75a3295f8c688359fcb7555b80e3f71ee42c5ac1d4525a39b2571107acf06a45

Analysis

max time kernel
149s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

modest-menu.exe
Size

16.9MB
MD5

ce03d8db32b901caba01fa8b1beefe54
SHA1

76377cea7317bd28af0ccaab276bd49360936a9d
SHA256

a568e2a4d89ab76ab9ff11b30bf320dcc4413353660678c51abc79863ff3c1c4
SHA512

40ef98ee1dd411d3f634f9fe1ccdac0bc8fa5d13b1392ac5d045bf130db6efc5ebae48298d02a732fe634af953af10c004d54c3a4d5862b7f9cd6736f6ddbfca
SSDEEP

393216:YwOMvc42XGU57JO0OTOUbHvnqdLNZHgbATTT9:Yeh2Xb1Ra4LNibATv

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	modest-menu.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	modest-menu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	modest-menu.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1204-0-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-1-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-3-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-4-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-5-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-6-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-7-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-8-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida
behavioral1/memory/1204-9-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	modest-menu.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1204	modest-menu.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1204	modest-menu.exe
1204	modest-menu.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	firefox.exe
Token: SeDebugPrivilege	3880	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3880	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 1748 wrote to memory of 3880	1748	firefox.exe	92
PID 3880 wrote to memory of 2340	3880	firefox.exe	93
PID 3880 wrote to memory of 2340	3880	firefox.exe	93
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 2336	3880	firefox.exe	94
PID 3880 wrote to memory of 3052	3880	firefox.exe	95
PID 3880 wrote to memory of 3052	3880	firefox.exe	95
PID 3880 wrote to memory of 3052	3880	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\modest-menu.exe
"C:\Users\Admin\AppData\Local\Temp\modest-menu.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.0.1302147194\1255685962" -parentBuildID 20221007134813 -prefsHandle 1920 -prefMapHandle 1588 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dba68cc-4c37-4761-9bbf-0fd56d593859} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 2012 1daff3d9a58 gpu
    3⤵
    PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.1.438484490\174264834" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {123aef9c-9ef7-418f-9dd2-9fa39bf01672} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 2412 1daff30a258 socket
    3⤵
    - Checks processor information in registry
    PID:2336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.2.2080762503\868048112" -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3156 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c550e9e-2631-45cd-abc4-e95e02c0d367} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 3132 1da85e9f858 tab
    3⤵
    PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.3.1680075788\709088381" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b455210a-b0db-4c80-8015-497972ad0bce} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 3572 1da8480ae58 tab
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.4.1036248570\1911102610" -childID 3 -isForBrowser -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7307496-f07b-43d4-818a-d8686cd803ee} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 4200 1da871d6258 tab
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.5.673919526\599872387" -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5184 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef0ae378-9173-4d64-94ab-6681723cd66c} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 5200 1da871d4158 tab
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.7.743304831\2096308566" -childID 6 -isForBrowser -prefsHandle 5536 -prefMapHandle 5540 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf91a347-f5bc-44d2-a86b-7ae3fc18c015} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 5524 1da882f0a58 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.6.40795494\1617259616" -childID 5 -isForBrowser -prefsHandle 5340 -prefMapHandle 5344 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e30366f-126c-4ea1-a41b-fa852248f7df} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 5332 1da882ef858 tab
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.8.352271377\1968172008" -childID 7 -isForBrowser -prefsHandle 6004 -prefMapHandle 6000 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84eebb58-794c-43a4-8827-fba5f62f3a06} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 5948 1da89efb058 tab
    3⤵
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.9.1249489793\723476117" -childID 8 -isForBrowser -prefsHandle 5304 -prefMapHandle 5212 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7b93b24-bb77-4e85-811f-fec68af120bb} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 6324 1da89c53f58 tab
    3⤵
    PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.10.1627842910\1637204268" -parentBuildID 20221007134813 -prefsHandle 4888 -prefMapHandle 5008 -prefsLen 26646 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {687fcd25-ed0a-4c84-8c9d-09e8be560284} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 5280 1da84807558 rdd
    3⤵
    PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.11.2037487501\422750844" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 10104 -prefMapHandle 10108 -prefsLen 26646 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6330ae46-9948-4bd0-a537-d816af2580a5} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 10112 1da8b5af058 utility
    3⤵
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.13.1988470162\40313790" -childID 10 -isForBrowser -prefsHandle 9704 -prefMapHandle 9700 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d516e3d7-daef-422a-85d4-ea5a6bd8ea58} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 9624 1da8b164a58 tab
    3⤵
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.12.1141807243\2058137846" -childID 9 -isForBrowser -prefsHandle 9860 -prefMapHandle 9856 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d0144a7-6579-4b10-aa50-7c8163b3e577} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 9872 1da8b165658 tab
    3⤵
    PID:2544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.14.1372490926\98605778" -childID 11 -isForBrowser -prefsHandle 9888 -prefMapHandle 9444 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebe48e75-efa0-42db-89d2-bc0ed311f8c9} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 9452 1da87b1af58 tab
    3⤵
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.17.1889808967\1048311975" -childID 14 -isForBrowser -prefsHandle 8724 -prefMapHandle 8720 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {816b0c16-007a-4f2e-ac0c-7b17c732d2da} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 8732 1da8c4bae58 tab
    3⤵
    PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.16.1697731729\1889707139" -childID 13 -isForBrowser -prefsHandle 8912 -prefMapHandle 8908 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ecf150a-7579-414d-be64-95100bd3c5ec} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 8920 1da8c698058 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.15.544856656\478460651" -childID 12 -isForBrowser -prefsHandle 9064 -prefMapHandle 9068 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d51248c-2c14-44f2-a7f1-dced3bae2c27} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 9056 1da8c54ae58 tab
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.20.350535709\1035026708" -childID 17 -isForBrowser -prefsHandle 8176 -prefMapHandle 8172 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd6ff070-e220-443b-adab-7da141194f20} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 8088 1da8c697a58 tab
    3⤵
    PID:5468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.19.207856485\2142799261" -childID 16 -isForBrowser -prefsHandle 8384 -prefMapHandle 8380 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b0349a1-a3ba-4ab4-b563-777b520e8620} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 8300 1da8ca26858 tab
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.18.218839267\1052260714" -childID 15 -isForBrowser -prefsHandle 8724 -prefMapHandle 8560 -prefsLen 26646 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1980df4-eb9a-4c9a-8267-14d6a0ea558b} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 8720 1da8c547558 tab
    3⤵
    PID:5448

