.13.1534357100\691933722" -childID 12 -isForBrowser -prefsHandle 5976 -prefMapHandle 2808 -prefsLen 27331 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d89ad5b9-3234-4afc-a06c-9222b87aa813} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5860 1bd9dc2c258 tab
    3⤵
    PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
d6b67afeb31f0d9bfe232166e8b300c5

SHA1
6ba1a534d40fea9302591aaee8fb6969bfa28e4b

SHA256
ab4f8d3ad2a02ad67059703fcb9c7ecd397d9abfce4b4cacdf7ecc11b4e37520

SHA512
62c9fc6797c263bf33c8f52d5d41ce276b3df2aaed6433d582987a607ae508f5389f86d5d8a63cc5715964623f5be08d5741ddd70a0fe18f0140eb314815c272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
942a9270a2d298966a06590f25243055

SHA1
f81efe0d259b5ba44733c5fc280ed13e254e878e

SHA256
e243f09f4563d146231520958496772751cc04e71256ddec967649811c710a5d

SHA512
4b55aadab327de7a187109bc15cd2aa301d8ab6650def7af321bf445b09ce534c34b384e19f08ab62df0598a2a28a81227dfdc38ac9d129752d1b11a1c9245fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat

Filesize
11KB

MD5
81752e389d235dc8e041c9f131433432

SHA1
61d7374d0d85bafd299407ef9de3133511ecde01

SHA256
cc3067069b70595c0c3d4afa5a8b911e484e250381a82ee61de510d50d6720a1

SHA512
130b4b4e046fa93ea5f36b3007191ebb35016cac717b69c12338935174793b275b15d123446c2e05136b0cabef6cd8746b59ac87af492a0040162060aad760a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\lswP1OF1o6P[1].png

Filesize
11KB

MD5
112f95bd7a8e11efb6553c5970fec9bc

SHA1
29eaf460e6741faccf8744dc74d42f911a73d358

SHA256
4f4c0ebb5150db9096ce3e4edb754966f91c84bc840ea6b9240aa81c9bb5154b

SHA512
4a2d2cf2ef5a1c1378959bbb3777c08f5a2a71934abfb8183947c36a0e5d723b1d14aad1721c08dd1154d4b757cfb7b57da23a4978ee545f2a5d081afc289757

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\activity-stream.discovery_stream.json.tmp

Filesize
156KB

MD5
a65020f82aee8edc4771f83931d3f41a

SHA1
57049b6294b22c125f657c7ad6558c5b468801da

SHA256
f6331dbfb1b2f5b01f098175efa0ee1076709184cd2f2e9a30e6c270a26994f4

SHA512
ef47502cf6eca84a38d4b01f9a5aafa33606993e080472a04d9d02980dbbf389457c3428c7962845a52bf2274a8e2b359afd07246dc8f59349fc3d48fd2202ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\doomed\20885

Filesize
15KB

MD5
261746ad273e1e3ac876a8e33ad6c656

SHA1
efa46a5059deeb6fd8dcc538f263224323f3273c

SHA256
8edaff00d65da57dc8b1aa82a0a16b1b5116dc189eaeae802646e4c9625f8672

SHA512
f2806a80c5b61bcd5135c9471c90540a9bc5dce4de9e507258fa74f7e34af857f50a045d54c502d1d03a9bf26abeb4c84de6fa0eff0fcb4ac8f7e74fac45174b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\doomed\31793

Filesize
8KB

MD5
52ec1ea491583c0806137c70439f2650

SHA1
9b18fe70651968d14131e367dae6ed9976164fc9

SHA256
7d27d1114efebc38ce164ad9a0c72b048a4aad1840d6b5a223609cdd77c5be53

SHA512
82dc0f85fad1018f6c9031270c17a3184891e1f8174be99b6657e94f8fdd8e5ae5065cfcd160cf78f18bfdca9a6228d4d913a3dbd43665621d676915a6085652

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\entries\6B34CA2D8C9EFF3A06D46C88A896879358A374EB

Filesize
172KB

MD5
02b5eda0bba2cf51d223493219f2365b

SHA1
315ac66d02c2e1ddbb186801f076489dc9ee874f

SHA256
1973be949ef59d4692a745be3d7ccf51bb4f0fa9247059606fdfc389b2becf73

SHA512
c8f662b5ac118a2e64596e30b2e96181cba99de5489448dd9c270f37e5d07e19d92c5cf02d14b2704616bf49bb215330656f7b2991387200f9761948b78d4853

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\entries\A0B8017B1717AD82EBD6A26B5DC14095DE97B6DB

Filesize
2.5MB

MD5
769a4aae02ea3ee96f6046977dd865e1

SHA1
01ce38d42639fce6f734eff132a7bd6ec519c383

SHA256
b83c97cccbc988072ba8fb29d25a4827758b452cac90de3f447ea863e3326fa1

SHA512
6e55cb93c1f6fcace444c539b89880a26c4f0480d53336f95476af0964ada80a87eb38a945e92cbeafed6f901b592dc8a8a6557e327b916ae0b02c0554c54faa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
6KB

MD5
ddfff14844f7c09f5d1b2dac608acc27

SHA1
b00b56b741847042fd03e14120e1bbd1df882872

SHA256
b7e69ebfa5e8623193bcbcb548eb885f7ce68005a809655116ade91afd4276c1

SHA512
d2d4ff14ebb393b66190d73223c9ec84b79e4396fad0e437f355e7bcd0af45f2a994d63eb1849a279523373a4b2d7872465c4513a8a287a53aca2f4e1460a45f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
7KB

MD5
33a68d149b5132dd37a15a351c287396

SHA1
134f5312cce763aa60588f76f0c01cf6cb831c28

SHA256
682dfd2f2c65c8d2e12a29e018c4b59b24643597a5e89f96789c4d97a08d4c64

SHA512
1041d17ef63ebe7b21ce2acfb5ebcaf4b668299dcea04fdecdddc3e1567f586f8071f6b84ac0213b7a0e32aedff58a11df18cf6109227969e730940353143647

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
7KB

MD5
bbf30329ffe59d6b90873e5a446f64f4

SHA1
489a568a38c6028380d4aba965deb3c1978820d3

SHA256
c1bb523d10393d5ca176385e46e6f3643f1171abc0d6f432d896cab1835fc4e3

SHA512
e645d2931e988369ff5b4445958a5806bcab9668ced03f32613520ae000e0069eddde406e57311a7c7c6d18a33a512d96a1e80abf6e9bb4721e365887d96fd37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
6KB

MD5
f6aac64705ed6fd2bc5f7ec13a5525f3

SHA1
0b45240b767a60c0d0809760c77020b2c8cd436d

SHA256
105fcbf89acd105abbdc64920a0a76cefd49e7fedf4bfc4d124fac19967280d9

SHA512
8f16bdf9efeb4417c699ce741c2e81fc0fdcc39bbca14e36909caaffd4cfd241ed1c3ca4a28279439d074a4197a8afa91de423d05825fa50b44c71247ef8a0ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs.js

Filesize
6KB

MD5
fcd5f37e5e4066f7cffe8eb106b6ce19

SHA1
b0a1c4d3d5c96271429fb09cb71055d177c13402

SHA256
38dbdb91f24f8e138803d71d0f7e4758fbb78e7f657208325fe30a501e225c67

SHA512
afdf7697bc784c3c85f30a8a1e4caa32459cf7f19c1ffacde04f62f089218ff1899ffe69fc465677d719546c8f91bea0d04807b13d58096f79aeba8eef0a0a15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
4e6578ab7b7ae1f72313fc4b7591776a

SHA1
21734697129c988b1b6f48c0436bbe119c7e665d

SHA256
0039976ef14301e48770acec00c3a6bdfca445b323452c029b7ddddf3adc9a48

SHA512
280eea106d7352396b6af063855a0e671c25abf899e08d4501f70219300534a6fa4385482b5998a1d9173a15a1e654fe05b683b110ae67596ada19924db99c97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
7e114050ba2dd85b2baafa80574bab28

SHA1
193a5b047c14680a102b783109eba1c83b84afe0

SHA256
32e91cd7b19cb35685b34e3e63164d1e4ef290d3a43d93446ae2e84037ae7df1

SHA512
368a82fe78b424326f6e626cf49d8c2bd3fc7a13b8503b73344ac7537d28907c4bfb24ae4451784749648775cd739b18cd4ac26af64d36c4e2b7fd79080a0c42

Download Submit