18ebd9b18169a44b962b85823ff8b3f0c89893124fef76d49a32d549ca87a6c3

Resubmissions

22/05/2023, 15:51

230522-tasw6shd57 5

22/05/2023, 15:46

230522-s71slshd38 5

Analysis

max time kernel
570s
max time network
570s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
22/05/2023, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

G_768916 (1).rar
Size

8.2MB
MD5

e9775d944eddde92787307f5e2523c2c
SHA1

176b83a3a60615bb01914c60467839b50346636c
SHA256

18ebd9b18169a44b962b85823ff8b3f0c89893124fef76d49a32d549ca87a6c3
SHA512

01c40c4d2726778b5f76fb6d4a5bb18fc73da274d10213b389c9e5e5d6cfdb27596c009f1c1919c6d13f5ba9a783c322655cb9f921a89703b9c80af17dfb8130
SSDEEP

196608:lBJ/X/1ZpzHOrThHyst/6it2wNh5kwh+abz:lBZX/RgThYit2UIwvbz

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\INF\netsstpa.PNF	svchost.exe
File created	C:\Windows\INF\netrasa.PNF	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3808	WINWORD.EXE
3808	WINWORD.EXE

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
628	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeShutdownPrivilege	3176	svchost.exe
Token: SeCreatePagefilePrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	svchost.exe
Token: SeLoadDriverPrivilege	3176	Process not Found
Token: SeLoadDriverPrivilege	3176	Process not Found
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5108	OpenWith.exe
5108	OpenWith.exe
5108	OpenWith.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
3808	WINWORD.EXE
3808	WINWORD.EXE
3808	WINWORD.EXE
3808	WINWORD.EXE
3808	WINWORD.EXE
3808	WINWORD.EXE
3808	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 4016 wrote to memory of 1088	4016	firefox.exe	70
PID 1088 wrote to memory of 4960	1088	firefox.exe	71
PID 1088 wrote to memory of 4960	1088	firefox.exe	71
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 5048	1088	firefox.exe	72
PID 1088 wrote to memory of 4592	1088	firefox.exe	73
PID 1088 wrote to memory of 4592	1088	firefox.exe	73
PID 1088 wrote to memory of 4592	1088	firefox.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\G_768916 (1).rar"
1⤵
- Modifies registry class
PID:4268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.0.492211776\592136480" -parentBuildID 20221007134813 -prefsHandle 1636 -prefMapHandle 1628 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {508089ed-ee89-4691-9565-caba0ba6f1a2} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 1716 1d2562ebb58 gpu
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.1.2011005677\878006100" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2044 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2d58257-c83a-4646-9479-e4d500d7721b} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2072 1d25620e558 socket
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.2.458740075\605981031" -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3056 -prefsLen 21117 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de6c632c-2f53-4bd0-ac32-f8b8df29e954} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2664 1d25a14a558 tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.3.1908339948\152582267" -childID 2 -isForBrowser -prefsHandle 3096 -prefMapHandle 3136 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9c19432-4d2c-4828-a24b-625b1bef6424} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 3112 1d25b022558 tab
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.4.121823048\1679793875" -childID 3 -isForBrowser -prefsHandle 4024 -prefMapHandle 4020 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94063414-360d-4cc2-9533-fecb2fc94748} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 4040 1d25ba3b558 tab
    3⤵
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.5.96780650\1498776688" -childID 4 -isForBrowser -prefsHandle 2468 -prefMapHandle 4700 -prefsLen 26700 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f608e8a4-5cc4-46a5-8bef-0d24b24893b6} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 4020 1d25c930a58 tab
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.7.1851490463\244976747" -childID 6 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26700 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51079faa-f62e-4084-b986-2a066f0ecf1b} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 4020 1d25d255858 tab
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.6.316827289\2075777838" -childID 5 -isForBrowser -prefsHandle 4912 -prefMapHandle 4916 -prefsLen 26700 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f0faf3a-0338-42dd-bf82-3d70ed5ff997} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 4904 1d25c931058 tab
    3⤵
    PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1088.8.1616290103\514819637" -childID 7 -isForBrowser -prefsHandle 5820 -prefMapHandle 5816 -prefsLen 27302 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d58ae8ec-d2ef-47ae-b135-10c218c842ed} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 5828 1d25c930158 tab
    3⤵
    PID:2824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2652

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3808

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:4100

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
1⤵
PID:3256

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s SstpSvc
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3736

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3176

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\evlzgz75.default-release\activity-stream.discovery_stream.json.tmp

Filesize
144KB

MD5
6adacfe9da1a10e350b0153281a5c8c2

SHA1
c5af943abd2cfee8b30a919e80d86610617214d9

SHA256
3de9663cb83471f6c5bae0c67943024715f62fe35e4711bfbd3bf77b543bcba4

SHA512
f590e1d8e0760b34ffb119d031d200ca223d97ea3f4132faf63824b3d13d6ee7838a814a1615d97723c9b1451cc3af694162cdec146db003cf8e3a128737e746

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\evlzgz75.default-release\cache2\doomed\6752

Filesize
9KB

MD5
1f7a9f1579781dcca1d52f5f6da8e873

SHA1
d50991a95553efabf67e3c8accffc512a32cd397

SHA256
7c2838895e94a3ffb2704b3bdaf5e1af5aca994701b23d19aa924be906052ef4

SHA512
7c8f3cb4738759a22c20c2e4ad78c08ee79e0a967b65356e8ec35a0a869445dc45fc6b8b21deac0a5c6e200b7754941f3561f63ae91a8a98a52580272afc4f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
224B

