hxxps://www[.]curseforge[.]com/minecraft/texture-packs/low-on-fire/download/4524893

Resubmissions

07-05-2023 17:00

230507-vh4t3sfc26 1

07-05-2023 16:59

230507-vhqmfsfc24 1

Analysis

max time kernel
121s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.curseforge.com/minecraft/texture-packs/low-on-fire/download/4524893

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801cb38f0581d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031557"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2243541393"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390243816"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AEFE55EA-ECF8-11ED-8FFF-DA4DA442263B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2216044509"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2216199131"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b000000000200000000001066000000010000200000005e7981b1b2f2cbbaa6d15489912c456c9c84a856300bf2a2710adde671733e31000000000e8000000002000020000000ce8be0a7242a73fe9ab6ed5017c059f0060dd2d9ec328124c13c5193fc91119f2000000043d8fe62443e8e14d7cedfa0eb2f2c26eab37a40ccb9f6ae6a39a268c7715ff24000000037e88fdab80469e02f47de4e15588e9e70ab8b208fd5ff582d7baee7def72502810781e87b79fa579d1580d1e73aadb393f4ca452eacb984f1311e6e4518eb87	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b000000000200000000001066000000010000200000004cf815535d2a03109dbb176c4378d9e6b62dd62d1d4bf4c6f9bfee9c20fab08b000000000e80000000020000200000009b9fbac78f8811b7edc3b456c23e0a6a9b8ba0045de9d4994e6539ee11b35aec20000000035a4d666c1666ceb174e32da8752a3eef46dde03d7151c131ec8151cbec63604000000018534b7344094228288a67ccb2f7ccbbdd2a82c2843a2d3562b601a8a78b22a9976ea91866dd09f8aab77fc51ddc567af6827b9ba3bffef3846eec0a9c7b8926	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031557"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6074c18f0581d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31031557"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "247"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{FFC27DC1-B1E8-46F7-8AEF-7AAE4D279567}	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\LowOnFire_1.19.4.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3900	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	3900	IEXPLORE.EXE
Token: SeShutdownPrivilege	3900	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	3900	IEXPLORE.EXE
Token: SeDebugPrivilege	3352	firefox.exe
Token: SeDebugPrivilege	3352	firefox.exe
Token: SeDebugPrivilege	3352	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4016	iexplore.exe
3352	firefox.exe
3352	firefox.exe
3352	firefox.exe
3352	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3352	firefox.exe
3352	firefox.exe
3352	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4016	iexplore.exe
4016	iexplore.exe
3900	IEXPLORE.EXE
3900	IEXPLORE.EXE
3900	IEXPLORE.EXE
3900	IEXPLORE.EXE
3352	firefox.exe
3352	firefox.exe
3352	firefox.exe
3352	firefox.exe
3956	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3900	4016	iexplore.exe	84
PID 4016 wrote to memory of 3900	4016	iexplore.exe	84
PID 4016 wrote to memory of 3900	4016	iexplore.exe	84
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 1524 wrote to memory of 3352	1524	firefox.exe	96
PID 3352 wrote to memory of 4100	3352	firefox.exe	97
PID 3352 wrote to memory of 4100	3352	firefox.exe	97
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98
PID 3352 wrote to memory of 1356	3352	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.curseforge.com/minecraft/texture-packs/low-on-fire/download/4524893
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4016 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e0 0x45c
1⤵
PID:3144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.0.1721770065\620890782" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {870f44b4-f104-4880-9b94-e2a45b23f3f7} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 1932 1db3fbece58 gpu
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.1.1630221396\1126091446" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ffb099b-8234-4061-b75d-7c95993b9532} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 2332 1db32c72b58 socket
    3⤵
    - Checks processor information in registry
    PID:1356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.2.1495179610\1165080799" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3052 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16d84a6f-c643-4bb5-a745-a286bdc8eea9} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 3068 1db439ef058 tab
    3⤵
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.3.1952270288\1090378829" -childID 2 -isForBrowser -prefsHandle 1448 -prefMapHandle 2472 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f692ad94-ac1a-46ea-8a9c-e4fea535cf4c} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 3572 1db32c6ae58 tab
    3⤵
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.4.1493267240\376015094" -childID 3 -isForBrowser -prefsHandle 4072 -prefMapHandle 4084 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23726e81-7113-44f0-9864-a9c19f0eb23d} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 4100 1db449d3a58 tab
    3⤵
    PID:424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.7.1836614215\1301692508" -childID 6 -isForBrowser -prefsHandle 5300 -prefMapHandle 5304 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01325d2f-9981-4606-8df9-fcec9d17d5d9} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 5292 1db46589558 tab
    3⤵
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.6.344166972\1277444057" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67916818-b4e7-4bcb-9350-c136a5cff7b8} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 5064 1db45f58958 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.5.470175833\1622476588" -childID 4 -isForBrowser -prefsHandle 4880 -prefMapHandle 4224 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b269db5-9d45-4b88-bb48-dfd370aec8df} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 1644 1db32c2f658 tab
    3⤵
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.8.2040152222\1244354965" -childID 7 -isForBrowser -prefsHandle 5564 -prefMapHandle 5328 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0d52531-6471-413a-9bdf-ab6d85a16e47} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 5336 1db47ab3158 tab
    3⤵
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.9.703226183\469280609" -parentBuildID 20221007134813 -prefsHandle 3200 -prefMapHandle 5900 -prefsLen 26755 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9112dd73-79b5-4975-9063-ee74fed78a59} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 4524 1db32c61c58 rdd
    3⤵
    PID:1456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3352.10.249341113\1737323369" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6040 -prefMapHandle 6060 -prefsLen 26755 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23f67bfc-b57f-421b-a8a6-0bfe3093307e} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 5116 1db45f52558 utility
    3⤵
    PID:5000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1588

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ab855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
14c5e436db29ac7db9301c7374ade89b

SHA1
1edbc68541a9f7fcee30b0128b50e8ff551a4a04

SHA256
3aa77b97fbf0ad97b71967f6324c99f34217026515d4d6583af5705c514e89d5

SHA512
16214d49c04a0bef7165ba36f98262d78b1600bb4afdf82f004d04f302692f28c3bfe457be36da5fc62c7a27a8b3d94073d2d8069a3aa506cd40f85574e4724a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
dd34ff77b7172353c9506f68a62b4d13

SHA1
e21eb05d00b13c987bf9075a10a7dc4273b1e128

SHA256
22635b8b94bd5716a9d1c245a03d1ea99ed437d1ae9d674180c1deab3173cfed

SHA512
8d4c2c26f088c418e0493aa4fe357af92704cdc42e510fec5351d846ab0b6c07d40a127e958b620a40e31ec8b1462e3cbc526d4aa075c1619b25e880a0dc5b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat

Filesize
5KB

MD5
2a6dc31c23187bb5046e4799f70ae54a

SHA1
2432b3eec722754d7f71aa1ff53b83db869eca1b

SHA256
d99655ebcecd05a59f98d7dff9b01259261d252cbfb0962239358209a833bf96

SHA512
aac9d8e84c939a6fdaf18d3693915142a15e0b0b40a6e6e2a000f62e1f8128e2f83871887d4b4725ad2791825b5e386444c61ba284e578bac42980a0b647bd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\favicon[2].ico

Filesize
5KB

MD5
c7b28ffc1154feffac7268ec63dd4e9a

SHA1
ca70f1a3d452c472cdeeff57b2e50e69e218a4bb

SHA256
b1c9f08adaa8f91957bcd20e2796814557683ed051173ae31779752632efc5b9

SHA512
50b3b0c0a18c02673c42c20212841ef6a099573adad51890535c6ca6fc55658117589a4772cebac93eb8d9464e6ec7f721a183c2cc64ec4770feb1563ea83a8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
160KB

MD5
86e72b825a2fa51d46c081a8039de0a4

SHA1
f8709dfa15d0e6478b947bdf00e8d4431acf8dfb

SHA256
63b39596e1f747960a344b017762a959597aa48d7d18097e444bbf5570418d2c

SHA512
e2ec6427b07a73c72f342fd3cd185dd63ed45ccff458c0678749dab44265ecbfc115aaa768e216c4579d1f96b25f68b362d9e8e0043aa4bbc860b55a90110897

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF72B4ACC72FC05BD6.TMP

Filesize
16KB

MD5
22ae0cc1f2fd20d5c875565b685ece8b

SHA1
fde1738b3cb904427b499c128479f05f14b82f1d

SHA256
810b5d4991752b830b842e194bac0d3b6cb4f108679eef0a3fba7f8039fa4458

SHA512
5892db00dd24068760612e118605f6d55b19ee8bddf188e5ea7f888a31e55359333972afcf92b02fda0471126bc732d1af029e71524a3b3c9f5231a48ba2a09c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
e9f7f6c3fd3960d58269ee5b31f01011

SHA1
e0119d7e2142b5b072992cd6b9615e54696c5b54

SHA256
687c2b9576ecbed8031a8a771268623627067474dec6bd496075cc02bc15ca66

SHA512
4dbdebc7f0146555a3ef98a0fab54fa80761a302c1cb1547e58c471b732b9616f1f5cfd81131510f151a865fc262dc251fee9fb69fe18f7103140f9f47eacef3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
ff1b73ccde5e1d26cb601534d92aa0ab

SHA1
fd6b1e4c3be5391cf3d0eb8696aca474c3c75d98

SHA256
209e2d948e2d15ca8a861ad0623cea7dcae0b7ae3e01975de040ab3fee8a5897

SHA512
0d44e7a35ebde2672a06ea58cab42076b853687e0882e0de869d42ccbaa76befd1530d91d9a7157db04ac0684214efe1cd3c03045285f6d4c03bf3652d8617b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
da5e8486fc520686d546f86b93eb7a13

SHA1
948e7ba7c683b27afb96693eafb511ef46b64b53

SHA256
617d1c842a8ce24962b6c9a5e3f09e9612b5717539a4194eaa48665d77c9a14d

SHA512
ca46b60a31c2acd19e907872625ffdcd6a4d493d35207b207d03b6702e2e7d3e2bdb5bbc3d9bd2a211f5f1c880a4a573331618fbb814d4b0b5b5f3c9bb1d73e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
6KB

MD5
0f312ff8202775bf9330ee47ef3fb331

SHA1
7811b8247892eace5556267cb57493cdbdab38b8

SHA256
c45a5ea211d910214a5c22d6ee5c28b777bdf8037f773a17ee9eddfdcdbe97fa

SHA512
7b36a61b4db30000d9bafd7d0af5ecf4dc0f09467be6e4344266cea120a9ac96c2cd03ec62f5bc21e79c386ce91e1842fd878f974d5693c0baa68d510d1b09c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

Filesize
7KB

MD5
5199467ac6362e497529ab12ba2e824c

SHA1
c63f5ba41b37f83588051d2752daaf540ec1c400

SHA256
eb6d2352172df654317dd6dcc0ca4651b31e4d1d2a53b22d215acd32fc6295fd

SHA512
2dd911f49a08356dd319d6d9b00f4c06ba38a2168abc581aa30aff824872917feb60766846b45708925623c22db67f7505085e22cff3e0f3bdb9fb9a910c0da1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

Filesize
6KB

MD5
f73e52d124620d05267ba934f3b312d3

SHA1
34121aa291d9f88b3e8e3a2fa37cb1c06cac2d30

SHA256
fc898a91ae8ce9d241c586f5dee2e60450dcdc5a31f1a7015d6dc2f4fefe4ac7

SHA512
4ef67626a2ba584817d707c71ddf7e7ce75a780921c3fcdfa8a03de0de9303c4b548ce3c3b493f1c4876d511271978bcd3cdbc2d1003b23c2459847180045d46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f914bd9473ceef88356e379023429427

SHA1
163e08908273a261be7d84c4a4e4032388f8b414

SHA256
8e7af0884c1cd74d46e16de0d74de6c7bfa2d9e01b361565940cbd9d90d291be

SHA512
2ffdfdf1e374dcfdf84116d38ecd6fb5a31c96f0b3a3bc0f36066e5efeba367ab00039ca9a17d20c4dfe1031d90f9aa2d4e3b9f7fa7725f1f99bd3a0fdf24ab4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
2cefb1d2fe6a06e6c3428809428bff46

SHA1
4ccf4f1f13c037c321144bfb710ee3cef0a10d62

SHA256
fccbc865f8aa63780a5fd66d558369678257e56ab70d01076a05e5566a7f7e53

SHA512
b899e99ce147648b867303080bea3e150ea91d94de70720c731e773e82b1a416dfefa59e592cdf22c4bde760ffc3e0688db4f9c0ed4cb6e90e247c7a904303b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore.jsonlz4

Filesize
2KB

MD5
c649d388684b2fb666a8a11ae7010211

SHA1
94323c8e3efac9ef89433c5ed61d32eb1b2b47b5

SHA256
71f4a50f29f9f1b18f3d59dba8a3a37296953c4756208413c80c83bf699b715e

SHA512
443f1fda32ed0dc05e6e0a1ef9584438ff976a80d8d2f985ba30556c48ec204f5a9870ac1671fd620f836e67743534519259a2ed1a2046f12049ae5e652ff9fb

Download Submit
C:\Users\Admin\Downloads\LowOnFire_1.utjBHVz3.19.4.zip.part

Filesize
12KB

MD5
d2ca2344a60898e5280ecb3f4af20026

SHA1
012aa5491541cbcd2767b4ab9b146ca67e8b0ac3

SHA256
9a77447ca7be7ce5f038c8e86c51add73f4679a7c0694d05f2e0edc6044a0ebc

SHA512
83e652b015f725f5f3c481a7e7b474bcb0c07ae018331ad7e78b8a69edd937cb67e2faba3194493fbf4332043d5c6587b49bb3b1c28f620dfc3344efcc8ce5bf

Download Submit