hxxps://github[.]com/ytisf/theZoo/tree/master/malware/Binaries/VBS[.]NoMercy[.]B

Analysis

max time kernel
106s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ytisf/theZoo/tree/master/malware/Binaries/VBS.NoMercy.B

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
32	raw.githubusercontent.com

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 8c0031000000000056586d63110050524f4752417e310000740009000400efbec552596156586d632e0000003f0000000000010000000000000000004a00000000005b13b200500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\VBS.NoMercy.B.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1984	Winword.exe
1984	Winword.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4472	OpenWith.exe
3300	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
3300	OpenWith.exe
1984	Winword.exe
1984	Winword.exe
1984	Winword.exe
1984	Winword.exe
1984	Winword.exe
1984	Winword.exe
1984	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 252 wrote to memory of 1704	252	firefox.exe	78
PID 1704 wrote to memory of 2452	1704	firefox.exe	79
PID 1704 wrote to memory of 2452	1704	firefox.exe	79
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 4840	1704	firefox.exe	80
PID 1704 wrote to memory of 2204	1704	firefox.exe	81
PID 1704 wrote to memory of 2204	1704	firefox.exe	81
PID 1704 wrote to memory of 2204	1704	firefox.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/ytisf/theZoo/tree/master/malware/Binaries/VBS.NoMercy.B"
1⤵
- Suspicious use of WriteProcessMemory
PID:252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/ytisf/theZoo/tree/master/malware/Binaries/VBS.NoMercy.B
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.0.641673168\1829091063" -parentBuildID 20221007134813 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eab65008-8c91-4669-8a3f-ecf38af89b9e} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 1864 22cd42da458 gpu
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.1.734751120\275967402" -parentBuildID 20221007134813 -prefsHandle 2236 -prefMapHandle 2232 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a84b0e7e-ee00-446e-8457-7fff50edb5a5} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 2264 22cd41f0d58 socket
    3⤵
    - Checks processor information in registry
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.2.1458716951\1306677775" -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 3200 -prefsLen 21666 -prefMapSize 233444 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1653c73-2a84-4308-a496-1f030a51b8c2} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 2756 22cd93e8358 tab
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.3.1807920801\1862077928" -childID 2 -isForBrowser -prefsHandle 3740 -prefMapHandle 3736 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12d813cc-1916-4bba-b68f-84d67d278dec} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 3752 22cc826a958 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.5.1563542768\1334524090" -childID 4 -isForBrowser -prefsHandle 4908 -prefMapHandle 4912 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db35d013-9329-4c0f-930b-f994fd56c830} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4772 22cdb867358 tab
    3⤵
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.6.633358200\554099466" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d6f4880-326e-47a3-8375-adc38017e029} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 5092 22cdb867658 tab
    3⤵
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.4.406561862\1044054534" -childID 3 -isForBrowser -prefsHandle 4740 -prefMapHandle 4736 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1290bd86-6317-4489-8868-c7781b2e9246} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4752 22cdb868e58 tab
    3⤵
    PID:2244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3300
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\VBS.NoMercy.B\readme.1st"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\VBS.NoMercy.B\HTML.NoMercy.b.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc7a5d3cb8,0x7ffc7a5d3cc8,0x7ffc7a5d3cd8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,6057579462647012365,7729799440676358502,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,6057579462647012365,7729799440676358502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,6057579462647012365,7729799440676358502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,6057579462647012365,7729799440676358502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,6057579462647012365,7729799440676358502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
601fbcb77ed9464402ad83ed36803fd1

SHA1
9a34f45553356ec48b03c4d2b2aa089b44c6532d

SHA256
09d069799186ae736e216ab7e4ecdd980c6b202121b47636f2d0dd0dd4cc9e15

SHA512
c1cb610c25effb19b1c69ddca07f470e785fd329ad4adda90fbccaec180f1cf0be796e5628a30d0af256f5c3dc81d2331603cf8269f038c33b20dbf788406220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a91469041c09ba8e6c92487f02ca8040

SHA1
7207eded6577ec8dc3962cd5c3b093d194317ea1

SHA256
0fef2b2f8cd3ef7aca4d2480c0a65ed4c2456f7033267aa41df7124061c7d28f

SHA512
b620a381ff679ef45ae7ff8899c59b9e5f1c1a4bdcab1af54af2ea410025ed6bdab9272cc342ac3cb18913bc6f7f8156c95e0e0615219d1981a68922ce34230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43cccf2b07eca51675499962fad2835a