MD5
e66d36cbcfd69fdf8db6e5c649137ef1

SHA1
c1ce08cca33347fe58f95f78f61c31ac6501f511

SHA256
15376656ff62df570727bcac73caf451fbe0599729bb4bf648b5e65b3e97f5f4

SHA512
78a8c44885ce2f1a035a3075a50027d6eff5c1adbc4d4d134880b1aced5e5d0f70fb6ca8cb037327ec4890a392b3be84eb85c72f38d4cfac985afab64b7c81bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
8e3b89aff5cc88b8122b1fd8b2287d89

SHA1
6fee0a094d4d27c46e603d68d157bea4866ff980

SHA256
991265cd066634ad2334f63899c2b85b68cb08da5b72bd310939c04a7155108d

SHA512
b49bcd5dc560ec6ae5c3fb86067330a3f9b4caf24a7c78d92e1ec6569de62da741fe6d353e240ae9181ce9f26f7bf369ef60e82dfd298b410435709fc323e3ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
68760c9c17d4c472713f0ac3e70c11b4

SHA1
f6e589a80f12c3f367bf6eaa48a09f2a2658cb0f

SHA256
db7779b26d07ffaf9c33e7e5232b05360ed78797b8a044fac336600a07bfa90d

SHA512
aab4091c43df791f6846a818d81136219dd4b97f02a71b8a7b42227655bf6f312dfef84e6e9bece37f57dcf38099b4aca7770c1c3fee4b188748fbd02f1e4800

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\bookmarkbackups\bookmarks-2023-05-22_11_yyzQT6zYKGzzlFbJAldNzg==.jsonlz4

Filesize
944B

MD5
6e888dd6fcaf9594a8c4264b6803875b

SHA1
b2437376c810d15fd5bab09673a2d2ede1c088bd

SHA256
26e32f944b43b35bb48ccab93e4b9e63d490da27e0f8c26afe10a193a21b03e1

SHA512
cc88f691a29b9a30abaed808025cfbccaa251a2d71b32fccac292930142f0b8450cfd2e4a14a6e65fd7d3f4dee562bcde642648e0affe0763b08d34c1f699a84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\cert9.db

Filesize
224KB

MD5
98aa0be3d2bead5acce5b5bcebd84cc6

SHA1
08537ceccf16c2d061a2d4ff6e86fd550b934245

SHA256
4da9e30c959a3fdf22782b6cd2bfd2fe6dd87eb6a89b0562a8372e26e61c4197

SHA512
7a2ffbfd3e9a509e0a4a977d2e3c438ae725b3a0219de374ce29f7ad146153b618a89b00677b66ec6f05040935dac677b22ee71f430ef401dadefc5eb145e17b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\prefs.js

Filesize
6KB

MD5
f843fc3b858888d342076c7199266348

SHA1
97dea7b7d8486f03cc085ef488fda80fe53515a0

SHA256
19b6e95d7e0e109333b648d994d42f1f8552467f8f43a4570f84dc5c5e2189a4

SHA512
9b25cfb2a279bda5827e7d4c3446c75cb5057e7a886e23b7f3eb44d3a2fbb04d19249ff423c821cc41ea7a6d8585fafb0b4f9ae8d54274883250c4a4a1c7c1f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f733828da17f384d1ae15f1188303e05

SHA1
adfdac6a3bd69873744efe50b33ff7a8ef110d37

SHA256
0d121cd1e8abe00dab653d900583900a9eb1136cf7298fece9d2f040363a0996

SHA512
cc769184614454ee90d9366e34b68b706e6962889b67641ef2a0caf220f3115a083c998dfb3a8f62c4eea3e53ef12f8abf2245998fac16551b9a3332e4515aee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
6c9b4c4caba9f6760b4cd1ff1283ddef

SHA1
c9f741cdef9373026e6afb12d20cb307cea24be2

SHA256
d8547858824a7fbc37f45a80986fb7e525a579fb81322da645aeca75fa2bc54f

SHA512
af90713955cf948a0d7a685487deec02b5ca56e2c619f2d23cfa13af752052f042beec2eac662e46710167bb306451aeb7685765ee343d1605cf952aaadc59d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\evlzgz75.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
9fd9798429ef6ec3a8ea8581e77c30a3

SHA1
a1dd9a4874ccb21e1a78f671d7a262e00f3a9e17

SHA256
20be3aae1dec5f235bcb76e96da0d33340a3fe6314f4a077e6c4cb103e8b7c58

SHA512
4d1bc60a479b95fe20df1ae3c1fb050345301056ac28c97f780656c01420fbdf71557c243380559926abb20a07caf2ec1860f9ec914ec1cc9510c78ad5adb618

Download Submit
C:\Windows\INF\netrasa.PNF

Filesize
22KB

MD5
80648b43d233468718d717d10187b68d

SHA1
a1736e8f0e408ce705722ce097d1adb24ebffc45

SHA256
8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

SHA512
eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

Download Submit
C:\Windows\INF\netsstpa.PNF

Filesize
6KB

MD5
01e21456e8000bab92907eec3b3aeea9

SHA1
39b34fe438352f7b095e24c89968fca48b8ce11c

SHA256
35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

SHA512
9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

Download Submit
memory/3808-1706-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-2005-0x0000026C23130000-0x0000026C2315F000-memory.dmp

Filesize
188KB

Download
memory/3808-2002-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-2004-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-2003-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-2001-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-1720-0x00007FF9A18B0000-0x00007FF9A18C0000-memory.dmp

Filesize
64KB

Download
memory/3808-1715-0x00007FF9A18B0000-0x00007FF9A18C0000-memory.dmp

Filesize
64KB

Download
memory/3808-1705-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-1704-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download
memory/3808-1703-0x00007FF9A4B00000-0x00007FF9A4B10000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads