hxxps://l[.]facebook[.]com/l[.]php?u=https%3A%2F%2Fbom[.]so%2FBJipjY%3Ffbclid%3DIwAR1t65x1_eWNh5L3Kj5lgERjLnH1-cJwFDzPOp-4PglJ3wfx8tVP7yT4bkI&h=AT1KLF97emXNUvodlzIPYeQd62STsbyQgEO3yR1EyBtR2X7bsCMWT4qdjGR2sr-eiKV3WRv0e_AHAjJqJS9qwgJJND-UWGKEm6QdfaplZM0ubD5Vawamxqv-WzO3epei8pATbt90XgEvP0OMa_zP&__tn__=-UK-R&c0=AT300gaUE-pSIbRVOl3ad8mxsg_OeddEafWlfXwAbuVeRJiJjglE9T39W_yh2PUtahd1ZnfHFYGRM0apPQTsDUOM_aYEraL_NxSZSeTAggoWdXjjF4yM1HHZRqFg8HsFeU6XKi69xmDoOWJeFvRHM4a5bYajrNS6SyNiLuIzEi2dCuw8lwFy3tmBSr_Kqx7MKiCS4eJqlbML

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://l.facebook.com/l.php?u=https%3A%2F%2Fbom.so%2FBJipjY%3Ffbclid%3DIwAR1t65x1_eWNh5L3Kj5lgERjLnH1-cJwFDzPOp-4PglJ3wfx8tVP7yT4bkI&h=AT1KLF97emXNUvodlzIPYeQd62STsbyQgEO3yR1EyBtR2X7bsCMWT4qdjGR2sr-eiKV3WRv0e_AHAjJqJS9qwgJJND-UWGKEm6QdfaplZM0ubD5Vawamxqv-WzO3epei8pATbt90XgEvP0OMa_zP&__tn__=-UK-R&c0=AT300gaUE-pSIbRVOl3ad8mxsg_OeddEafWlfXwAbuVeRJiJjglE9T39W_yh2PUtahd1ZnfHFYGRM0apPQTsDUOM_aYEraL_NxSZSeTAggoWdXjjF4yM1HHZRqFg8HsFeU6XKi69xmDoOWJeFvRHM4a5bYajrNS6SyNiLuIzEi2dCuw8lwFy3tmBSr_Kqx7MKiCS4eJqlbML

