639bf66106f578e5b7bb31ee5786c3e5788b13353314db6eab74d9f365d9c590

Resubmissions

12-05-2023 11:43

230512-nvjw4sch74 5

12-05-2023 10:57

230512-m2bzeacg59 10

Analysis

max time kernel
20s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2023 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SCI_1022117443_3102810.pdf
Size

680KB
MD5

ac4255be6fae0c5ccb0598bc10fce105
SHA1

1a29f996d5ffe867578e32f3a640c8d0a696f011
SHA256

639bf66106f578e5b7bb31ee5786c3e5788b13353314db6eab74d9f365d9c590
SHA512

77ba86cb420596161421c10b9137014e5a738312c5614d15697f7cb2471a4b6724d4a7204e573a6c5bd3483abc032ec5574e6d97242dc682feb248de815da10d
SSDEEP

12288:xYM5yMxbT9qBsRPeT9S84fCs3Yy3gIa/0AFBu+xD6SuB0wkPCYBhxngXJ1WY5:xGMxbzPeTo7f3Ba/0+u+xDuGX5hlgHL5

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	firefox.exe
Token: SeDebugPrivilege	2836	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4872	AcroRd32.exe
2836	firefox.exe
2836	firefox.exe
2836	firefox.exe
2836	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2836	firefox.exe
2836	firefox.exe
2836	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
4872	AcroRd32.exe
2836	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1032	4872	AcroRd32.exe	88
PID 4872 wrote to memory of 1032	4872	AcroRd32.exe	88
PID 4872 wrote to memory of 1032	4872	AcroRd32.exe	88
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 872	1032	RdrCEF.exe	90
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91
PID 1032 wrote to memory of 3424	1032	RdrCEF.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SCI_1022117443_3102810.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2EE608097F6BE09FAF9B6C265E0990E9 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=09185D1ADE116023AEE32B7B9FBF0EA9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=09185D1ADE116023AEE32B7B9FBF0EA9 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=023B5B7970D4AF3B7B27B8E41B7D3041 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=023B5B7970D4AF3B7B27B8E41B7D3041 --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=025223CB60F13E65D7EB083FF8C452D0 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1168
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ADDC9603E7EFF28216681CEEE0CCCD3C --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:448
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.0.367843534\1500871043" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ace83a59-c836-4a28-b5b1-84163cef7d6c} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 1916 1930d3e4558 gpu
    3⤵
    PID:2800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.1.787593330\2077218996" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {699032c8-d8b2-4ea3-898f-b1520c91e30a} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 2316 19300471958 socket
    3⤵
    PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.2.1625828837\1466287991" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 2728 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30a80b16-34a7-4f25-a065-c2d65fcb585b} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 3120 1930d379b58 tab
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.3.1146544947\1881157988" -childID 2 -isForBrowser -prefsHandle 3548 -prefMapHandle 3560 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef585a9e-6ed7-46c7-85f1-c6edf4ffd8ab} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 3528 19300468758 tab
    3⤵
    PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.4.1436450373\1834662702" -childID 3 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a522a930-47db-4650-aeba-ad2b560c95de} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 3836 19311e1f158 tab
    3⤵
    PID:456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.5.2133444782\1711192950" -childID 4 -isForBrowser -prefsHandle 3008 -prefMapHandle 4800 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d25652e6-180c-4591-8fa7-7d65ec0f2626} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 4880 19312aae258 tab
    3⤵
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.7.1352258896\1740503851" -childID 6 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d6f1899-16d1-44bc-9115-2856c3d87fa2} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 5348 193137c2358 tab
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.6.1369892237\732165220" -childID 5 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be3f1775-c098-4e97-9029-f35ae541dec2} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 5160 193137c3558 tab
    3⤵
    PID:4564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yz6mdvpx.default-release\activity-stream.discovery_stream.json.tmp

Filesize
148KB

MD5
76d99bceb50284dbae22502daaae2b4a

SHA1
263d62ee5f67525a43650ff71ed78b40b8aad7b5

SHA256
3a9e82c00e676990577741a094bdd6d76cf11bb40d6416d3bf9881a017216fae

SHA512
9e69cb26c336258d55de521699ead080c5458af50edf273030e05eab2cb8581bc268009774ff86bcabac24504fbd2392b7e396ed9d85b21e22790b0aa6d59444

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz6mdvpx.default-release\prefs-1.js

Filesize
6KB

MD5
66f439b8f5a246d40a2839f98f01154f

SHA1
19d75b9cb548a992d09d13db099e66f59cb3de36

SHA256
a461f1c2e7a1033d52ad6f40fa1364dead250dc93b348c28c261803d12a067ec

SHA512
0893e4be912918286e63707b2b02ba1a2e65849c68c5c51f98e63f5ca2f9c854206c1de4d0d781f095c520ad208ffe20cbed5ba012356449652f0c8eca252f30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz6mdvpx.default-release\prefs.js

Filesize
6KB

MD5
2ca68eec3c1fdbaa1ae996ee759fc3c8

SHA1
54363409a7393613ff528d0488d1cc16796ef2d8

SHA256
4fe10ac0c622a99629804d64c89b59339a12a63ffb0b56132bfe39ec9b25aa1a

SHA512
e2fdc625ee7d3e54c1cca72810eccccc3f493253319dad56693d77904692830302564897d7d9c33b876f645bfcd1a5498be9be81bb18932e3333d00ca3408c12

Download Submit