hxxps://www[.]boersenratgeber[.]ch/mailings/tracking?utm_source=Newsletter&utm_medium=email&utm_campaign=nl_bb&linkid=ee9b9f6a81632c02ff818c7f8f8b5bde&utm_target=aHR0cHM6Ly85eHNpeC5jby56YS9iaW4vcmVhZC8jP0E9WVdSdExuWm1jeTUxYTBCMlpuTmpieTVqYjIwPS9jb21wb3NpdGlvbnM=

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2023 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.boersenratgeber.ch/mailings/tracking?utm_source=Newsletter&utm_medium=email&utm_campaign=nl_bb&linkid=ee9b9f6a81632c02ff818c7f8f8b5bde&utm_target=aHR0cHM6Ly85eHNpeC5jby56YS9iaW4vcmVhZC8jP0E9WVdSdExuWm1jeTUxYTBCMlpuTmpieTVqYjIwPS9jb21wb3NpdGlvbnM=

Score

10^/10

microsoft phishing product:outlook

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\DOMStorage\dp-model.it	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303088ffedadd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31043054"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30445500eeadd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31043054"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007ce7b7852422c48865386072e9a0d0f0000000002000000000010660000000100002000000001139369c86ba8f0853b9a4191c7ab50525da9215445432bdbf652b7c06b549f000000000e8000000002000020000000ec935d5d8bb3175c3c54424b12b9184119c4c8ab11439ee172139f1082ea8e9720000000857a3d720eb38556f03506fe001b4f632993d275e5e07a557b7ad8226f7258bf4000000024c6b6e8873b949955cc8949198a3d28e9d8aa034ef10942698fb83b15223da72e3fbafc160fb08c1e842233ec732d25112a3773600ebb1bcac49e2238d91b2d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dp-model.it\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "237568795"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "237568795"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "251159460"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31043054"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395181537"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{399DEEB9-19E1-11EE-A3FC-E2F5CE34D8FF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007ce7b7852422c48865386072e9a0d0f00000000020000000000106600000001000020000000f183a04bcb49bb1e79ef7edb27d11315ac9c018cdef584fd50d4e6fa17dce30d000000000e8000000002000020000000d84510fc9baaac80423447808b271e72d839d8d5e2bf46558a093030e1a0119820000000e0b4b1fb1ad6adb39e5d018a0533eb992a37152fda201c27bdb59d49a0d2b24540000000754f3d818e9f93ec0f7f765adecdd338790ac3a8cb9dc2b316837e2bc0168e1f956518b787a837ff999927350a7cc46ea6d84975d44e9e222eeb93f0d110265c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dp-model.it	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	firefox.exe
Token: SeDebugPrivilege	892	firefox.exe
Token: SeDebugPrivilege	892	firefox.exe
Token: SeDebugPrivilege	892	firefox.exe
Token: SeDebugPrivilege	892	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2064	iexplore.exe
892	firefox.exe
892	firefox.exe
892	firefox.exe
892	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
892	firefox.exe
892	firefox.exe
892	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
4512	IEXPLORE.EXE
4512	IEXPLORE.EXE
4512	IEXPLORE.EXE
4512	IEXPLORE.EXE
892	firefox.exe
892	firefox.exe
892	firefox.exe
892	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4512	2064	iexplore.exe	80
PID 2064 wrote to memory of 4512	2064	iexplore.exe	80
PID 2064 wrote to memory of 4512	2064	iexplore.exe	80
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 1580 wrote to memory of 892	1580	firefox.exe	83
PID 892 wrote to memory of 1196	892	firefox.exe	84
PID 892 wrote to memory of 1196	892	firefox.exe	84
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85
PID 892 wrote to memory of 3548	892	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.boersenratgeber.ch/mailings/tracking?utm_source=Newsletter&utm_medium=email&utm_campaign=nl_bb&linkid=ee9b9f6a81632c02ff818c7f8f8b5bde&utm_target=aHR0cHM6Ly85eHNpeC5jby56YS9iaW4vcmVhZC8jP0E9WVdSdExuWm1jeTUxYTBCMlpuTmpieTVqYjIwPS9jb21wb3NpdGlvbnM=
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.0.1906424960\411235451" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d54d7f9e-fedf-4c25-b8f2-5ece8b5b1162} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1932 1dd4e9ede58 gpu
    3⤵
    PID:1196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.1.2076197851\1201619604" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d7ed6a9-2903-41e7-8b5a-c1f2ab1aed67} 892 "\\.\pipe\gecko-crash-server-pipe.892" 2332 1dd4e7e7558 socket
    3⤵
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.2.118239161\762993879" -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3296 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {610e1370-b9f7-48af-8cdb-d90ae3a3e1c7} 892 "\\.\pipe\gecko-crash-server-pipe.892" 3288 1dd528a1858 tab
    3⤵
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.3.140604542\173486755" -childID 2 -isForBrowser -prefsHandle 1036 -prefMapHandle 1396 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b6f4155-e945-48be-8c51-96e0e157e138} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1388 1dd5146ba58 tab
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.4.1331501161\1192638770" -childID 3 -isForBrowser -prefsHandle 4100 -prefMapHandle 4092 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6074f569-593d-427e-99de-515e5711ff6d} 892 "\\.\pipe\gecko-crash-server-pipe.892" 3564 1dd53d61d58 tab
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.5.2139418625\251881327" -childID 4 -isForBrowser -prefsHandle 5068 -prefMapHandle 5096 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85152aa1-9497-4b8a-a69a-6948949ab9ce} 892 "\\.\pipe\gecko-crash-server-pipe.892" 5060 1dd54c04758 tab
    3⤵
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.6.1019622694\633321108" -childID 5 -isForBrowser -prefsHandle 5128 -prefMapHandle 4716 -prefsLen 26575 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa72b05e-9688-423b-8d71-64ba4ab6c3a4} 892 "\\.\pipe\gecko-crash-server-pipe.892" 4752 1dd54c04158 tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.7.141831611\105407790" -childID 6 -isForBrowser -prefsHandle 4720 -prefMapHandle 2724 -prefsLen 26575 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98288b0c-b77f-4695-9b85-593719e45603} 892 "\\.\pipe\gecko-crash-server-pipe.892" 5304 1dd54c03558 tab
    3⤵
    PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.8.480003818\465260073" -childID 7 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dec1ff46-ac80-4f8e-b205-956d905d878d} 892 "\\.\pipe\gecko-crash-server-pipe.892" 5276 1dd567d4b58 tab
    3⤵
    PID:4932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.9.1421720296\1908991107" -childID 8 -isForBrowser -prefsHandle 4696 -prefMapHandle 5240 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b22b8f8f-9440-45cb-b222-4a9455faaf94} 892 "\\.\pipe\gecko-crash-server-pipe.892" 4764 1dd42071c58 tab
    3⤵
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.10.298343927\1661953711" -childID 9 -isForBrowser -prefsHandle 5144 -prefMapHandle 4344 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64bbc975-99ad-4740-948b-db231597eb55} 892 "\\.\pipe\gecko-crash-server-pipe.892" 5860 1dd5284f858 tab
    3⤵
    PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\e863qdq\imagestore.dat