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042254"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5661CE66-16C1-11EE-85C3-5A9695CC9A3E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "719690629"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082e1c0dc4be3f54f8ffc5370cc661e5600000000020000000000106600000001000020000000be82d81d90e726a66146af88ef7a981608802c60d49c4975d23e2714d73d1297000000000e8000000002000020000000f87bb6b992a4a9501b1f4eac420bb700ba66ea393b8c9fd9a75dca8b79940d6520000000634f8a276c79616f21266ecdfb987cea353f98597682ad651dcf92f3f2441b304000000078d7778ecee78e16fd0b968a889909b6e9137a20533a8c8a8937b5307dfbf55fc3ff8acc96054dc6f42133500da34d92376aed2b5e6b51c959cfc0fc5ac9fc04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "719690629"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394837989"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "745337786"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3081d12dceaad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500bc82dceaad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042254"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082e1c0dc4be3f54f8ffc5370cc661e5600000000020000000000106600000001000020000000f962f909c9bfd3c98775aa6123248287314cff4882a1ccc336111921015b368e000000000e8000000002000020000000395815b3ba37c95e4e0219e0a3d1ad7d3835b493cf3d5d73096c7782c69c76b42000000017821f170cb932c34dc36d7abf109fb8afeed3f9a39e3c0f16f9fcf70d6777f04000000068cc75aeb698b32e15d6790f1d1ae5f4bdbb28e4fe4faa40a10cb1e9f377f1b0257693cabc4449f7fa8d4994c6b82bca94b695291c5958b9495c6161839208ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042254"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Smarttaskbar.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeRestorePrivilege	4256	7zG.exe
Token: 35	4256	7zG.exe
Token: SeSecurityPrivilege	4256	7zG.exe
Token: SeSecurityPrivilege	4256	7zG.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4960	iexplore.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4256	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4960	iexplore.exe
4960	iexplore.exe
4872	IEXPLORE.EXE
4872	IEXPLORE.EXE
4872	IEXPLORE.EXE
4872	IEXPLORE.EXE
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4872	4960	iexplore.exe	84
PID 4960 wrote to memory of 4872	4960	iexplore.exe	84
PID 4960 wrote to memory of 4872	4960	iexplore.exe	84
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 2704 wrote to memory of 4596	2704	firefox.exe	93
PID 4596 wrote to memory of 4720	4596	firefox.exe	94
PID 4596 wrote to memory of 4720	4596	firefox.exe	94
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95
PID 4596 wrote to memory of 3228	4596	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://l.facebook.com/l.php?u=https%3A%2F%2Fbom.so%2FBJipjY%3Ffbclid%3DIwAR1t65x1_eWNh5L3Kj5lgERjLnH1-cJwFDzPOp-4PglJ3wfx8tVP7yT4bkI&h=AT1KLF97emXNUvodlzIPYeQd62STsbyQgEO3yR1EyBtR2X7bsCMWT4qdjGR2sr-eiKV3WRv0e_AHAjJqJS9qwgJJND-UWGKEm6QdfaplZM0ubD5Vawamxqv-WzO3epei8pATbt90XgEvP0OMa_zP&__tn__=-UK-R&c0=AT300gaUE-pSIbRVOl3ad8mxsg_OeddEafWlfXwAbuVeRJiJjglE9T39W_yh2PUtahd1ZnfHFYGRM0apPQTsDUOM_aYEraL_NxSZSeTAggoWdXjjF4yM1HHZRqFg8HsFeU6XKi69xmDoOWJeFvRHM4a5bYajrNS6SyNiLuIzEi2dCuw8lwFy3tmBSr_Kqx7MKiCS4eJqlbML
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4960 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.0.1183221965\1871687116" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57ee8064-74e6-4e9f-b610-c98304f7db7d} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 1924 1d733a16258 gpu
    3⤵
    PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.1.814101980\1759076692" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1570aae2-ff45-437b-aa29-214f24ee06eb} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 2316 1d725b72b58 socket
    3⤵
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.2.584247659\1050489504" -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3308 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6144902-cb58-4b50-abbe-53188f5c2b01} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 3228 1d7366f8858 tab
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.3.866715706\1275816914" -childID 2 -isForBrowser -prefsHandle 2488 -prefMapHandle 2484 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7389ba6c-80ed-45f7-ac1c-5e9d1fb2b921} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 1204 1d73529ba58 tab
    3⤵
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.4.925372856\898367488" -childID 3 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24105dbe-b563-46d6-9a95-c743b313f1b9} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 4028 1d73685d558 tab
    3⤵
    PID:1696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.5.1921852233\1286261432" -childID 4 -isForBrowser -prefsHandle 4712 -prefMapHandle 5108 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09bb042f-4add-4935-87f2-a930f2f55f89} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 4932 1d725b6d658 tab
    3⤵
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.6.685169813\1418960450" -childID 5 -isForBrowser -prefsHandle 4712 -prefMapHandle 5108 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1daeb700-223b-4a50-b641-0acc46850bb8} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 5252 1d738de2558 tab
    3⤵
    PID:1680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.7.2085478254\229850003" -childID 6 -isForBrowser -prefsHandle 5504 -prefMapHandle 5500 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2049cdce-c4c6-4fa3-a59d-6d769c4a94c8} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 5512 1d73ab60358 tab
    3⤵
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.8.1159531094\615305299" -childID 7 -isForBrowser -prefsHandle 1644 -prefMapHandle 3012 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {446addd8-fec9-48ad-b990-fccefa06e8a6} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 1592 1d725b5dc58 tab
    3⤵
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.9.1391542181\1300500787" -childID 8 -isForBrowser -prefsHandle 5836 -prefMapHandle 5840 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b23a942d-e632-48a5-a2eb-ed091164c2a1} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 5828 1d725b69658 tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.10.1950976328\841107054" -childID 9 -isForBrowser -prefsHandle 4232 -prefMapHandle 4244 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33637646-050e-4705-bb41-166e8ab9d8a7} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 4240 1d7354b5358 tab
    3⤵
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.12.607693268\1490470398" -childID 11 -isForBrowser -prefsHandle 7156 -prefMapHandle 7152 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a546504-d529-474f-89b2-e392b1438a42} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 7164 1d73a373158 tab
    3⤵
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.11.1550270917\679579534" -childID 10 -isForBrowser -prefsHandle 7328 -prefMapHandle 7332 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e055e9a-89ef-4972-801c-85645545569a} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 7320 1d73a374c58 tab
    3⤵
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.13.1584128788\871105311" -childID 12 -isForBrowser -prefsHandle 7188 -prefMapHandle 7196 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {756cd9d7-5cf3-4dab-8aa5-9eebd35e7647} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 7108 1d73bec2b58 tab
    3⤵
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.14.236307628\965825918" -childID 13 -isForBrowser -prefsHandle 5192 -prefMapHandle 9952 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3d017a5-cac3-4a56-8216-9061235092b2} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 7428 1d73a3bd658 tab
    3⤵
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.15.1344471509\1119398087" -childID 14 -isForBrowser -prefsHandle 5396 -prefMapHandle 2788 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41891dd9-b7ed-448b-be70-1b9a3cefd429} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 4828 1d739868758 tab
    3⤵
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.16.421147452\66197927" -childID 15 -isForBrowser -prefsHandle 9712 -prefMapHandle 9716 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {395139bd-dfac-401f-a12a-3eded5655a44} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 5028 1d73a487b58 tab
    3⤵
    PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4596.17.1795987046\121075564" -childID 16 -isForBrowser -prefsHandle 6460 -prefMapHandle 9544 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b0ea82e-4d25-48a5-ae5c-e3f4f9a30b58} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" 6496 1d73b215758 tab
    3⤵
    PID:4172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5304

