hxxps://hostg[.]xyz/

Analysis

max time kernel
69s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hostg.xyz/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = aaf7e3ade092d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D62BA619-FED3-11ED-9EF6-6201C35E5273} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2869490598"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31036128"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b6a7b4e092d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31036128"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2879490332"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ed1e4f342d7b9479ed0d9f8abae838e00000000020000000000106600000001000020000000089038000f74799447871db532bb0574aac389d11756220a7ab5633dd2bb2b8b000000000e8000000002000020000000d0070a6afd0676cb66863ae1b05e2f731a1dd1aa37e5c88dffad8f46f1d7f3f520000000f3302e7ebd761e245609e012707662e286951054a9e660e442da9ada28591c5140000000030ae3f6511f07599d5250c05d67f28dd6bf3a646717ab48f2726ce55f7cf120659cd59fa215be67176782ae4158f756b2c70a875429f806b14ef865225b9558	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "http://hostg.xyz/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ed1e4f342d7b9479ed0d9f8abae838e0000000002000000000010660000000100002000000079d8ef63c2fe48a75d96f5764aed9569e0451a7653ddebc183a6d14e904448b4000000000e8000000002000020000000dad8e64baf47c8dc9c1fbef6beb6d08270a82c5cb1103b939f6050f671ba8f94200000005983eb9e22e57bac65b41dc2a4cd419cbae1dcc14fe0d1ddaf2d92c0b20f358c40000000402367705e0edaa4eb7fe711dfa346ae6b6d51034bbdb7fed46afb64c7224a6a5500e08442ba39ce032f8b01df5a3cba519abcecf2ffe52d000b57788622aeb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31036128"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2869490598"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07b8bb4e092d901	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	firefox.exe
Token: SeDebugPrivilege	5080	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2220	iexplore.exe
5080	firefox.exe
5080	firefox.exe
5080	firefox.exe
5080	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5080	firefox.exe
5080	firefox.exe
5080	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
2220	iexplore.exe
5080	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1880	2220	iexplore.exe	84
PID 2220 wrote to memory of 1880	2220	iexplore.exe	84
PID 2220 wrote to memory of 1880	2220	iexplore.exe	84
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 2760 wrote to memory of 5080	2760	firefox.exe	95
PID 5080 wrote to memory of 4624	5080	firefox.exe	96
PID 5080 wrote to memory of 4624	5080	firefox.exe	96
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97
PID 5080 wrote to memory of 4148	5080	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://hostg.xyz/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1880

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.0.1344865957\1408455621" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1736 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {818bbf3c-a132-41ba-95a8-22e9aca455aa} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 1952 1478a117158 gpu
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.1.757448676\1098212886" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4958de24-d49a-4cf0-ab98-e009e1dbc635} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 2316 1478a653b58 socket
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.2.2108991211\2018976523" -childID 1 -isForBrowser -prefsHandle 3144 -prefMapHandle 2924 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {242f4b64-55ae-4748-8567-7b5759c9f4ba} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 2720 147ff890958 tab
    3⤵
    PID:3992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.3.327998204\710364123" -childID 2 -isForBrowser -prefsHandle 3396 -prefMapHandle 3404 -prefsLen 21115 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8897cb05-c04b-410a-9d85-71b31033e5a8} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 3056 147ff825858 tab
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.4.1110117751\84780469" -childID 3 -isForBrowser -prefsHandle 3524 -prefMapHandle 3528 -prefsLen 21115 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {703c8c3e-7688-401f-8bbe-b63a41a9f1b7} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 3036 147ff826758 tab
    3⤵
    PID:2740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.5.1716074633\480747462" -childID 4 -isForBrowser -prefsHandle 3716 -prefMapHandle 3720 -prefsLen 21115 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e882ee70-7754-4ff4-84c2-8b84f6a95d5a} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 3800 147ff825e58 tab
    3⤵
    PID:788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.6.541596066\1330109522" -childID 5 -isForBrowser -prefsHandle 4704 -prefMapHandle 4700 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43efd4d3-dda6-4463-bf11-b962c7c89755} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 4708 1478e827b58 tab
    3⤵
    PID:3816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5080.7.439912456\1834276014" -childID 6 -isForBrowser -prefsHandle 5128 -prefMapHandle 5156 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dff4a8e7-d5d1-4025-bfda-84c3ecdd5a10} 5080 "\\.\pipe\gecko-crash-server-pipe.5080" 5192 1478cad4558 tab
    3⤵
    PID:404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
78e9b4e882c43acc881d686739d07f2d

SHA1
4e6cdb6d30eb906b050697ee001d0d2205e442b9

SHA256
c1358626993d7c983bfaccf9759a8a66fd58cb66710d6af0ffe4f187178ddb91

SHA512
ca301a71f7e6c85f1fb2e7af0cb3eac48daaa184ce6c01b4209e62ee9958a293eb3276713acbbdbe74fcb989262c31e6719e5c0a6bf53684ed45dcfc231847c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
b7111a5fd0448bd726c2745b7d064f13

SHA1
e3d0314bb5905b93570d3942d8ad9a341601aef3

SHA256
c06f228e048fc396f0c86ee94ee6b08b9d3207a37d5ebea899e2d03d11e0bab4

SHA512
a6f396d90de0aeb1f78920a92e0342e9605bacff7a75a05d764c63009b9a6f19357e073927ae3c41b2b7418c7b51cc18127f321f2142fbdb298d119991815740