Filesize
1KB

MD5
331e29a4cc85f1a4b94e469534fc4e8f

SHA1
ff181bb8162c7ee0278f8678eb40b6f0863b5564

SHA256
f0157be4f4d401aece61c0a64aa852b8c6920bbaf28175657b314079dd6e6e5a

SHA512
63520b9a3511c97423762937eba013826448c091a819c6882a892b4cac96849db8250ba372d54a1c40fcfbf9488d40378e1f2583ec213658071f9cd4b1df8525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\e863qdq\imagestore.dat

Filesize
5KB

MD5
3c915b7ca6b812e226eeb1392152117a

SHA1
221ea9d86c85f95b4849277c4e3e75779db8441d

SHA256
ec2e2cab790a71edcc18fcf698b6fb2e04543f61bdb6ebdc764415a314f58945

SHA512
06ace5dc9c0bae3dfd90267fe6a831895f60d81f22d86d685c9d72a7e2b1f1caf4aa6ecf8d75cea332cc45ef034327febf088189c184455fa505cf2950b6d045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IFS1FGNU\cropped-favicon[1].png

Filesize
1KB

MD5
8e797612267b5e92ceef8eb7af1da5e2

SHA1
a6f56fdcec397fdfd3c5d18c8bd6f7bdf2bf37c2

SHA256
a675661b30656265f012d19c0e522e41bd043b3f2dad08d93d5b8eefa69a5a0e

SHA512
1dd86c0301289df11d3ac392480d601635f0f5ef03af47bf8aedba0718eeda749c2911a030ae5dc077a36dfedd01df383e35ea201c50f52882c146d5c1304041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IFS1FGNU\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RSFEJP46\wam-metals-logo-blue-50-80x80[1].jpg

