hxxps://vk[.]me/join/AJQ1d0NzWSnZK/9ZF5gMuCim

General

Target

https://vk.me/join/AJQ1d0NzWSnZK/9ZF5gMuCim

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 49 IoCs

Processes:

explorer.exefirefox.execontrol.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).y = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e00718000000000000000000000e4c006bb93d2754f8a90cb05b6477eee0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "677"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).top = "77"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 0c0001008421de39050000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).right = "1002"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).left = "202"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

4700 explorer.exe

pid	process
4700	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

firefox.execontrol.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	4188	firefox.exe
Token: SeDebugPrivilege	4188	firefox.exe
Token: SeShutdownPrivilege	1900	control.exe
Token: SeCreatePagefilePrivilege	1900	control.exe
Token: SeShutdownPrivilege	4700	explorer.exe
Token: SeCreatePagefilePrivilege	4700	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exeexplorer.exe

pid process

4188 firefox.exe
4188 firefox.exe
4188 firefox.exe
4188 firefox.exe
4700 explorer.exe
4700 explorer.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

4188 firefox.exe
4188 firefox.exe
4188 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

4188 firefox.exe

pid	process
4188	firefox.exe
4188	firefox.exe
4188	firefox.exe
4188	firefox.exe
4700	explorer.exe
4700	explorer.exe

pid	process
4188	firefox.exe
4188	firefox.exe
4188	firefox.exe

pid	process
4188	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4224 wrote to memory of 4188	4224	firefox.exe	firefox.exe
PID 4188 wrote to memory of 2732	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 2732	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 3724	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 5016	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 5016	4188	firefox.exe	firefox.exe
PID 4188 wrote to memory of 5016	4188	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://vk.me/join/AJQ1d0NzWSnZK/9ZF5gMuCim"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://vk.me/join/AJQ1d0NzWSnZK/9ZF5gMuCim
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.0.1215086066\822303092" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b3eb80-b015-4692-9373-355a61f795e9} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 1976 1877ceef158 gpu
3⤵
PID:2732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.1.243115085\1041257767" -parentBuildID 20221007134813 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {930622a4-40c0-454c-bd52-43b35f5eb94d} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 2400 1877cdfa258 socket
3⤵
- Checks processor information in registry
PID:3724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.2.30578444\780399275" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3240 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1180 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9de2ccd-6184-416d-9bf5-6dcf834bafd1} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 3204 1877ce5d858 tab
3⤵
PID:5016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.3.82886682\63437061" -childID 2 -isForBrowser -prefsHandle 3988 -prefMapHandle 3984 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1180 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5775a15a-83ec-4ed3-b152-b235f5029cb3} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 4000 18703434e58 tab
3⤵
PID:3748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.5.1867727077\562493935" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1180 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83ec4ea8-b856-492a-8c42-07b2443adfa7} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 5020 187046a7358 tab
3⤵
PID:2936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.6.1574191771\602840784" -childID 5 -isForBrowser -prefsHandle 4828 -prefMapHandle 5040 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1180 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f618f0a6-49eb-4f5f-8dc3-1806a865a438} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 5020 187046a5b58 tab
3⤵
PID:2688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.4.667663302\458722572" -childID 3 -isForBrowser -prefsHandle 4760 -prefMapHandle 4740 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1180 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b474318-8e08-4c9d-964f-abf60190e292} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 4784 187046a5258 tab
3⤵
PID:4676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4188.7.1946875237\1299083967" -childID 6 -isForBrowser -prefsHandle 5524 -prefMapHandle 3168 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1180 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1af7f476-3042-442f-95af-edf57ceba174} 4188 "\\.\pipe\gecko-crash-server-pipe.4188" 5584 18705795d58 tab
3⤵
PID:2752

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\WaitEnable.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:1916

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\im gay.txt
1⤵
PID:2596

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\671ddd60de3d46b194cf254ea8a44ccd /t 1648 /p 1916
1⤵
PID:224

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uzw33i5d.default-release\activity-stream.discovery_stream.json.tmp
Filesize
22KB

MD5
e0c2d61ba2442a43e35b2fea02861178

SHA1
3bd8f632d1819bca9669279dfeac942257ff6152

SHA256
3613462e04766766c97b9e0bb926a5e5b342948560fad1e84a85cc4ca16e2f44

SHA512
8eae86b5dc71a9e15afa2d899fae89246e3f48825e12d5099b0e97b9a0e87b02627b05d0ef3c1d6a3aa275ed4e01fa3ce03c8e03f2772bbb2e6768fb3baa4be5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\prefs-1.js
Filesize
6KB

MD5
803f79a9ff0832f21587cc7494f3d0aa

SHA1
f4976adbb744bcd7fc6d87752848e220b96ed723

SHA256
e6b820212ca97f95e16777c1ab8f9481c1ae9b4211292d513281d7057defa1d2

SHA512
f07647f4f55a665bcc736a6b32dc637c87c67030d77b9be639123447624a7ec404719fea8872759d604fc165e071e754161a9cbfeb4a959a87726695694b31de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
cf907666f7d15f4fa812032b528e3297

SHA1
115fb4a22b163b14831f98aa2b69b79a86f8bb9b

SHA256
1ec5d42e906f134fc53c570c6f2d3cb9afb9fc72efadb3c55b1c18fd63c94110

SHA512
1c7869284e90effd38904412dc5f3848d5e585c75946fd18ea45429a9f9054d97922017dcb840af10a86967313cc3daabc209b9f2320db00428acbb317e90515

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionstore.jsonlz4
Filesize
10KB

MD5
994f24ce13d1610020154e64fb446553

SHA1
a103226edfdb370b8cd2815e85b556d03aa84ada

SHA256
2d0bb57c8af3e319d93fe0077b033beb6e03bb2f729776e2290f70919996f32f

SHA512
d6bb034b52db7ac9e1c5c3c8be120591500cb1c2235f1885a3b34313409f32e8530194d9fddb71341ec78ca13f36569dbd6517f3fb8e976af896db39ecd3889b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads