agenttesla | hxxps://mega[.]nz/folder/4700hDQD#-8-I9xQWq7XrFu_osffZpg

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2023 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/4700hDQD#-8-I9xQWq7XrFu_osffZpg

Score

10^/10

agenttesla umbral keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000f000000022bf2-454.dat	family_umbral
behavioral1/memory/3084-492-0x000001B635800000-0x000001B635840000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000f000000022bf2-454.dat	family_agenttesla

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31043219"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2428641635"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a07bbe79b265d14db3b0aa02a38821470000000002000000000010660000000100002000000000b180997881f48e767437015957a2c917fab4e3111a7dc5385ce6e4f392ce29000000000e800000000200002000000026176284261ac166a2ffafdb0858d46bd2641fb75b85ddbd200c7a3f6b566974200000008ffe3da6ee4319be81a8750fe9b136af00a8b23ebeddc8cc7760a093e748cb5740000000ff85ca757990d94e1a0a38047d3b09dfd56055fe70516348b0375c5f5f5339021bc56e5ec00c432df43455b732b4f3d3562bbe9f8c4679d369197f12de2ceb02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31043219"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffea00000036000000700500009b020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2416141226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31043219"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a78c9193aed901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a07bbe79b265d14db3b0aa02a38821470000000002000000000010660000000100002000000025dc127d1373aac8b93edeac5bbaa149a42152aab9adda27e042d42d30600b09000000000e8000000002000020000000510afe622389a5892ea180e8cc0b627f7c0373d336c2d9d09c341df15652245e2000000011b89183627693d9dc4eee31faa93514b6d6175552740443981981cca5241f0540000000c14c83382ec07dd8a2ddefba8131550d1e4becb7e28c3cf4318bba5f7d2ba9f3d2c2607fab47eee4a98a3a09e53647b0bd273da0db79f5fabc5a0b0334ef0c5e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b3be9193aed901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BB7ADA45-1A86-11EE-A61E-CE28E34818EB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2416141226"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Sapphire_Clicker.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	firefox.exe
Token: SeDebugPrivilege	212	firefox.exe
Token: 33	224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	224	AUDIODG.EXE
Token: SeDebugPrivilege	212	firefox.exe
Token: SeDebugPrivilege	3084	Sapphire Clicker.exe
Token: SeIncreaseQuotaPrivilege	1912	wmic.exe
Token: SeSecurityPrivilege	1912	wmic.exe
Token: SeTakeOwnershipPrivilege	1912	wmic.exe
Token: SeLoadDriverPrivilege	1912	wmic.exe
Token: SeSystemProfilePrivilege	1912	wmic.exe
Token: SeSystemtimePrivilege	1912	wmic.exe
Token: SeProfSingleProcessPrivilege	1912	wmic.exe
Token: SeIncBasePriorityPrivilege	1912	wmic.exe
Token: SeCreatePagefilePrivilege	1912	wmic.exe
Token: SeBackupPrivilege	1912	wmic.exe
Token: SeRestorePrivilege	1912	wmic.exe
Token: SeShutdownPrivilege	1912	wmic.exe
Token: SeDebugPrivilege	1912	wmic.exe
Token: SeSystemEnvironmentPrivilege	1912	wmic.exe
Token: SeRemoteShutdownPrivilege	1912	wmic.exe
Token: SeUndockPrivilege	1912	wmic.exe
Token: SeManageVolumePrivilege	1912	wmic.exe
Token: 33	1912	wmic.exe
Token: 34	1912	wmic.exe
Token: 35	1912	wmic.exe
Token: 36	1912	wmic.exe
Token: SeIncreaseQuotaPrivilege	1912	wmic.exe
Token: SeSecurityPrivilege	1912	wmic.exe
Token: SeTakeOwnershipPrivilege	1912	wmic.exe
Token: SeLoadDriverPrivilege	1912	wmic.exe
Token: SeSystemProfilePrivilege	1912	wmic.exe
Token: SeSystemtimePrivilege	1912	wmic.exe
Token: SeProfSingleProcessPrivilege	1912	wmic.exe
Token: SeIncBasePriorityPrivilege	1912	wmic.exe
Token: SeCreatePagefilePrivilege	1912	wmic.exe
Token: SeBackupPrivilege	1912	wmic.exe
Token: SeRestorePrivilege	1912	wmic.exe
Token: SeShutdownPrivilege	1912	wmic.exe
Token: SeDebugPrivilege	1912	wmic.exe
Token: SeSystemEnvironmentPrivilege	1912	wmic.exe
Token: SeRemoteShutdownPrivilege	1912	wmic.exe
Token: SeUndockPrivilege	1912	wmic.exe
Token: SeManageVolumePrivilege	1912	wmic.exe
Token: 33	1912	wmic.exe
Token: 34	1912	wmic.exe
Token: 35	1912	wmic.exe
Token: 36	1912	wmic.exe
Token: SeDebugPrivilege	3368	taskmgr.exe
Token: SeSystemProfilePrivilege	3368	taskmgr.exe
Token: SeCreateGlobalPrivilege	3368	taskmgr.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3640	iexplore.exe
3640	iexplore.exe
3640	iexplore.exe
3640	iexplore.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
3640	iexplore.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe
3368	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3640	iexplore.exe
3640	iexplore.exe
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
3640	iexplore.exe
3640	iexplore.exe
3640	iexplore.exe
3640	iexplore.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1776	3640	iexplore.exe	86
PID 3640 wrote to memory of 1776	3640	iexplore.exe	86
PID 3640 wrote to memory of 1776	3640	iexplore.exe	86
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 3076 wrote to memory of 212	3076	firefox.exe	94
PID 212 wrote to memory of 2312	212	firefox.exe	95
PID 212 wrote to memory of 2312	212	firefox.exe	95
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96
PID 212 wrote to memory of 4816	212	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://mega.nz/folder/4700hDQD#-8-I9xQWq7XrFu_osffZpg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3640 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.0.842559002\1703018605" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1800 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ac48f63-718e-43d8-bae7-e682bc6ca595} 212 "\\.\pipe\gecko-crash-server-pipe.212" 1900 1b0cdaf4558 gpu
    3⤵
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.1.884579576\1163507410" -parentBuildID 20221007134813 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fed041bb-d015-41e7-ae37-b46ed7209e0a} 212 "\\.\pipe\gecko-crash-server-pipe.212" 2300 1b0cda0b458 socket
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.2.1810772232\286779361" -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 2980 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {473f68a2-fca9-4f6c-9197-42683e0f8fa6} 212 "\\.\pipe\gecko-crash-server-pipe.212" 3104 1b0d17a7d58 tab
    3⤵
    PID:2104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.3.1650812506\76410033" -childID 2 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4db7fdd-fbee-42d9-960d-6bbadbfd4b88} 212 "\\.\pipe\gecko-crash-server-pipe.212" 3700 1b0d0452a58 tab
    3⤵
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.4.2120475824\1685212589" -childID 3 -isForBrowser -prefsHandle 4468 -prefMapHandle 4464 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b132ed6-9e3a-477f-8d04-af2b8e151e0c} 212 "\\.\pipe\gecko-crash-server-pipe.212" 4476 1b0d2d07758 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.6.1718943073\1074568465" -childID 5 -isForBrowser -prefsHandle 5100 -prefMapHandle 4952 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de3cb696-2535-45f8-bc78-9518dd61e36a} 212 "\\.\pipe\gecko-crash-server-pipe.212" 5000 1b0d3bb6858 tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.7.1408186357\302628950" -childID 6 -isForBrowser -prefsHandle 5300 -prefMapHandle 5304 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {414cd8f5-487d-46ed-a4e3-1d7f5d0a0a60} 212 "\\.\pipe\gecko-crash-server-pipe.212" 5292 1b0d3bb8358 tab
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.5.1546661381\1631986360" -childID 4 -isForBrowser -prefsHandle 4968 -prefMapHandle 4964 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49d3b737-3d65-4725-a7e4-163afcdc2984} 212 "\\.\pipe\gecko-crash-server-pipe.212" 4980 1b0d3bb7458 tab
    3⤵
    PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.8.238061769\637613216" -childID 7 -isForBrowser -prefsHandle 4508 -prefMapHandle 4444 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {deb082ba-9579-4e73-9a72-e44d52270975} 212 "\\.\pipe\gecko-crash-server-pipe.212" 4592 1b0d2d06258 tab
    3⤵
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.9.1291397388\319821219" -childID 8 -isForBrowser -prefsHandle 5824 -prefMapHandle 3304 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa95a469-6313-415e-b4ef-e1452295cb4a} 212 "\\.\pipe\gecko-crash-server-pipe.212" 5828 1b0d1ce2658 tab
    3⤵
    PID:1328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3360

C:\Users\Admin\Downloads\Sapphire_Clicker\Sapphire_Clicker\Sapphire Clicker.exe
"C:\Users\Admin\Downloads\Sapphire_Clicker\Sapphire_Clicker\Sapphire Clicker.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3084
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1912

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\qwzqiba\imagestore.dat

Filesize
6KB

MD5
d00ea8fb453cdb158972504d3f0adc02

SHA1
fa8505ca759b2c409ad64a0a6adc818dcaa4cdb2

SHA256
0b71ecb855df3dd7b382a0a7cce4378997a155eb985f9918765ec09365e7451b

SHA512
a673877f9d323bee6cb8595c8cc3ab487ee6c08c988a269ba47845457b21eabc5ebf49f5d234a508dc731fef6d7ae870753ae353c263d694cc466bd2c39ad035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SUUB7YB2\favicon[1].ico

Filesize
6KB

MD5
72f13fa5f987ea923a68a818d38fb540

SHA1
f014620d35787fcfdef193c20bb383f5655b9e1e

SHA256
37127c1a29c164cdaa75ec72ae685094c2468fe0577f743cb1f307d23dd35ec1

SHA512
b66af0b6b95560c20584ed033547235d5188981a092131a7c1749926ba1ac208266193bd7fa8a3403a39eee23fcdd53580e9533803d7f52df5fb01d508e292b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
133KB

MD5
fadb7ba3060d655e4452e614d81e1962

SHA1
320348a9d21a0e9087f5114152e0e800f49c0df5

SHA256
e9fcda292265a74ac66f900fef7d63df134aac7585c9dd56e98f6820e4c75031

SHA512
22d49e029e5947734406cdf2d90438804b24d065fc75a53c14f4f7c8739496a411017ec53510633bc9b28999ebb5a72bd57b8f58a8039a20a22c3643d3a5a40b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\cache2\doomed\1357

Filesize
9KB

MD5
4ff31e17e39037adb8112bf00d1f64bf

SHA1
d7ab9a1b6dfd5336abe85c483d20f8f8418b6edd

SHA256
f0d5ca2dce9dad5e549f080272c2b6402e4fd7f5cb9a5ab7c92fee3f95732682

SHA512
f16425f6f1e6035478fd2dddaeedd31b352fd1d0a91f7181a685cd2af216ac2e32af52f02659a7ff9dc1653fb281107f688bb71ebe6e0ddc35feb0effa748e4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\cache2\doomed\5561

Filesize
9KB

MD5
9967717fcd2d934199b40005ff7c0ad0

SHA1
6db833f2b5cabe3bc1ad214006e17d6c2cbdfe15

SHA256
e7809249e55f1177c469702f9cacbce4f6e66fae997f54c5c40e5c7068f6ca39

SHA512
a0c2f577a07589ebf90ee5ca0e8ea1cd9e48d5b6ccc9404a9181a48cd346e30cf6843a3b2a9d2fd4d59e61f862259d8f956028fbbfc0aaaebd4aaf391c23d4e9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\cache2\entries\46452CEA1D6AA2BF58B5942C88BD664FF9175EFC

Filesize
44KB

MD5
c862ba1d7d09441f3a24052442260877

SHA1
c43add7a7f2cb477177f6026c31568ba2d8b59f0

SHA256
2e4788a2a8245c570ccc92c4e7559576644ccd103dd4382700c85691e0b54f47

SHA512
427c82c6e49c65de741f1075a7727d05a528324fbc9f99c4297a76c96f9c2f7723a1c75472fb10622d3ea1e02c919d793f2eca1bd61c8a1ab93fcd3b3934bfee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\cache2\entries\5E3F231055825CEC7AE91E91A990320D4AE9B0A7

Filesize
29KB

MD5
051214c502e8477263e96946f9add4e6

SHA1
c3333c02cc5fe6e1b578d14a5e8883be05cb8e1f

SHA256
dba6ef62304febff2cfadff895e1ca3a5cc2be0431eeb6f01e41dad8872bbe64

SHA512
d79a5a7980a9b6f994f978623f99d11ae22204f011ffd157fd54417f22d2de7c4b1ae3a131407905140debc594d54b1eedff962ad5deffddbea1bf45165eb523

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs-1.js

Filesize
7KB

MD5
f1939e4125cb250c7e900f896e4acf4f

SHA1
ef1af824e0faa42ff3b46668f37de30b07b29046

SHA256
cf0b056d255d6ccbc6a1426ca99738968ce2848559b11e0e0d721806a65bd688

SHA512
83be4473e399646543f42b657b80d4f5cbdf1e3b53707dc31c788ae142c8ea0792ba40bdbdc67e9a1040afde040f46a0a363dd2c219cc25e19393e488fcfb84c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs.js