SHA1
ccacc47c452ba4278432515e3bad6afcd74f94c9

SHA256
ab542bac1addcb34813517b6d2470742505effb083859b50f94946ba296ecc78

SHA512
dc754f52cc876622eb13532b8dce817782bf7b74c0604a058da4269b175d89e1a9384eca6e4778e96ecedf29d2f8bd2b692baa2959da5edda8d49a35e177806a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80d5ba537a02866d0f234ff5de9359d6

SHA1
c41538b051d69a2a105f22cb818e2dbca3d0b472

SHA256
fbdaa1621cf7ef3f46c176ebba3442024be097bff327df4f1f548274c7a7426e

SHA512
3b3d117fd2886c269db386a01bee5f947a49e372230ce4adc2b9cff50807675d8abbf222a140f9f48260d6b52934c57bfc092a3d433218bc396d7a00ed55f90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffc2206e0bdee301ef2b5512882386fc

SHA1
26f6299796a3973dd0736e0e3e235e74754bc44d

SHA256
abd1111b544a60d3005982afad93412423c17922876c4983bea3de2126ff146d

SHA512
42097b0f2e9f55d11009ed07b63ae6c905e15cc2390ca0d78199b3e973eed90eeb069b508c2c8eaca382a4801a7ce85d0f0879810b5f6ab2fac54561ba1a2037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
534e84e21c29fd1616309eca868229bc

SHA1
c74832799fa38ba5181b1a421c156437917e2216

SHA256
9cabc05b3508916cffdd71fe6b30d33494354f960279b6f239d61e1f057122b5

SHA512
e5779152486c562a6ee0258b10655213d5631ebeae2a5dd9d74d55ecfdedf6cbd86cbf51d7a02c836989398d57d77318608a2428f919d390df9568437d9f51b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
238B

MD5
d778a1b63c4c546a1ca67eab311b0939

SHA1
f0c083dad8430105f343f8e399556d78c45e30f7

SHA256
f21c9ed6cd0959a2d89193dc0da7c2fa840dd15e56bd617a0a6928d29eb6dbad

SHA512
cc3d5ac3e0286ca922812250c65d449b7557f06c5598b86889a0d37f8653e7c8ab646fda388db2c30e73ae0e105798ddb53639e22cb8babb206629325ad4074d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
2d0cb39f2885502080e93b217291f3bc

SHA1
ad17de7248f44d3799ead28694fd3120f12fa08c

SHA256
513838b5bca65d6609fb71834f0c76e948205b079087c10d5f1c65deab910067

SHA512
b8756235b55eb3d3302d78a5e666971f9d42acb776ff1dc418366e7be7001415e47668b04f3efc4a039af15f9d82071ab57ceba41ed92c643cc654c36613fd41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\535c8c33-3d6b-4cfc-88bb-d787b05f99e6

Filesize
12KB

MD5
0c1b4f1961173243b51216d7a4f4c7b6

SHA1
4b03553ddea8644fd5060aad2c2b3f26ead952de

SHA256
ba052d5698ac4af699a6d32ccc5421554cf31f1b0f82461ba8a4337da4cca41b

SHA512
bd2504d8d9550bb3c7d4501a1455a9e058055b7c037f30d480fc7897ae8947118c65e01b9150c15fd6a376d1df5f5f4dc77aead427817183dae35de6a7202869

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\e29cafd4-7803-4ed3-a5e0-1afa50bf85ed

Filesize
746B

MD5
9d3a073107f893d4b8b71c5458f744e5

SHA1
8d1a3bf49c1bc1f67d03b3bcbcc331b68c647ed2

SHA256
c1ac5a8f889aca07aca14cde6f0e75b634f8c6358abc6e41ed39f08a5a13f47f

SHA512
fdf34b4f50a4b9fe01c2062f921ce165fb363e1ef6b9576b8805aca39c17835ebc5aacde3e6d5ea251eb66fcdeb6e51b3bf7ab9cff04a8bd933e5b66379cf25e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