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\activity-stream.discovery_stream.json.tmp

Filesize
140KB

MD5
e39a3bccb69c8ced6dbe67d22a06ee1c

SHA1
0e8eb539ea5e6f734744178015d2e1a0658fe87c

SHA256
897102303a4c5ec0347d40d1bf810c14768a0b208f072a8721383c04a5323970

SHA512
52dce9c0130d7b743be7de0989a87ced11adcb3dc37ab33085292451b9cfb743a7fbeda5dac4feae78029c756355ef1c8c3e9b5652650b49495ae864f8d2a072

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF0DAC042678A85707.TMP

Filesize
16KB

MD5
7da0b8b343dc671b49a136edacf20bc6

SHA1
55f73674325c899c62067511d6e6cddfd5d6b161

SHA256
480af318f36fdf5aab2a56105c66ff4f3a6bc231c0d521f345eafc3c9eff5388

SHA512
899dc9fd5f3f47beec694add359e1f2eeb0ef11409267aec33efa536728d54a085d1b20c43ff49e34b08ce5f950b136900896afa4b3a628bb1d4a1cfc5fb487c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
9d43a88abc5e2794feb303be756678f0

SHA1
5c2935d8fbe3f5f93fd41ec591d5cbe73fd210d4

SHA256
69c2426c67260cda6a6d72c9e69bb0375356022f0ace487672eebdf92a3878e6

SHA512
24ead49a7ef390233149368495e3a5e2ed2fbc3e31f1a61c9d8246708862255c52140f38dc425ae1556d3b1df0513d764f94c3f64d097a99b639e0763db6f516

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
6cef27eea66db27826fe0603070c6101

SHA1
5abe032b644922c8b05051d587dba18b746b1bf3

SHA256
f28ac0b7aa1b166ecca30b59173f5c30e291191b30553740d6424eee6b200a03

SHA512
d9d9725eacbb84d337c2d9c44e64d34b96b3658403e29697deb05b19cbcd803a085e89b61981e7f6001f189900b1d15d36caa841baf98bf66fef9513d5c72897

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
0d753b2df6ef00f98eeab0c884804f96

SHA1
9a17be48a280e5370db1e9cfad8f9652c518934d

SHA256
d45687fbe0c6c4a368b1ec4c9f114be099a2624520d00f85135cbe500ea86f06

SHA512
f2aa6be0b4248d62f33617ec94ec6ca3df8be31b7d950ac78b63fe2f9f083c9618d01886d5e2b46f36ff6797398aed85a486db16095f60ab91c677cf4e2bec2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
7aec1858d6cedfed8f4a47d9f1ca4503

SHA1
d55f035b0d4d3990c0f105bc63682f1f1941d712

SHA256
0e048a7445497a1f1f7f281734a1c2ed0ee4b45659f90dd57b37eb7f890c4d33

SHA512
c78418dcadb31be41344a641859a95f9a180e3aa40c8d661124485a7cd4d06e59cda8d6c02d04535bb7d9366661d0fe5d15b3d60d43d793944957c064c9f8dd5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
f13ec5021e02518ba050da2efb70b7df

SHA1
1a49ceb1a28af49c94fa8831fb3167452bc6965a

SHA256
a6dc7f7ea25e46d8c860a76cfc770aba518090f2c6a3e3b0332c424a9049c4a3

SHA512
3e8f96b4173df3ff1f167fa5d20479c4b895fb871e042f42420014986696e5637498b181dc767c8d23940fdeb6b520b4c4295fdb7fcefc42e9943264380bddb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs.js

Filesize
6KB

MD5
feb8a52858c8167a58f36caa1b37f116

SHA1
7ae7f9d2721ae3c579f9e18e4fea679e8c848158

SHA256
adbc4c7b5e775c3d401ae811d5be5a69b844f5937e3d0a416d374dd5a7ec227a

SHA512
109d42ec5b9744b3561d29a9cabdcf2ffb81233935fa5c2d80c39f27b92ae55366c3c51ae3d26cc1a8936635662acbd11af89e54efac374aceaa279f13e7dc16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f65dd19e43ce92d301134273fa3db7af

SHA1
491d3cb624a60a2c0d4f1c79bdaa3d1f0f760ed7

SHA256
44f4c1f91c8787d597e35891161cb928046696e68b0385c2aefa689c8a4de49d

SHA512
469d1a64df5ab81d8839e85522b051c35716d18ddd2e59ccb3d4dc46e8e522effc6565ff57dd436bb8b3f85b29819f7192875c542cb902e3a986c08d5a7c202d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
8dc8a5e0ccacbcd4197a67c4dd85cd39

SHA1
96de21439bb20cfcb0d583ab690e0dc109df6aaa

SHA256
da326a2605c268817c1ccac43d8e6b6664f37a91586843ee081152a8b380c312

SHA512
ac476b01ee9bfdc6d56ae2317f2c04a3379d73871250aa9ffef126d918a2a34b98c45a0b415f9a2fa75f2ec3a5dcc10893abdfa44ff476d6bad8c6d002a9f946

Download Submit