hxxps://telegra[.]ph/New-Soft-2023-02-142%20PASSWORD[:]%2020232

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2023, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://telegra.ph/New-Soft-2023-02-142%20PASSWORD:%2020232

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4025999b1d81d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "92"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2770159246"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "114"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "87"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "89"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "95"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "114"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "118"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DOMStorage\telegra.ph	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "97"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "98"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "116"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31031581"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "94"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "102"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "116"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "119"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031581"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "97"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "111"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "87"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2711451406"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "105"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "106"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb827cf93ddd146af8365c0e3ca130200000000020000000000106600000001000020000000c8ad694f8b98b9c792e9d1e57de3fc74d6e1e21e047edda31e3864a011e95642000000000e8000000002000020000000c59e6c9cf885649e0651046eaef9d65b0fbb62eba88a862ba6e53131be4117a120000000a8c09c3a7736726380d7bf42686e208cdea2397d5008becba803284f22d5b1b6400000001d67d063f62fee00005dbcce10d3968ef64e08a18006da9160d068fe940fc5a36672da6aa69bbc24cf774ea10e7f30f98fb6cdda67ea702877cee8d570aa761b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "88"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "93"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "96"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "117"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "103"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "104"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "108"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "99"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "102"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "101"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "109"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "89"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "91"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "98"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "86"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "103"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "119"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\ = "118"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\telegra.ph\Total = "108"	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4756	iexplore.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4756	iexplore.exe
4756	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2340	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2232	4756	iexplore.exe	85
PID 4756 wrote to memory of 2232	4756	iexplore.exe	85
PID 4756 wrote to memory of 2232	4756	iexplore.exe	85
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 4992 wrote to memory of 2340	4992	firefox.exe	98
PID 2340 wrote to memory of 3508	2340	firefox.exe	99
PID 2340 wrote to memory of 3508	2340	firefox.exe	99
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100
PID 2340 wrote to memory of 1728	2340	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://telegra.ph/New-Soft-2023-02-142%20PASSWORD:%2020232
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4756 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.0.1439920806\331513829" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20812 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e280c0-b6b9-4e31-92cb-129de1b300c7} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 1944 218d14ed358 gpu
    3⤵
    PID:3508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.1.1827296898\764485866" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20848 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {611ab0ff-797a-4bc5-ab1f-f4ad858403bd} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 2316 218c4772558 socket
    3⤵
    - Checks processor information in registry
    PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.2.1630422227\1435405885" -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 3044 -prefsLen 20931 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48e8eae1-1cde-41b0-aa73-09d00f01d457} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 2788 218d53d3e58 tab
    3⤵
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.3.650521307\348948511" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3548 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4d1caa8-c05b-499b-9159-9081e5545b7e} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 2484 218d3d17258 tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.4.1349178255\338895301" -childID 3 -isForBrowser -prefsHandle 4240 -prefMapHandle 4236 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a35f8987-7088-44eb-ad2f-9a01bcb5f781} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 4248 218d69a8358 tab
    3⤵
    PID:1508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.5.1339203808\687602219" -childID 4 -isForBrowser -prefsHandle 4748 -prefMapHandle 4368 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30e0a174-7e92-4ed9-af52-b486c1dfe64e} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 4656 218d14eeb58 tab
    3⤵
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.6.401598484\942333218" -childID 5 -isForBrowser -prefsHandle 4720 -prefMapHandle 4636 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88bdf3d5-4fa3-469e-b90c-d1105c6123dd} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 4768 218d563c958 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.7.1369274123\1430128793" -childID 6 -isForBrowser -prefsHandle 5192 -prefMapHandle 3364 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e21511d-cc63-4528-8efb-e7420da5193c} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 5300 218d19deb58 tab
    3⤵
    PID:4348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2340.8.1291588156\804243990" -childID 7 -isForBrowser -prefsHandle 5312 -prefMapHandle 5308 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e518b4fe-980d-457a-bd79-a360911ddfe7} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 5320 218d19e0358 tab
    3⤵
    PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
14c5e436db29ac7db9301c7374ade89b

SHA1
1edbc68541a9f7fcee30b0128b50e8ff551a4a04

SHA256
3aa77b97fbf0ad97b71967f6324c99f34217026515d4d6583af5705c514e89d5

SHA512
16214d49c04a0bef7165ba36f98262d78b1600bb4afdf82f004d04f302692f28c3bfe457be36da5fc62c7a27a8b3d94073d2d8069a3aa506cd40f85574e4724a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
c03831458ac12a7894338d3a9c83deb3

SHA1
39ff14a5e662ffb151f28f774ed12027432e87e1

SHA256
c188983f04510544bc9fd921618a9d62d1617858682695c8f3d4f0f82c02cbe6

SHA512
11a7a82de67a01237b48a273eef181b63b400978119acacbf7591cfc7b184b61833ba9d3f8911e4df2ef31a97a18b147d0a3a407f716c5cd29d6bd0780f49cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\A266VW49\telegra[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q7s3h6i\imagestore.dat

Filesize
290B

MD5
763c4f9808d5000ae6201192bcf241b0

SHA1
6a582b9a93d4c370c1d9e13d78fc26f0c7c7859d

SHA256
6f63212ce28dac090e18754ff0599826c28ad102529bd9c6f14a63fd507d2311

SHA512
967e0514e1333e30de9688d53b63379865e658e3cdfa845c2d3428235367b437121de3cd25c6d241dca941a641d677131b6fd7377c912145736ed12593046025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\autosize.min[1].js

Filesize
3KB

MD5
bd4f179f94d68ec0999348ff53afe2c0

SHA1
e7a0816561e5a62f97c6f7c1e5b5d9af60ccb2b0

SHA256
ad0f0ffdcd62a3c1918dd0e51b06f52be8941a74bd6702cf9708752a90bfd36c

SHA512
9552af023d1af4a8115e2324d99762cb105cf381b757a66894da554cb7675657cf05ead29a94e24e4dc0690f5006525375c39933251265ceeb9e3a6f99adf044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\core.min[1].css

Filesize
230KB

MD5
97f8260e2fc321a619d66fd10bb8796e

SHA1
38e66bbb11748d7a469c2f35dc14526e6386f020

SHA256
976c89984ca0224c0f9ecc1bdedd1f82d34a7d7b14826491837d0d1cb1275f01

SHA512
2b2f21ef6ffc55e08499ad1328b50e3cbfac51d91d4c00c4c284797493c5b6b86fb47268c107ff614d583f1fa9f20b2e01a2248aa2241e41d4712f916fb1928d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\load-image.all.min[1].js

Filesize
16KB

MD5
f983dbf664d416edff89057d892e2bb5

SHA1
0f6eab722ffeda3a62e62151edeff15a07c3ced4

SHA256
24923cb2ac81afe909f228d38891f3ddbdb64b0374cc821585975d1ed1e20370

SHA512
ec6acfed6f81df0ec4db68115a10b9c56f5d6ee0932ba7525ab756cf870e50ab888701231d05e21c5a2a480f13a6d3f46a9b75fa24781ac534cfaa7f77f7cd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\quill.min[1].js

Filesize
197KB

MD5
c46aaef8261c47139766dd35428aaf31

SHA1
e620838abb67bb85e26e6c69f6dba176239ff8fc

SHA256
5ae14ad66b01a78b21928513355532e579cb7e3a230f9396f30125a04bf4a6ec

SHA512
cccca951baa49ebad7e3458960e2ff74b3a99ff695cc08a886dbcb97a550a3d45a81496433100fcb2efbfd0faf5b6f42db772ee354fc896393169df8f5f8c43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K941J8ND\_websync_[1].js

Filesize
5B

MD5
33c7f42d99cf0bb6f4d4ddfc819febf1

SHA1
027cf9b3d545d46ff7cecd0669c8e411440423c5

SHA256
3544fbb65b848dd24192ba608359e02cadd6ff8aa3d2175c6f5a4d3c23afccd3

SHA512
6648be4d935dd772b78cfae07aa34a6396380a3de7c1de3fe0b1f068363bf3d49b26ffb641174e8676783b182095ac332270bb7bf344813ae34db139b2376cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K941J8ND\core.min[1].js

Filesize
49KB

MD5
e2ac497da42654175d05618cde626143

SHA1
edffeb9daec07424997cd4d6f629c0f5212cf7b7

SHA256
edcabde89b7cbfe2267bd113a78a2136b7909e8fca55c23a7e68e152074fd290

SHA512
736edf740f5e7dbc65e61d1c62e4d2836dff9f8cc2774c9ce1ffdeedd94eb817b68917dab4ffb21f6390d4a994d5ad3d69cf6b20901c04ab25acee5843efb6e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K941J8ND\quill.core.min[1].css

Filesize
7KB

MD5
c109c41150b8c3feb5cf8e349a6b05a4

SHA1
fe462d4f8a16e9ffb37f733c214befc1b807e17f

SHA256
2d8806a9454f45e2c653e351411dcc6466d613ae1bbd9c44d3a31e052c5e511c

SHA512
2e8596495cfe5093bf66c70d62c04f932e4d0679303b3304fbfd6b18fc5c3ae40b54a802c23ed8127f1a7c941d234c309471d01b980ba5fdbc87ba47f52cf88e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K941J8ND\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\favicon[1].png

Filesize
166B

MD5
91169aa7638bd8b8d898dadc4d0d0dd9

SHA1
817e5c6bb48ea41ac6eb061c70ab1e895f294239

SHA256
2f2f4f03b4f5bacdde4c08482b99d0a4e418c280c6c1ada8c724b3a48e24609f

SHA512
bdef44ce6ab197f022b75534fe40a9a40a29cc451523dd0f2d134740726ee0f9f87d5ec363d49c279e5e56c19fd70d944e84d21f07315e4cd2babd71581e7c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\jquery.selection.min[1].js