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Smarttaskbar\" -spe -an -ai#7zMap22266:86:7zEvent32472
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
4b958c078984d97dc80efb7b9c9db5d9

SHA1
e36452e7ea54d63035d7a8d81d13ea506fc8357f

SHA256
0b69c52b5e2faba2e0b7d6e67a7693e333d0aea0dbb80cb95764fd50b9a0e799

SHA512
75fbbc35d97c0d0513324ee27395c74d70e2b2a3dcdd0c03e4014b0b0307c9e7742c49a165677cee79563f4efbe56c94bbaea2c7867d3401cbe1fabab7df9c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
d9fbd89769d7da3db3acc5076afd541a

SHA1
eb49d074361153bd74f7a2d57e5014501c76d68c

SHA256
e84718e83f1d1a6c7e1e34a57778ac1c84ba67e1fd268a150a480f8613da0a4a

SHA512
52c513fea0d5f35006ea8e66295b4528cafa10ce80db7d93c685729a956d9c50f89859734ff84ea2ec05560eac581e40ed4c8a9b10845cf1a58694c870149cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YMNL2J1\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
158KB

MD5
dc99ac1e91ebbce7b0cf00825e41f808

SHA1
d2801d20a0b1a916f235defd7099b6cbe6891b06

SHA256
2c8923a5c146f131395293e438a0a574cb012671ceba5f248249fa929e911f46

SHA512
6a13e8f752d144b2d8ab161890e900c96e32c984a8d2f460a77f790767f833580b59e0af837b3f92724685b4cc40294351f134817985c07debc53ae8b8e97c9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\prefs-1.js

Filesize
7KB

MD5
672b648124057f0e28ee81c6b1fa257f

SHA1
432044cd194c70bda7ac6c4afd12c8bb52f1d92d

SHA256
c26b32314884c7a42ad3a257692a64c1396feae748ad1038db3d4778de465ad9

SHA512
e46ef367292f4f75568bdd766fcb24ca480d5418b58cdd8da3db7af1f220fa0e8ca3447d057b61a08d7c4e47130e9481426487a1ec9608f533d7e9a9ef74253a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\prefs-1.js

Filesize
6KB

MD5
701108b6b3c87648142184ec2ddfcaee

SHA1
8b58915230bd236e808485bd78c8616f3b445eb6

SHA256
e0eaba6c2adc734988650b608ebe0942c5324ceb124366aa7379afca5595a22a

SHA512
d01b3c26b15ec4b6d27ce79e1375228d56485c936bf14c4788301f4755c1d5b10c9e183932cf34fcf7c166f779166fdd9efc1ea4f06f2e367bb4a29d90e4548d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\prefs.js

