1f4f7b787ee329059e4de4487ba5c17c7c6ca3be95b72c9873fc9380632fa1f9

Resubmissions

04-09-2023 00:33

230904-awfdesdb38 8

03-09-2023 23:32

03-09-2023 22:36

27-07-2023 15:08

27-07-2023 15:03

27-07-2023 14:59

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2023 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Castle of Temptation_6hiiU-1.exe
Size

13.8MB
MD5

98f37b09dadc616079b92a6c5afdd066
SHA1

b55932b9c10046cfccde0210d5da29f3e5b2afb9
SHA256

1f4f7b787ee329059e4de4487ba5c17c7c6ca3be95b72c9873fc9380632fa1f9
SHA512

6e45a6fe9d35350be799fa95d7aa12a960695d94dd99ff581c17685b94c1e8b4ba618dc5d3932a7e0ce63c676471caeb6bc2ee40e1c644ae7848bf0db286a26f
SSDEEP

196608:0j6kU9NYlObEk0Lp2dd/kZzkmxgy9NSW7I7GIXSpINbhiTGIwTh3kC3uDEN9TrSh:mLSN30LpEiSCC9XSpIFwah3RuINhkUU

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

3956 netsh.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

qbittorrent.exe

description ioc process

File opened (read-only) \??\F: qbittorrent.exe
Executes dropped EXE 2 IoCs

Processes:

Castle of Temptation_6hiiU-1.tmpqbittorrent.exe

pid process

2940 Castle of Temptation_6hiiU-1.tmp
1372 qbittorrent.exe
Loads dropped DLL 3 IoCs

Processes:

Castle of Temptation_6hiiU-1.tmp

pid process

2940 Castle of Temptation_6hiiU-1.tmp
2940 Castle of Temptation_6hiiU-1.tmp
2940 Castle of Temptation_6hiiU-1.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3956	netsh.exe

description	ioc	process
File opened (read-only)	\??\F:	qbittorrent.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Castle of Temptation_6hiiU-1.tmpfirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Castle of Temptation_6hiiU-1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Castle of Temptation_6hiiU-1.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 17 IoCs

Processes:

qbittorrent.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell\open	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-LLFVH.tmp\\qbittorrent.exe\",1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell\open\command	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\DefaultIcon\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell\ = "open"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell\open\command\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-LLFVH.tmp\\qbittorrent.exe\" \"%1\""	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\.torrent\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\URL Protocol	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\magnet\shell\	qbittorrent.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 35 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

qbittorrent.exe

pid process

1372 qbittorrent.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

qbittorrent.exe

pid process

1372 qbittorrent.exe

description	flow	ioc
HTTP User-Agent header	35	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

qbittorrent.exefirefox.exe

description	pid	process
Token: 33	1372	qbittorrent.exe
Token: SeIncBasePriorityPrivilege	1372	qbittorrent.exe
Token: SeDebugPrivilege	2028	firefox.exe
Token: SeDebugPrivilege	2028	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

Castle of Temptation_6hiiU-1.tmpqbittorrent.exefirefox.exe

pid	process
2940	Castle of Temptation_6hiiU-1.tmp
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

qbittorrent.exefirefox.exe

pid	process
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

qbittorrent.exefirefox.exe

pid	process
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
1372	qbittorrent.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe
2028	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Castle of Temptation_6hiiU-1.exeCastle of Temptation_6hiiU-1.tmpfirefox.exefirefox.exe

description	pid	process	target process
PID 4616 wrote to memory of 2940	4616	Castle of Temptation_6hiiU-1.exe	Castle of Temptation_6hiiU-1.tmp
PID 4616 wrote to memory of 2940	4616	Castle of Temptation_6hiiU-1.exe	Castle of Temptation_6hiiU-1.tmp
PID 4616 wrote to memory of 2940	4616	Castle of Temptation_6hiiU-1.exe	Castle of Temptation_6hiiU-1.tmp
PID 2940 wrote to memory of 3956	2940	Castle of Temptation_6hiiU-1.tmp	netsh.exe
PID 2940 wrote to memory of 3956	2940	Castle of Temptation_6hiiU-1.tmp	netsh.exe
PID 2940 wrote to memory of 3956	2940	Castle of Temptation_6hiiU-1.tmp	netsh.exe
PID 2940 wrote to memory of 1372	2940	Castle of Temptation_6hiiU-1.tmp	qbittorrent.exe
PID 2940 wrote to memory of 1372	2940	Castle of Temptation_6hiiU-1.tmp	qbittorrent.exe
PID 2940 wrote to memory of 1372	2940	Castle of Temptation_6hiiU-1.tmp	qbittorrent.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 3876 wrote to memory of 2028	3876	firefox.exe	firefox.exe
PID 2028 wrote to memory of 4452	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 4452	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe
PID 2028 wrote to memory of 3620	2028	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Castle of Temptation_6hiiU-1.exe
"C:\Users\Admin\AppData\Local\Temp\Castle of Temptation_6hiiU-1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616

C:\Users\Admin\AppData\Local\Temp\is-JU157.tmp\Castle of Temptation_6hiiU-1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JU157.tmp\Castle of Temptation_6hiiU-1.tmp" /SL5="$40060,13603942,780800,C:\Users\Admin\AppData\Local\Temp\Castle of Temptation_6hiiU-1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\netsh.exe
"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\qbittorrent.exe "qBittorrent" ENABLE
3⤵
- Modifies Windows Firewall
PID:3956

C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\qbittorrent.exe" magnet:?xt=urn:btih:BFF18AF5608F9196CF05BF0C1F0B54A18C3F0A77
3⤵
- Enumerates connected drives
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.0.1123652579\1833568302" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1576 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {549afd76-13b1-4a4b-b997-b50c9bb1ebac} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 1948 1bda67b4858 gpu
3⤵
PID:4452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.1.1568863523\1129915643" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {141ca004-b034-4cfe-8397-17a814f9f702} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 2348 1bda6331758 socket
3⤵
PID:3620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.2.482008444\1636056494" -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 3012 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea977a7b-650c-45bf-b109-31165e88942b} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 3284 1bdaa9b8258 tab
3⤵
PID:2296

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.3.1290449025\1389408926" -childID 2 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48069c10-7c4e-46f6-ad2b-6712d9911ffc} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 3604 1bda942c558 tab
3⤵
PID:4844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.4.838362191\1483350078" -childID 3 -isForBrowser -prefsHandle 4504 -prefMapHandle 4500 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {503e5dfc-3791-4b52-9279-0d21c3247e69} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 4516 1bdac917e58 tab
3⤵
PID:1492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.5.341219336\1125058366" -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5200 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c393ef36-0c10-4d50-b01f-6f6b258a9e6b} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 5172 1bdaa936b58 tab
3⤵
PID:1612

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.7.2117840770\772111778" -childID 6 -isForBrowser -prefsHandle 5560 -prefMapHandle 5564 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {030073c0-e2ea-4fec-a03a-d3ae1d2c56b3} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 5552 1bdad5f1258 tab
3⤵
PID:1200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.6.522334561\1358688645" -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c437c60-52a5-4098-ba96-3f4ff5748f0d} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 5360 1bdacdfc858 tab
3⤵
PID:2828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.8.1322611419\1694048617" -childID 7 -isForBrowser -prefsHandle 2828 -prefMapHandle 4212 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a3bf82-d69a-404d-9a07-e612b37f2806} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 2840 1bda6aa7c58 tab
3⤵
PID:2532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.9.406531211\1643745364" -parentBuildID 20221007134813 -prefsHandle 6280 -prefMapHandle 6268 -prefsLen 26831 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d86a7ab0-0183-48ed-aaf1-cdf3ebf481dc} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 6288 1bdae231c58 rdd
3⤵
PID:5232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.10.997828007\1301929600" -childID 8 -isForBrowser -prefsHandle 6308 -prefMapHandle 6424 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f409362-ca03-4f0d-9c21-05c61d4ec7da} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 6432 1bdae89d858 tab
3⤵
PID:5268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.12.1258794897\1858477093" -childID 10 -isForBrowser -prefsHandle 6688 -prefMapHandle 6308 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {077de929-546a-4700-8580-7b20d6375229} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 4408 1bdad59bd58 tab
3⤵
PID:6140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.11.377022167\1826491292" -childID 9 -isForBrowser -prefsHandle 5868 -prefMapHandle 5604 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ce3ab49-641e-42c3-bf74-df83a5a91ab5} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 5184 1bdad59c358 tab
3⤵
PID:6132

