27779e51501c540181715ffd1f6204cddb5d5b17a60434ea5922b28b8eb75a5d

Resubmissions

04/05/2023, 14:58

230504-scg21sdb73 5

04/05/2023, 14:52

230504-r88n6sdb54 5

Analysis

max time kernel
300s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

attachment-2.eml
Size

298KB
MD5

b2fcd339b18e3a35acf9937b82dfdbf1
SHA1

18ff6240ff29a8bbe77f1c2a45906c5a3e88ffdc
SHA256

5c70baaca2e40bd6c2c3be0277f18bcf6fda98efbc3645acbf9575a474bd0cc3
SHA512

abe47efdf197aa56438d87d5b29e03d772a13aba063032451219ac715263d255dacfa964e4a032e3ead47ec48cbaab16e76a0d4d74ea11382ccbacd31bfba11c
SSDEEP

6144:d08dlmdWAaDOMDSkITQbtNw/N59nB8iw7gdFpahtXii+VfHNj+UAN:d0GqzMDSkIitSF59B8iScpaHXii+5He

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000a456e776110050524f4752417e310000740009000400efbe874fdb49a456e7762e0000003f0000000000010000000000000000004a0000000000a8762401500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\attachment-2.eml:OECustomProperty	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3880	OpenWith.exe
2564	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
3880	OpenWith.exe
1228	firefox.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1520	3880	OpenWith.exe	91
PID 3880 wrote to memory of 1520	3880	OpenWith.exe	91
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1520 wrote to memory of 1228	1520	firefox.exe	93
PID 1228 wrote to memory of 4136	1228	firefox.exe	94
PID 1228 wrote to memory of 4136	1228	firefox.exe	94
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 2540	1228	firefox.exe	95
PID 1228 wrote to memory of 4648	1228	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\attachment-2.eml
1⤵
- Modifies registry class
- NTFS ADS
PID:4192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\attachment-2.eml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\attachment-2.eml
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.0.1475355360\1474525501" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22d76b79-8d1f-4d4c-91ab-0d10b6c87e49} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 1916 1de1a9ef258 gpu
      4⤵
      PID:4136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.1.647827249\2061966305" -parentBuildID 20221007134813 -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1541dc28-cd3f-4052-9679-5103863d0cc8} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 2340 1de0da73b58 socket
      4⤵
      PID:2540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.2.2073484785\449719506" -childID 1 -isForBrowser -prefsHandle 2940 -prefMapHandle 3056 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e73710cc-1c76-4aa8-ae4b-ab58201922b1} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 3048 1de1e6f6558 tab
      4⤵
      PID:4648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.3.158399359\1025360285" -childID 2 -isForBrowser -prefsHandle 3808 -prefMapHandle 3804 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9d874bd-55a7-4496-8c40-2bc21a26a719} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 3820 1de0da63b58 tab
      4⤵
      PID:4152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.4.197027077\1629300152" -childID 3 -isForBrowser -prefsHandle 4912 -prefMapHandle 4860 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb0e3089-51af-4e65-97a6-da11bde79a3f} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 5060 1de21c6e558 tab
      4⤵
      PID:1924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.6.2116053047\23080326" -childID 5 -isForBrowser -prefsHandle 5088 -prefMapHandle 5400 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7594b11c-74fa-4dfe-a9cb-37d9d06632c9} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 5308 1de21c6b258 tab
      4⤵
      PID:1976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1228.5.1542180228\376550223" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5044 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7a3a54d-0f37-4ac6-b8fa-1791d7883e02} 1228 "\\.\pipe\gecko-crash-server-pipe.1228" 5088 1de21c6bb58 tab
      4⤵
      PID:3412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
e8187d482287879dc2d25b437e299144

SHA1
d8c1014be2fe685b842cba4694658e7c9bbd18c4

SHA256
98c95e64f6b9b15835de6331b628497e369d5a1c6b1e4cc453279ba62258aa0e

SHA512
cb3577d40b2574746df06c49f42a7a07df24316bd039d020e516d38ac4d8205e9fc8505adb6fa46de535e709ebb5625983957fb10809faf7a1bfa4eadb128b3a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
147KB

MD5
f2fbe80f94b6bfec1d39041a2383ca60

SHA1
6e778fe58a699cacff9b4847b4c6ed5a0325005c

SHA256
8b624784cf54ff7c5a98d4d293c4d6de6bf33c815bbb33c0fcfa719629313919

SHA512
99f90e66b29884f8af7d317edaa18313bfeca231b85c185b83120bdfd91f3c89236373eb383cb7c2e22252786bee1d1d93ccaaaf5b723f5d5e52d5b902d676ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\250EE2BC03AFF526F1A1C3DB212A79DE3EB60D5E

Filesize
14KB

MD5
04ba03f60f95d21f518246624782f003

SHA1
8058702c8fca6568fbb6ebea1ea4defbc34c60ed

SHA256
d68624f46e1e4167fe0cc7e915bcc91e5382102534c828415a2087dc98703b96

SHA512
9f38b8bce39f6d821de14eedd91de3710810fbf611a86c7360d4fd8a346b73b5f7df0ab87ff753627abf41c4b691bfd34818b3be5cadfc8ba738e411f68a8f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\attachment-2.eml

Filesize
298KB

MD5
b2fcd339b18e3a35acf9937b82dfdbf1

SHA1
18ff6240ff29a8bbe77f1c2a45906c5a3e88ffdc

SHA256
5c70baaca2e40bd6c2c3be0277f18bcf6fda98efbc3645acbf9575a474bd0cc3

SHA512
abe47efdf197aa56438d87d5b29e03d772a13aba063032451219ac715263d255dacfa964e4a032e3ead47ec48cbaab16e76a0d4d74ea11382ccbacd31bfba11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
0032c80282618df1bc7dc8db4e63d005

SHA1
78af5d9a522e39f90d7a3dc5e9bce0e95b1b0fc3

SHA256
350ad45f8718fb1074054225ecc275d3ecff22001392cbe3a988513dd899d73f

SHA512
30e135d8aef4c81370ca5fbaf8a25547829cdc15a01efc21173b131fea8e4468d9d7fbda7df5a2bf4303adae4fbe14e0fbc2e12aa2f421894ed31e0e569fa2db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
7KB

MD5
09337dd597384448054bc5aa86c99379

SHA1
6199155ff572a2b0ae814ed8db8e9dd207428d56

SHA256
a135ee0066da7a5b17e603d707ec2f5abf14cf8c2ed32e958cde1f6a1c8fc634

SHA512
9ec32581db898b3f7fae31841be5600bffa07246e64c43db8a39a6efa4312bbc08427772cc565f9121c16192ad98be9aac5559eb4cf3083e1be6ff1b0df374d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
8KB

MD5
f60ec6704cae1ba71e7063dc5b7b8abf

SHA1
fd3ecf01a7eb92eba7034c3c0ca0580dcce96db4

SHA256
e3547f739094e72a5b2d523cf0bcf3faafb8d40c6dd73916f22e9c841194d2b9

SHA512
ed5bb4094a74f000eba259f2981274a561e38a8bfe96cda58193a9814e5bca967d77b4a2637113fa55ea96c4abc7bd06dbe1afc6f468ac4c6485ad7820de489e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
9KB

MD5
1a024189d3f938e6a287b60591ea2797

SHA1
53251c948cf453a51b6b40dabb322ed460d8644e

SHA256
863b2e79afa4d415d9047f8e3d12683e4bf989f7ff36afbdfd3b9e2c05d0f406

SHA512
a96f2d7f531ec8a24875b8f2005c994c0722471344eeb884573cbda9d193b05652c581ca76c2072f3bb69b061cd8fbe2eb45462b8d67c976cc4e309277fa1b09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
10KB

MD5
c9c7a7c2435bc5909e3c817e2246c93f

SHA1
a841d23254fcfe7ec206a95997945820e405f9d8

SHA256
00a1f22212d39e2e1dd46836dd9eed973ff24bd85f5e445ef0a257c33452de1f

SHA512
578ba3c17e86df4b6701974832c3c99f0432ca297f6d33edb0698b0edbeb4f7dc33e7cb5395bddfa79e2e4e3cc2914ae025170f00ec460380a68e2c1f4fbd89c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
6c3c3bbc6ec8e9dd4ea5298ae4157b75

SHA1
a795ae46bae7323b62df00d93595216c144c4850

SHA256
260f002ee983c90908a2568b5798e7dbce90c62e6c83f7be87a836a6be212555

SHA512
7025aed7adf9de0874e17367bb70208936879d31d18cc4b3afcd8c9be523d19e4822b01efc2538d0b5bc2a3c8ee80ec2ec27b91680e1e30694f2f2b36a85e500

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
50ab9f14e532e0a76cfc5678667408ed

SHA1
2291304bf43ee790c25e50dbc7ad835a03bf0c5c

SHA256
2b7cc0b5b5d2d4f587c07bbfd97c9dbf7a034044de76f9c4cad7923ba4f1c746

SHA512
5960bbf9a7b7f1942f1de2bf9d3ab0424021e29fa8ecb3e9926df4cfe5035814627963ef676acd33a0ad6bf76f62afb1aa569d564ebd4243e33e61d2559848a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
6KB

MD5
f73e52d124620d05267ba934f3b312d3

SHA1
34121aa291d9f88b3e8e3a2fa37cb1c06cac2d30

SHA256
fc898a91ae8ce9d241c586f5dee2e60450dcdc5a31f1a7015d6dc2f4fefe4ac7

SHA512
4ef67626a2ba584817d707c71ddf7e7ce75a780921c3fcdfa8a03de0de9303c4b548ce3c3b493f1c4876d511271978bcd3cdbc2d1003b23c2459847180045d46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
46c707a2ce23e7b662d16fdff7a3e64a

SHA1
b7c2054109c514f095dbe9ab8ea1f4d53fb82587

SHA256
fdd6e5adeb72e48c3842ef5b73a3f3082f647408041c991dd6b9312cc7381dfe

SHA512
8749b0df062b1d32a6f6ea347f89da9d050d7399f41d7d1d0ad9cd05d6d9e6c7a01f4c96aee265afcf82a588078993bc294f3a300a28dc697fdd5809f8584351

Download Submit
C:\Users\Admin\Downloads\FJuDba-z.eml.part

Filesize
298KB

MD5
b2fcd339b18e3a35acf9937b82dfdbf1

SHA1
18ff6240ff29a8bbe77f1c2a45906c5a3e88ffdc

SHA256
5c70baaca2e40bd6c2c3be0277f18bcf6fda98efbc3645acbf9575a474bd0cc3

SHA512
abe47efdf197aa56438d87d5b29e03d772a13aba063032451219ac715263d255dacfa964e4a032e3ead47ec48cbaab16e76a0d4d74ea11382ccbacd31bfba11c

Download Submit