hxxps://links[.]mail[.]service-airfrance[.]com/ctt?m=22412736&r=MTExNDk4NDU5MzI5NwS2&b=0&j=MjA5NjQ4MDM3MAS2&k=options_option_2_ICI_PROMO_ST&kx=1&kt=12&kd=https%3A%2F%2Fafricanrisktransfer[.]com/cp/?11=bWVnYW4uY2x1dHRlckB2b2x2by5jb20N

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://links.mail.service-airfrance.com/ctt?m=22412736&r=MTExNDk4NDU5MzI5NwS2&b=0&j=MjA5NjQ4MDM3MAS2&k=options_option_2_ICI_PROMO_ST&kx=1&kt=12&kd=https%3A%2F%2Fafricanrisktransfer.com/cp/?11=bWVnYW4uY2x1dHRlckB2b2x2by5jb20N

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "432756936"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4885326af1dd94bb4dd17ee5868703000000000020000000000106600000001000020000000b9cabece09bb0f77b6651f8ed1105abd1588542204ddca8b9a42e7d184615eac000000000e8000000002000020000000dda570d8587e5bd117e7de5176a88102fbbf06b36acb456f25e87f9f2f87181a20000000f063667d6c25c83b8508272137536e6ed4585fe3f13438ec18668bc34096adc3400000009682aee31ce3dfdb9eab67bba2710a10e34d533199d068d4697b418c0c16dcc0e65777690029e2bf78dcc7a7c0e04540adc0257234d72d3e7d00dde64adf8a30	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395356362"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "443225997"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "432756936"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00eacb1b85afd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c028e61b85afd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{45537FBD-1B78-11EE-84C0-CA4A694772C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31043461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31043461"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31043461"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4885326af1dd94bb4dd17ee58687030000000000200000000001066000000010000200000000f2417a9d731fdf059a0a35efb845eaf68f30c0090a920a0fcac9fa9afb6a39f000000000e8000000002000020000000949ee2a750e760e443c15218c4332064ed1721c5b5c20ab3dce9a0fe76f15cb42000000069ae681ac3dccaecd31c62da8fb99a83fcceb3b2ebdeae3aff778213c16072f140000000d0a9b1f8ec49dc5dafe7b1f768f656a26de624f274c9ef22f8158987172f95b761f345329360bfe841ef41ae7147cbfd562a99f1cd63eefb9304bd331f21a66f	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	firefox.exe
Token: SeDebugPrivilege	976	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
216	iexplore.exe
976	firefox.exe
976	firefox.exe
976	firefox.exe
976	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
976	firefox.exe
976	firefox.exe
976	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
216	iexplore.exe
216	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
976	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 2520	216	iexplore.exe	83
PID 216 wrote to memory of 2520	216	iexplore.exe	83
PID 216 wrote to memory of 2520	216	iexplore.exe	83
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 3396 wrote to memory of 976	3396	firefox.exe	91
PID 976 wrote to memory of 1468	976	firefox.exe	92
PID 976 wrote to memory of 1468	976	firefox.exe	92
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93
PID 976 wrote to memory of 3564	976	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://links.mail.service-airfrance.com/ctt?m=22412736&r=MTExNDk4NDU5MzI5NwS2&b=0&j=MjA5NjQ4MDM3MAS2&k=options_option_2_ICI_PROMO_ST&kx=1&kt=12&kd=https%3A%2F%2Fafricanrisktransfer.com/cp/?11=bWVnYW4uY2x1dHRlckB2b2x2by5jb20N
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:216 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.0.1243090514\896678091" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26354431-b213-488b-a36c-c6a4c1545906} 976 "\\.\pipe\gecko-crash-server-pipe.976" 1960 22e574ee258 gpu
    3⤵
    PID:1468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.1.1989441492\2069763365" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2324 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1ee6578-dd97-4e75-a894-97c2b76b4870} 976 "\\.\pipe\gecko-crash-server-pipe.976" 2364 22e57406e58 socket
    3⤵
    PID:3564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.2.1705406627\209322735" -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3112 -prefsLen 21012 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e4ce072-ba43-418f-8daa-f9819879b1e7} 976 "\\.\pipe\gecko-crash-server-pipe.976" 2900 22e5b1a0258 tab
    3⤵
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.3.2000465947\800447183" -childID 2 -isForBrowser -prefsHandle 3176 -prefMapHandle 3044 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1043c864-756c-4f2a-97e6-3954950dc1b9} 976 "\\.\pipe\gecko-crash-server-pipe.976" 3340 22e5c012e58 tab
    3⤵
    PID:884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.4.855160597\655548067" -childID 3 -isForBrowser -prefsHandle 3960 -prefMapHandle 3956 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef9af78a-17ab-461a-9061-275ea82a22ef} 976 "\\.\pipe\gecko-crash-server-pipe.976" 3972 22e5c011f58 tab
    3⤵
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.7.2103294258\990426383" -childID 6 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab5c67f0-1a6e-4019-97f2-b73f7b8e79fd} 976 "\\.\pipe\gecko-crash-server-pipe.976" 5312 22e5d6ee858 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.6.646775435\908526950" -childID 5 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f168080-057b-42f6-a8c9-02d1e5631ce2} 976 "\\.\pipe\gecko-crash-server-pipe.976" 5056 22e5d6ee258 tab
    3⤵
    PID:3112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.5.628905345\2065875354" -childID 4 -isForBrowser -prefsHandle 5028 -prefMapHandle 5016 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc7c7bdd-da5c-40d7-bc5d-680856bc6909} 976 "\\.\pipe\gecko-crash-server-pipe.976" 5036 22e574ee858 tab
    3⤵
    PID:1264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.8.810639038\176118111" -childID 7 -isForBrowser -prefsHandle 4736 -prefMapHandle 4780 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81ba4a7d-d89b-4481-8040-56e514eeca05} 976 "\\.\pipe\gecko-crash-server-pipe.976" 3984 22e5c012558 tab
    3⤵
    PID:456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.9.509528858\1603647130" -childID 8 -isForBrowser -prefsHandle 5032 -prefMapHandle 3968 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {024e0d30-3beb-4fa2-9792-2fb12167125a} 976 "\\.\pipe\gecko-crash-server-pipe.976" 4528 22e5cff8f58 tab
    3⤵
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="976.10.982282943\1748710052" -childID 9 -isForBrowser -prefsHandle 5240 -prefMapHandle 5248 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23fc32c8-b1bf-4e8e-b7ff-bf612d14fd0e} 976 "\\.\pipe\gecko-crash-server-pipe.976" 5276 22e5db95558 tab
    3⤵
    PID:4516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dwd4kki\imagestore.dat