Filesize
6KB

MD5
9beb86bb7b45941a2daf7b3e2d86ddca

SHA1
38807b47ec3be436e9819c239c43e12978c2e724

SHA256
a3258253f696743c3103c761a6606c1192500c7174b7d8e6f6fb4c1fb701342b

SHA512
e944b0ae50a48f7e822fe2dca82448a869c6d234cd34adc7c4e55fb364172e9a136c336d3aadcd368189a0d4e94a4c4549eaeba47a6f0c6037351a38eb81d89d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs.js

Filesize
6KB

MD5
b05b8ccc612e02ed252f887eb9d88208

SHA1
b3c5e06445fa3f119fb8d820dc84f728dbcc9bd8

SHA256
be8c1d87e0bfb4a45f0335759b3820aa2980258c26f59e63f661bf324f91a2b1

SHA512
2f3f58ca80ce3c3ca1299e699f717f4346d627f51f32a0050e7e5b77f5bd2fda9c8cfa9447f42fcac0fcfe46689a81854509edc1e6532433b99a7ae5c8979705

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
984bc6d4af88af338e45c0427ec144a1

SHA1
07e59c8b70ebb24de557bd588e5e654ba3c466ff

SHA256
2ac8c469dbcba0eea329132a1063de52b10126cb8e7de16a8389c55eb5336fa3

SHA512
6e9c3f2232185926cfa606d2683fb20d6601289429077c1779f0b1ae4579b0a3e951bdc076738c1bff1244a106bac73da1a86f11c418dd641fa21a0e20763833

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
9f51faf9ea2bc4b172fbdf42463a5196

SHA1
8077027906656113dd80feead026975a3b4e41cd

SHA256
6d5cb154c4a4e9e9c7cac694e6834ab68f48e7daa0e15b7291a5c684d2a88431

SHA512
87f7f6912d521e3ff9ca5671055ec721c39c3d8c1055741863803a0702616a4d98425f5b8a309576d689466129ed2754cf0b22a0d081b7cb6d11d6b9e41a4e76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a4bfa3aa178f23c7f754bff84d6cb18e

SHA1
def39b566f7de5ced80c9fd5bbd23cf8058a80f9

SHA256
7800515b5c1780685845d08f7a87eecf20a2ee39656640e818447615a0c11dbc

SHA512
d3d68756a647b020ffe00a095574db1fe13404e03aa96f6497f346e32dd494173013fa97a44572a866750b91e3c064dce4c40da0cbcf911afd9336b9a4a48eaa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\storage\default\https+++mega.nz\cache\morgue\223\{577067e6-2139-496a-a071-4750e867c2df}.final

Filesize
1KB

MD5
3efa9abd92666265dd81c4f4311a96f9

SHA1
41b6b716d67b93555e444cd453f3c6e3f8c9522c

SHA256
5066b1841e8877db31312ef3af86f9bc9234c95071119e025764f45241a4e2e7

SHA512
5961950f077501608a0f2975e7f69c483eeacc4eec4ac77fd650cc1131609501f87819f93ed23aa508a90426156abf038a859fac4112d2d4435bbb634027cd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\storage\default\https+++mega.nz\idb\3713173747_s_edmban.sqlite

Filesize
48KB

MD5
4e6fc5ae022209213189891e021c7db6

SHA1
8afe4dac4a15668d4c448a9dceb97c5100f7fc95

SHA256
0a13b865338f1f89e5c376465f0bfebdc80a350738f4d393e62fc31e42ac24ff

SHA512
02a132e689c573560d9ff4a32e4cd717521dfe3105b0abaec139d34c00ce51cf7ca65c5a2235a3deaa755f157923cdd6d30d02371ae4d07bdb3ce08157d71419

Download Submit
C:\Users\Admin\Downloads\dtcnu3Xa.zip.part

Filesize
3.8MB

MD5
7d27ec5f0c753d6968efcbb9d90e60e7

SHA1
0b934d310fb9bf7ef04addd2a135b8441b8ca241

SHA256
b5e5be2e891c665402f992457b06743f6f6b6eb64650da6a56e3d2d971b95173

SHA512
0510f81353fffd041510574d0fb184cae067b3aa459115e64e68e597b4ede511fe4c35125f0a85eb99bd8a32fffd49f4c56725cb26dd77d44a5941a4a5249910

Download Submit
memory/3084-492-0x000001B635800000-0x000001B635840000-memory.dmp

Filesize
256KB

Download
memory/3084-493-0x000001B64FDD0000-0x000001B64FDE0000-memory.dmp

Filesize
64KB

Download
memory/3368-498-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-500-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-499-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-504-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-505-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-507-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-508-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-510-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-509-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download
memory/3368-506-0x000002C49D100000-0x000002C49D101000-memory.dmp

Filesize
4KB

Download