Filesize
6KB

MD5
371f9d067ab61a6f290040c04c9bbf5b

SHA1
cc12837919345f77c1444796e0025be01aeb767e

SHA256
825cabb4d33e8f05edc771a366ecf66c78ada41c958128e73da2a7c414049b61

SHA512
c8f2d088c43bcfe32344e1d7afd21e71dc16a3a7a08265c76dbbfcff63107a81fdc65c2cbdbcce025f007afc5fc05464598e5ea1587615ae8089d2c75f513843

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
f2f4bac6401895608779b4da89b39e0d

SHA1
ed0fafb0080520a42a2e52c8ba20de9a26477100

SHA256
ebc58a811c9443e127c51ae5f416e452091ff5cdfc101eb04f8d91f8f849cd39

SHA512
b2743b9a9e483a18a64e9a5a47236113744688652d193fea9ea720a7011e71c9735d5a91d9ab09d6d184b1a16dd85657f319d5c5785dd6127ae7b00cc1b1361d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
1df18feb5223231443761875048f73fe

SHA1
6b9889edfbb70b3b676eb274f343d638a032ac42

SHA256
0aaf733fdef1db9eba4a16995be3e1de294027e3cd8ecb8e024bf8c93e5d67bf

SHA512
72b619efeb461eeed9a035961f0d225cf8b1fe37cc72032cfbee30644fc588b12848463e4a63a8ccffb548afb735a59784d6dd6e160105575cd95f8083ec62a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
fa9f34874fc47c5c3ae9a75a8aa93c74

SHA1
315ef2fd423edbd25cdfe4cd48033a55029e3763

SHA256
6f2b2fee5009bbc26caea3f786b6b8b2ad0bfd66a10c3b11508f5b6ddcd43c43

SHA512
989c86f803e3930b90cc6a7f79ef4fdba6563b29277e14ac9a2681039cdc34dea71067768cec1f3f256c43c9c2a756536222ab4c110a21a565aa70812529c279

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
66a36b42536b9bbf1c6120ca884dd3ef

SHA1
0aeefc890d1d2b5b2c2f8c190b1034ea77e1d196

SHA256
be48ea32291a8e9bc561a28fc6f54ed72b8eca258631d8c6ae9de4f8ff4da97b

SHA512
7464b23f307e6cd5884fd58691d67a89ae1b6bf975f5ba53ddd770aa6c809ac054e5938da04a6d6e07a1b8e10cc8aa5ad740e79ad5a63b1e46286bc6e1351e75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g6h1qcgn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
6271b27cea0690e0d3bfa7155e6ac25e

SHA1
b1910a08356fce4280e39a8cfa30754d680fab95

SHA256
04cf4faf979dbf47889536678a7a028d5dd64ca0e1051b2b4490035f5793430d

SHA512
c62f63a1e64400c1446c83da509ef108821e4b9e0d2658c355828e2e1517b8d5e0cbbe32f4c32efd65ef4f40f287c41c1289a8367e959bdccb82fbb5d859c06b

Download Submit
C:\Users\Admin\Downloads\Smarttaskbar.drN5_wqE.zip.part

Filesize
11.3MB

MD5
033d771ff9d4853f4c52213428b1d681

SHA1
9f790e6b4f46e9b7e69a7861c2fb4df90f39f6c9

SHA256
e98bb04975a72b762724e1263c54605bab18490eb86e901358b9549f05b9d72a

SHA512
4730bbc2ede912976b641b5882d362c4dd2e33e81a6ae8ffd4863a8df6ba1f194daddfb246ccac5f13b05403e63f0ee65718df5954042766436c9e239b27a810

Download Submit
C:\Users\Admin\Downloads\Smarttaskbar.zip

Filesize
11.3MB

MD5
033d771ff9d4853f4c52213428b1d681

SHA1
9f790e6b4f46e9b7e69a7861c2fb4df90f39f6c9

SHA256
e98bb04975a72b762724e1263c54605bab18490eb86e901358b9549f05b9d72a

SHA512
4730bbc2ede912976b641b5882d362c4dd2e33e81a6ae8ffd4863a8df6ba1f194daddfb246ccac5f13b05403e63f0ee65718df5954042766436c9e239b27a810

Download Submit