Filesize
1KB

MD5
5674eaac3f2016f6c430ff71ea1803bc

SHA1
04b5278ba8ebb95ed1f53bbc07af2f9b18006b6a

SHA256
4e73dfa733ba89f2715d078900d6967c2ce54695867bb7a6ec977e9984120018

SHA512
f265ca77337a0d4456aaff32afaa9cfe723b8517d44297d74dd1f0c333f2801b0bd648a55d104602126c88b49ec1f4ea62af8b4773b9322446cccd925a6bab7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NB3GP0NJ\ART-Favicon[1].png

Filesize
1KB

MD5
394f695c46149616c4edcc355e335feb

SHA1
cd2f3b1b39660ba68b8b8a7b7e0eb4d5b9dc4a76

SHA256
0ec7f074e8cd71dfe92c07429f769c33e43a90022cfa7d2b6a6ce4e2359cb964

SHA512
32f30aed729323ff7463884e4761dd2e7227913b65a6ca8440a5acc8b41f93c9d2ed234734e6bfe9888adfdb0b92d7cc347357d6eead996da05e7e0886cfb116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RY8A9UY0\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\activity-stream.discovery_stream.json.tmp

Filesize
149KB

MD5
8dd10838cd0765e24b9b9d0b59350860

SHA1
b583fab408a9553a657d52bc553ccf386473344e

SHA256
910ead0c320359e7986af4260b973076483ea19b4157cd61cb1a84c45df97a23

SHA512
260391a4352f84b7d4781b98f35c6261b0caca1f361560dbc9e8d4cf188de77be0238259f9ebfb16b6e62cf22e69c57d37f2ffbead6e198019e53a86fa2fdbd4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs-1.js

Filesize
6KB

MD5
6f4865ff5af3c410bae7aab19b4ddb4c

SHA1
30b9f92b525a563432e24118d7317665e87cf840

SHA256
ca5964aa7a5d11fb3a4629a2502ab1f62d054d5c47f520c4ff134657959dd5a8

SHA512
1f0eeecd3b0bd084fe5436339729e5ff892428dce3bda5676172046b71d4a163180a453538a8e597c2e63a51d644ae8c2cb0826c4d448ffeaf695e428d887d9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs-1.js

Filesize
7KB

MD5
b088bd7be32a148874d142f7c2b4fc0f

SHA1
fa005793e16931741b13b1105249c9f0160aee87

SHA256
1d3e0e641a0d2a428a8b80bf19fa89b07f9dd38cdf834cf12e2d5dbd9023cc13

SHA512
00a5149c67fe5103d47eac556dd7bd5189a205e5cc2fb51083090da70e8fd9df7a678840ef2f4038ad3a63412afef4e205c1dff3d32ca26e9d4145152f01ac3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
8263c382d404eefcfe29d388b5e63093

SHA1
ec1eff09db5c14184e8cca9bf8359b4d5db9a302

SHA256
ee6afb5bf8448c8a5f44ba25676348b4603888289cb9b35b1570ec7f4c502e3f

SHA512
c8af0ed9ec04d8f874066d377f8b031b8aa8db91fca687516ba3398ea11407e948e6a3ae9a16bb48c16f3928925f9d4eeaf227479b1a350f829a549f3ccc67b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
53eeeebe2345fa2cd7391ebeb14d78b9

SHA1
2b013e3f52aace1fa168fb4128a707311ca97254

SHA256
65e44215719473f1cee55ff26140fdfc2de6b9451dff980823f7acad609bcc6f

SHA512
0edc925e292dabcca8673b68980cea9c3b33d4a4b9953a7058069a5720b19c64afce4efecc4131d9c1b8e2be830a87f87f7fef2b77fbd52569a0c43420a05855

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
1b4a1cc9e34651bee6bfe9085cafdf6b

SHA1
447df58277afa691f4ad1deb4ddc5f9879005e73

SHA256
a7a6746dc5ab860441d8abf33bdbb6fc7e0286168051edc3cf83c6eb91005ecd

SHA512
c6f688ce519a272b3cdc5ff5ea29093e95979c0eb46e4271ff987f5bd52030558759b43ed4f2f71f3fb1cf35f1d51342265b5f50d9c4c6b25e09f789cddacc68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
6aab27324a4c667e953d514ef02c0ac0

SHA1
2bfa205d740be3a6019038bffdd3671e72c6e927

SHA256
a415831aaf8aba0b11c16dab37952283429e48f9e5f3de9bc89a3d2aed8fbb3c

SHA512
ace22f1a35d4046cbad866af404f72e0d4b497a8d4de27e582429ab39597b133b42f173e13affb4dcf302852db0497de99b47f0971712ca5d0a95f0194601e29

Download Submit