Filesize
2KB

MD5
485340bf60de255d917b74218669d9c5

SHA1
5bfa17a6e88faa54c7c29f4ef1a1ccc3d80e1175

SHA256
e8a9bc2271729e7078ae34f415d174765fafa7045593d270adcdd364b529ac08

SHA512
27558ffcc917334e65f77e07f11354aab27266c5cfc6267d7f120f6e2a69a1868ea7af4ca3bd7c56fe357809eac1856a5c9208b1c42c96f8459f5de8528ccd2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y624AVVJ\jquery.min[1].js

Filesize
93KB

MD5
8101d596b2b8fa35fe3a634ea342d7c3

SHA1
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd

SHA256
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

SHA512
9e1634eb02ab6acdfd95bf6544eefa278dfdec21f55e94522df2c949fb537a8dfeab6bcfecf69e6c82c7f53a87f864699ce85f0068ee60c56655339927eebcdb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\activity-stream.discovery_stream.json.tmp

Filesize
160KB

MD5
edc156f0c3bd8dfdb4d293f2e75d3b2d

SHA1
8448ec10175c781a7d74131a1fb3f1f54b8ddfe0

SHA256
75a7be20966d21dbecd7bd766d61136bdb6685e0b7764c2b5e7d6db7081dec39

SHA512
f8844bee07ceb68191aa03825548ac57bc782e09b2f63004ce7b3797210620cac184cc7edcda094e017885314f58771e82236d3f476da8cad58aac62b711aa6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\datF6CC.tmp

Filesize
27KB

MD5
50f4325b6fdab7b63d1f12399a50b4e8

SHA1
2835dd8303a4a945690679082ab70a96159bc14c

SHA256
53e62aea15e58d342e737f4a769819258968a39bcee433432fe1ae7bf4776a3d

SHA512
a12d8f5a94e23aa6acff64f0ccd19a9b75202d5bd25dd6d6ae529b155f37351bd9f0a3289c067af9678a78f2087f70b63afc8450172ff25ed0805ef5dfccc613

Download Submit
C:\Users\Admin\AppData\Local\Temp\datF6DC.tmp

Filesize
27KB

MD5
6b39c3bc9dd0b080cd10337e0131c801

SHA1
d104af8f119459a8a5a5d4a19a93b2cd701f6f48

SHA256
4ce374a48ba0dba1231039953c1d43eb6fd8a64c48fef6b0f1b058c1e06adde4

SHA512
c05cc9dc426f96797b625e9564d86b79b2ef0bb06c56c11492fc8b3f6e79b6eebaf0659c8b1fbdaeed5c3421b8dc02876796828f8993c03157d1d5915be64b09

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
26b66e50d0a033ef60170f6b81f354a3

SHA1
3b05e6bc2ce4b67f22a34c941282a879167e4846

SHA256
a70e69b94a14b648516eece74ceb6f7b6c66ceb686882b2129517536aac8ac6d

SHA512
693b459c468db0127843d8dc731227f428788f419801c6fae67e6996490146adc2b31beaca1f9325b4db741273cf0e3a613085e7c645e15065168d2c4963e4f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
ee5baabb5cf7f40dec7463069ee48514

SHA1
c9b4ab0712db6a093eca67f0455b60c349991310

SHA256
dbb43c531fc7743d27e3c9971b6b34999b929266f454c5b210223a2102829dea

SHA512
f530bff6dc173463999839f9641e568ac2816d4bf73ffc41646f20ede0deff4f6ce5fadc9f8519fa669893fe65ffec98eb7098c5b7fdc49ad872bc46b5393aae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs.js

Filesize
6KB

MD5
9971fa8fa89a208685d3e30835832fb5

SHA1
5d9972a3bdbd4c18b3648597d2fd9f9fd6e30300

SHA256
13417a67a65fecc73ad5acc94d17d8a6fac3b0a343daf12d1cd2d126b9198084

SHA512
02b107e0d9449fa2d4d3655a880fbdeea4477205fa6c21aaf641c3d358353aa437cf040ec842107f973253bef767e48b9a0267dea5ed2d331aa192ef540e3b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
975a44c747bdb55a658f33d120b06195

SHA1
80e03ed6bf7ba91e9cef81cf7705493998054444

SHA256
007794756a44c07f23bd0f2ae5e1f1ad1b5211afda415aeaeebbf9ec26f988b0

SHA512
b431e7887e47f568032eaa1a92fe2d53d9f8d3d1a2bf1b2743ced6e1fab7ef80c467200052fd64178aa20a0e415a3cd842f20cd8de9a5d9f47ed13594202ad37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
94136107004347ac3870a82beab6401f

SHA1
1bd60a733b3f66c1958189039a3b291f830dc296

SHA256
9ec8beb27913b743ac7fad9424c9717e678269759d137a2eb565b4b5dc44ac97

SHA512
63c07ebb0854450faa04533cb0a4fbcfc08c4f395493485487b42b988830fb592d2cef13f6491f9051fe903096a0322af8b7e8963d562a725e36b479fc688f6c

Download Submit