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.13.1969641114\738426455" -childID 11 -isForBrowser -prefsHandle 5716 -prefMapHandle 5728 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47937d2a-811d-4ed3-93b2-6c7c9fa20975} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 5668 1bdaf49d558 tab
3⤵
PID:5764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.14.887164077\901354154" -childID 12 -isForBrowser -prefsHandle 10616 -prefMapHandle 7236 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7f82e23-446e-405e-b849-3b7093db4067} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 7232 1bdaf49c958 tab
3⤵
PID:3760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.16.1468201382\389603444" -childID 14 -isForBrowser -prefsHandle 7088 -prefMapHandle 7084 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50047ec1-3b5f-4465-a21d-772e91fdd1f6} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 6308 1bdb0480858 tab
3⤵
PID:5164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.15.807328393\957547866" -childID 13 -isForBrowser -prefsHandle 7056 -prefMapHandle 7000 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90a1bb87-f774-4a90-9baf-ba747497eb52} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 7068 1bdb0a36e58 tab
3⤵
PID:6120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.18.680790962\919310600" -childID 16 -isForBrowser -prefsHandle 5740 -prefMapHandle 2924 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11e76895-494d-46ea-9804-1227a10d356a} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 6612 1bdb0cc4058 tab
3⤵
PID:5680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.19.1692668817\1009191455" -childID 17 -isForBrowser -prefsHandle 10856 -prefMapHandle 10860 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d17dd9a5-4ec8-4954-b301-f1dc604fa0cf} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 10848 1bdb0c72258 tab
3⤵
PID:5704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2028.17.2133993424\1861204466" -childID 15 -isForBrowser -prefsHandle 10424 -prefMapHandle 5604 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1340 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e784da9-dba8-4f13-9bdb-4b2ea56f9893} 2028 "\\.\pipe\gecko-crash-server-pipe.2028" 10432 1bdb0cc3a58 tab
3⤵
PID:5684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\activity-stream.discovery_stream.json.tmp
Filesize
153KB

MD5
de0d7c12e9ac40f706ad44c785e8ad49

SHA1
0ab2bf711c34cff4c5bd61760b88a400bf538f9a

SHA256
b6f56e973b8dcaf1e6de02c7ed7d01677b19da5b7e0b6712472b861f04e66f07

SHA512
9ddb8544a22a985c040e877b7653f08892e036fd92cc0237e73eda360f1b1e6655dbf8e325159645bf01fddc56bfe4193d54bf28416407ebda14bee933ff4abd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\cache2\doomed\16537
Filesize
9KB

MD5
5e14ed7fed5f67958ab31ef234821890

SHA1
1d388f8d96bb944dbb34a0d8f1f7ea5251f4c7dd

SHA256
73a0433b9a60d5abaabaa7dce5c3d96c707484b4b36e7f4530913d967feae355

SHA512
6a055e3997a118d6773bac982d399ddc13a1ac64a90f10268cdedde4679981a1f14d7bc940d71c722c1d2ce6c061d4e7f06ee642c56a82aa21c08c23d3ef6e31

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\cache2\doomed\20611
Filesize
15KB

MD5
de4e1aedd581bea09ae0bd51bb38a06d

SHA1
4c77cec4c28b41e498905a5fb8773ac68c8d8f0e

SHA256
8a839690821c1de9749cd90d3b96195a819ad4804467e5f1d8326fc6a19704a2

SHA512
c68a4829ace9deea7fc4efe8581b79b46fe426cba13adbc2e7e70082224b0f991e587c3c85d5f1fde6c9c78b52e72c54b15394460ce6801f712a1f616492fc27