Filesize
6KB

MD5
2245c11fe83ca2187943a6ae54c90504

SHA1
26da4452aa1e98dea39298faf520c3bbe9a66c73

SHA256
eabede2af24765c4896be14c492dd044e757526cd50fa9352232b6066592a378

SHA512
799eee1a4c9fc4ad093cf1208c25928294ebc1013aeca4de8a0f0c0b966056faeae0f4e85ce0e55cb521f3641bafa09c81a952303f17a0fdd316c1501689b067

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

Filesize
6KB

MD5
ce884a7dd17a9a57930f1c41668b3acc

SHA1
58780ab758ce6605721224892b25779bc07781e6

SHA256
030698ecfd1c910dd79acbbfd499c6871aa5579d1fc9139057252b77aaf62c94

SHA512
c13512e49d5b7c7139bd9729354f7925e06c8e7010874231395c5cb2820aa3378ea888fcd7e9b8a070adb56863bf5eddf8082c909f4ee50cc4277401c587d393

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs.js

Filesize
6KB

MD5
575fa6267b38498309e2a9f30746872c

SHA1
58940c1c5b003a6c4cae5198e3960549e9c1561f

SHA256
d966084ebb470cca01c68521df699cb829310958efe0e4040a23a6a7b13a2a69

SHA512
adbb8becee37a134d9efb5893ed7a111a24b836c22fd141fea0199951ba61108c2095d9d562783f7b6addd54ccaa8a533f92410729b6fca47e3c7d3caaa94cb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
c89aac67d33b2cdc0b5521985dd9e89e

SHA1
087048db97641990a0928a28cd391df463c9a036

SHA256
a9ebb3ec5f8867979b84db23b79d41e3cc2a18a1a6a332d87558ca97137c121d

SHA512
3fddca2daac8608c37de7e57566e5f9fc673b61178f6810f0cb2e09645c5476aec772922e19e1fd89ac5d887d9231435d2966a7a1180c2919d900430417de1db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
63ba033cea059c0c818fe3bb79ce6b14

SHA1
84b7652e1e619de50b4dd9f7822eae14d4d9a9e1

SHA256
86a589536c02effa2814fa1b6f175b7f1ec1094c7ee407d30eae349bb2a6b09e

SHA512
fde40d70d42efd925fa1662ce8ea3b8d1c30f84940e366847a394ef75eaf635faed91477d27b931ab02ce60402d3adfd4c3dda530f41e75f1f5732d655168e90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
e909fbbb359e260a840ec2c8e187c6c6

SHA1
4adae1343ce7d0ec44c91115c3f726fb43bd8b4e

SHA256
ff27ecacd23437cd626c6970ef5711562bf83408291188afb3139298269f65ac

SHA512
39a1ed0718e7342db49c4d1a76a8cfbb44789e796bbf5212b564ec8a8a3e65ae1e1a360255db76efe62a7f10077b77e1a6ed86db915aff17b3241642bd16cc32

Download Submit
C:\Users\Admin\Downloads\9DbbQ7r2.zip.part

Filesize
2KB

MD5
fe8aa88331fc7d50e1b6cdfed2e1a083

SHA1
b6e743d8589c7a13c710fba962b6eaa33a96a8aa

SHA256
5dcedafac1544eea7083b7aa494a551aac9996472d2806194024c93d79f4571c

SHA512
b39936ec558adb8b0ce04e5799ca8fff333779ffa1c5b4d424983ffb4dad62137afc31afeb86b91977c5202dbdd94bdd90599a666e8bfaf98d3e21bd6d35c598

Download Submit
memory/1984-310-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-292-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-307-0x00007FFC59450000-0x00007FFC59460000-memory.dmp

Filesize
64KB

Download
memory/1984-306-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-308-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-309-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-301-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-312-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-311-0x00007FFC59450000-0x00007FFC59460000-memory.dmp

Filesize
64KB

Download
memory/1984-314-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-316-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-319-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-317-0x00007FFC9A270000-0x00007FFC9A32D000-memory.dmp

Filesize
756KB

Download
memory/1984-315-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-313-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-294-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-300-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-351-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-350-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-349-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-348-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-352-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-353-0x00007FFC9A270000-0x00007FFC9A32D000-memory.dmp

Filesize
756KB

Download
memory/1984-296-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-299-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-297-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-298-0x00007FFC9B7C0000-0x00007FFC9B9C9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-295-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-293-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-291-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download
memory/1984-290-0x00007FFC5B850000-0x00007FFC5B860000-memory.dmp

Filesize
64KB

Download