Filesize
3KB

MD5
6ca3b34efd0da3a44109eb9eab9a6c80

SHA1
779e4ccbf37e50c9d3c6229f7275d44de9d153c4

SHA256
97ded76a9e839f57d28326e35d522a578b99ae081593a939ca3acbfb51f7f992

SHA512
de2e529be51f1624a47ea359c6f47a7705775fb98545328d77ea3e58375ed419b2e17d99d447ad16ec7ad60f42f22b3eefc70ed5e46837e58d1a7811aa2ac289

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\doomed\15008

Filesize
12KB

MD5
e3d1fd2a0453e23db7d7f9e9879817d7

SHA1
a03135771c06c86a32e8a8c8afc81727466e9414

SHA256
c8fa3bdc298fe07fcd5867935d8b61625b2cc8acfa2ab50f04ff893c2f5de34a

SHA512
f4eb6776b39c4e9fc5fe9ded845ae529e02bac40e204c880250c5a6ccb072410f7cca6872c1053dca73defe87a1b6ef39c0e5ba5b2f8df1e7f5ab07abf8a69db

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
3973e970323832e7f459e125f227e8bf

SHA1
3f9c99ccb40e93e082d310cb744b376aff47b071

SHA256
e16738c2ba39aa91c5d136afd6be877dd82691a3bc994f1f94d5662b88b50c4c

SHA512
1ba5514a996e531790ae8c67ad1aebff393d1e616428b0c41bb82bec89ce910e7d9a53e10822955c774786794d179325f941e7e4ccc0551a8076c671a9f1607d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\entries\7E98F30C8BB93FD34A72FFEC211F558EE14A8D5B

Filesize
98KB

MD5
a2b2a64b3419e653e5f1a304367243c2

SHA1
3a65c35d2473e5928e7841a6cbf47a6e6c017f43

SHA256
bb3fcef5fdc853c0a538e34461339c0e92a09138f2899d1bf4bf84215096287e

SHA512
bb75a5bfeb12d3cf53753dec07d9b51c77eafdf7165d88e8fdabdc7edcb9e7afd2b33e948750e3ef03818b18339e66e0e858fe6c8893bff3e26892a714a99c2e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hw21aoqh.default-release\cache2\entries\C119A85786FB23F03D3A81882102EBBAE2ECCEF4

Filesize
28KB

MD5
d9a7e4fd99df5f55b2068c0b67a4dd30

SHA1
11397de8f4901f987a83a58e5bff6bb1b1c996e8

SHA256
ca2a13af644616a1304d3f477456c9d92dfa9b25e9a79d86c3af7c3590b7b55d

SHA512
03602c3836d9b8ddc122f5b392d1dc35566e1c9fe947838e227d5f78d8ea321bbbf0932e3c95654902353c462dbb9da4b21eb11491b025e854cf3e82ec49f2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs-1.js

Filesize
9KB

MD5
3dbde7e66cffc9a130344e8e678c65a5

SHA1
dc38362da4d0bc9cc0a427c6646060b52d64effc

SHA256
802e1a1c98aa50ca9526a4ef2a460bd61ef7ca2c5669b944f9db66e6926e21f0

SHA512
677b826760d0106914d4c06b6cbdacd15f43a07c5bb3d008434ef4b8aaae44305bd2410bd9c7e99e953ae1c48301989a8f9b8c88c17c61d938df7563a68659ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs-1.js

Filesize
6KB

MD5
d6c767bb0cb20a107e20ca0fbeef8c3a

SHA1
4de9b8c4921e24a923ac99944e1048e48bce3c2c

SHA256
a0717921ca7a9693b7d0a2b9f3a5418ad2787bdca36ab8b5a9d07efcf84d7bc4

SHA512
6843f212b06c0d768ddcaa885f3ad4f68817e06ba84a43cf753ad4f04a800b9d5cf2562637f45a8f9403d3d07daf61042ae03acc33cfc04325f89125a0fe5f5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs-1.js

Filesize
7KB

MD5
e1f9b70890f85cf22d98823b4f40e2b6

SHA1
cfa68c7b8cbc30f59e7b23b4ded6c88acfadc9c3

SHA256
b714a648e20ab7e4958f385ee4e084bb080e67eacb0055f39d089ce9eb00389d

SHA512
a61577a5c654428259c0279f261a060b6c0758030d22ab4293cfb74c21e49030fddb4e4e162d952be14ce397039ffe6f8caeb28b078fae3f7fce28fbe4d175c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\prefs-1.js

Filesize
7KB

MD5
cc011b23b610ed3cf26d96b0f9bf124f

SHA1
85d46c858e7a3bd5c12449c59939c8ec561105dc

SHA256
7e5e39b17aee7907d2a3eaa5e1b9d49980000f8653eb1a575685d36aba76b873

SHA512
ec01a5d75172c949fd53068920fe44d9c4c1c77e89dcb30d9cfe08f123ac108a2557b27360a52351d7d906e985f171351da278f94f7d8116085dc6854a693091

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
0edeffcf4de565ce229911df9f715632

SHA1
1f63261aaf7e77022e4cd35b0d4e2732214ccdd7

SHA256
ae5ba9f2a837982da747b66503015ad834948bb05e61e6181761f23fffc364cc

SHA512
3bb39b4e7ef9f0cf735c7d7ace691216bcbcebc2aa4d65dfd5ce3e73aae24fc50a100398f76b05420cba2e11830b9dc8507809af210ea303dc57bfc5106543f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4812a0a9118b7100e0135f157925cb42

SHA1
b4e67ae5fb75ded0adc7fafd294dffd24929b336

SHA256
65bd17c37e8e7ea6bcd37c10c55a5a663b26cae877097e73b8c246b59a9f0a75

SHA512
a2ec65a97c7bb7d7d09bd48be20fbe79640264a65fa501c711f1d4dd0dcec51e95b98f895858391af15452777ddf9443a7b38a73f89d055ce173adc4d3d5808a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
1e3fc16034f2311e8b75432d54990a4b

SHA1
f24d176bcba60cb51af9e7c9988f3156152652d9

SHA256
0a494cc91f190044ec5f199c59dff9dce34a6a5dc4456659e68fe963de4d5e0b

SHA512
e04dec60293b5c52da69a2141c0e79eeab9c19d2d50db64314108b2c0b5ba1efbe68a6f008edb254abe3a519028013c48c9ffbce5aa1430c178a197226c7afa7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4210f5f5bd8de74ba6898df7012f73a7

SHA1
c49b2bc9ba31723f5cb88e464a1862e15408b5f1

SHA256
26d87455d79f329b018df928dec8d76ef6f9d69eaf5576816235f5d815613954

SHA512
4626aacc7e3cdf3398e074a2313e864cada1bf2addd481ed78ffb8d28fb1a46057eba0591ee1dd6c4eed7b90861bf94976f35cfd4640f15a7e66ba2cc2af880b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4f6ee5913293f0f80c455bb9d7a74c6d

SHA1
2678ce56bf845e814430ddb6320e7855705607e9

SHA256
6c94c696f0b01a794123b1719439e2b61d1c58f6e5fa0040a426fb70ba749d9d

SHA512
b759fffda3d7a0a7cb252599a879b8feccc826b7f7cc819f7513a0604988018bb5944d1786a4db5cd1519a95c343525feb133a39f5031f10096d17ee57408841

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a966f07915c61c138999108af99111e5

SHA1
1223a3df6802640b6cbd3393c48dc5518e15b14d

SHA256
29682c3dd2badf8efae40ff38425ecd60a541e973f2b4f8c354125d16022847b

SHA512
a1b0a5ceb01dee6f466c243e3efa0e7f1438082df748965048a755dde07af10e191eddf0a19be27be6e0009ad8f3792f7fe56784b6ea2e1268712e86d2890067

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hw21aoqh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
399862058a0bf7728d02bbbca5a01d64

SHA1
357df08823ce8342426f2fe5b37aeea9c9755a36

SHA256
b7810cec070638c465368105aa5cce5bcb9279601a0ffa1f1731510885e0317d

SHA512
4ac95288fc8d91c9c9ac209af8ed4bbce23d15371cef4031050da05477be334d45041bbb0660e2469e7f49b8e092fb618c0eccb77ea97ad11657b3d8036931ed

Download Submit