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\cache2\doomed\25045
Filesize
15KB

MD5
842955bf3c3b4804c129f35a3d48c443

SHA1
3d3878afb4880f77f325e93557de7fa4d7536671

SHA256
47bdfd98c8339797b6188a343d87b6fe7cd5711d6fea26809c30ad6166e4f45a

SHA512
9c561684f8b87c578a9b3c494bcaa56eb17738c41497b78997cc45d28d5bd0aa3c616c07a2e96a8b8ab5d5ef330bae9f71dd21a93b610b87d6e12cf8fd00845b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\cache2\entries\E5DAE692573E123C1B49DB02C333CB3DBDBFD568
Filesize
65KB

MD5
df036865cc6a1b8f6dbff5e1ccc5bb62

SHA1
e4a0d300d89f4f1ca79525de0241b1f52988ab34

SHA256
b54039a27cdaf7a8f65bd895bb1eddcd33f787c3ce655b2669e3aacfb79a1091

SHA512
dd9d8db589185de40b6b0278092810dcd12f5629e2975c2726029ac60da828dee96d80fe5bbfc5f3ed36ef5481e5f780fe7a2928948a02450c71a22d2d759b11

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JU157.tmp\Castle of Temptation_6hiiU-1.tmp
Filesize
2.9MB

MD5
669677fda69fad1e66ff28fe36ec5fba

SHA1
ce3bd4be74b75747e53180d283aaeb46a661da1c

SHA256
3f400a7b565cad7a3a7823e8dc24942f965b062a67f6a212cc5a2b256c85b096

SHA512
4e1940f56f7f314bf7c5d459f48a935bea6271c74cacdbb4e0da0bb18d52239c5b867d61a2849ff146a29f2557c2fa4921767bf1b8bd697eefeebe43d3b52d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\RAV_Cross.png
Filesize
74KB

MD5
cd09f361286d1ad2622ba8a57b7613bd

SHA1
4cd3e5d4063b3517a950b9d030841f51f3c5f1b1

SHA256
b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8

SHA512
f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\WebAdvisor.png
Filesize
47KB

MD5
4cfff8dc30d353cd3d215fd3a5dbac24

SHA1
0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

SHA256
0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

SHA512
9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\botva2.dll
Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\botva2.dll
Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\finish.png
Filesize
2KB

MD5
7afaf9e0e99fd80fa1023a77524f5587

SHA1
e20c9c27691810b388c73d2ca3e67e109c2b69b6

SHA256
760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0

SHA512
a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\qbittorrent.exe
Filesize
22.8MB

MD5
22a34900ada67ead7e634eb693bd3095

SHA1
2913c78bcaaa6f4ee22b0977be72333d2077191d

SHA256
3cec1e40e8116a35aac6df3da0356864e5d14bc7687c502c7936ee9b7c1b9c58

SHA512
88d90646f047f86adf3d9fc5c04d97649b0e01bac3c973b2477bb0e9a02e97f56665b7ede1800b68edd87115aed6559412c48a79942a8c2a656dfae519e2c36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\qbittorrent.exe
Filesize
22.8MB

MD5
22a34900ada67ead7e634eb693bd3095

SHA1
2913c78bcaaa6f4ee22b0977be72333d2077191d

SHA256
3cec1e40e8116a35aac6df3da0356864e5d14bc7687c502c7936ee9b7c1b9c58

SHA512
88d90646f047f86adf3d9fc5c04d97649b0e01bac3c973b2477bb0e9a02e97f56665b7ede1800b68edd87115aed6559412c48a79942a8c2a656dfae519e2c36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LLFVH.tmp\zbShieldUtils.dll
Filesize
2.0MB

MD5
c79e3df659cdee033a447a8f372760ce

SHA1
f402273e29a6fa39572163e4595e72bde3d9330a

SHA256
7d09715c4e0735a0832bf81d92d84600df1815a2ba451586bd25eb16f7c450a5

SHA512
490cc30ccfac209f1f5332ce4168b0dc849d7e4d86f3c198ddd23b39ddc950001928a1e071c2ace74c4710508265c0872adb02e3f068e521d28ed8b19ea36492

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs-1.js
Filesize
7KB

MD5
18e66435cbdb683058fa729192c11e9f

SHA1
7e6235202b07e0cde64d05a60699164e49701079

SHA256
f017965028fb9eee78bab7d91be7af39e7e9cdc83274f747856b7d174acad7b2

SHA512
70068e8207799911702d6ea6e55dcf70784eade45095487c2b5666cbb04f0f69bf5ec6796b20e22caa27e4b27a7db97139c4685e0ae7497731dadbac42ce55b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs-1.js
Filesize
6KB

MD5
8e541a942a6d47d727c91a6a724d5330

SHA1
43e24642bcad9e65b84b842008681e69f7a0675f

SHA256
6a0b71647f5fcd46f72b8edf460abbd39138c6629138b758dccb70af9f08f81e

SHA512
45fddbb5cf794884323888e35820b481c9828569d75f0e23f3c7cbba822b2f579af1862b02c46729c31f3a216ce957aa657c12fb5627576ed25bf8ec1efac5d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
a17ea957fbfe48a0a4a493869f1be05a

SHA1
6e9a1ba50b00456ab589ffd9c5f003a2bf7ecad4

SHA256
92ec6e6af6b855a72bea142be425114405b8de8080fb80b837fde5b6cbf5f0c4

SHA512
b9fbf671ce2093cea8162cef062e169d4ddcfa7264c4f7567768b4021d5390133e60b0a9f4496aece71ac98fb8f46f4bff3b15dea4136b7bacc1307b3ddd9aa7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
740f895979fe59a0e2040c96c885830e

SHA1
26c2d5c0f652980bc1da15762f6b30ffb5dc2642

SHA256
e7a55096216b1d1ddb59ba16f291e0b11c158769d64bc56ce8a65816d1969540

SHA512
5be33483d7f53ad4a8f4f6de42713db3fcae0903b27306022fb5f9ecb225b1f0b9cbff4a49981d9dd769384f09aca2168240aaad881db35544c06ca36853e661

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
9KB

MD5
7729e4ef308ad561f955b4b4da60dc6b

SHA1
c2b59ed0c450879fff14e4bd892b8a177b304953

SHA256
07816c8c62576fa3fd4635b1d5f4e38dea5eb2cbebdce43400eb1e37af364036

SHA512
fd7a355716117eb179f1308e5f2324c911bab74203e58d21e5a60a85bc241ee5cf4f65b6c5497a37b043eba41252f48c472ed8a19e765a97da23bac933c1b5d0

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
Filesize
1KB

MD5
1d5fca5f9fe1d751da7ec1e31820e944

SHA1
60309f31a8baadf18aa3a323587d6b538d11c691

SHA256
522748ed3e2466a35365b68ea499318d03e35862c61f9cbdfc2f0b3e1b5235e6

SHA512
8d4f19262b77a03c14561e9dca2c2532c35765d7211de0f2fce3768c74e92f1f3251b20d62302afa8e7b4511a365479c6ae431807a006a2d76d1783f28a4cdc8

Download Submit
C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
Filesize
4B

MD5
5b76b0eef9af8a2300673e0553f609f9

SHA1
0b56d40c0630a74abec5398e01c6cd83263feddc

SHA256
d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817

SHA512
cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d

Download Submit
memory/1372-190-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/2940-167-0x0000000004BE0000-0x0000000004BEF000-memory.dmp

Filesize
60KB

Download
memory/2940-203-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2940-187-0x0000000004BE0000-0x0000000004BEF000-memory.dmp

Filesize
60KB

Download
memory/2940-186-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2940-175-0x0000000004BE0000-0x0000000004BEF000-memory.dmp

Filesize
60KB

Download
memory/2940-174-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2940-158-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2940-157-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2940-139-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/4616-205-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4616-134-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4616-156-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download