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\ResetUse.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:6008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\cache2\doomed\18678

Filesize
70KB

MD5
ace07ff24bbd9ee87654a2eb035901a1

SHA1
33379b1bb5122358bd572e8d9022e2022448772b

SHA256
5c62100f0483b1b2cefe078dd66d25822d7d06cdba248cea3400d7dcf07a91c6

SHA512
80e9f58ea8eedd8493cc7dcef0137db2b2aeea8f4c445c4b0bf867d204d6861e21395738c5d441eaa94aa4f0b8f7e90cea5ca5b1e22a850b8e36ce9f9a4f3ff9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\cache2\doomed\22137

Filesize
8KB

MD5
a31496c5c12f963ba9de7136c478d145

SHA1
04c60c73d4de54f1ee2a5150a3a6718a2a81f23c

SHA256
d4510d5f726592d3648c44f285840a3ebe659f35f6882d02bbed8cb3899b2100

SHA512
090da31ac3240650a67d9b5aeb8acd2bb7e0c0f7b515b9250ccbbfc5c92016e02273ebeda280eee82d4adedb703a31edfcc5f292e24a79db13ed074a3e1ee044

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\cache2\doomed\25032

Filesize
9KB

MD5
c60617d25dac56cc5065cfc9c046b01b

SHA1
0e18152d7ddad37f32e9e6ae0573d546df587cd9

SHA256
8cbb7c968759a69cf51fc6a0388828a441f2c66699348ac1c30bc5f5816d138b

SHA512
f2c116cf0a29f7d589561be83e4716b8536d97406c89fdde969c3207f07b681a795d843fd5643df72a85afbf88481b9b452a9873b4056630124e65c6eeef5d67

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\cache2\entries\D8D58A0805DA7A0279B288AF39ABB5257C3D05F3

Filesize
120KB

MD5
342c88b35397ff7d937ed25326155f91

SHA1
754b98130b38561bb92411a02812a35bdea40bb1

SHA256
0947563f96532e9c0d3e2c4393ff4a44f0788dc10c18710977b0468b22f0b418

SHA512
5c08bd7303e82615caf6dbc74c4a92079f0dcbf4115caef113a27c2a9f5bab3129c4dcef82ae67b00968df446964ec47fd1f92db345321fd972d416aa35522b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b49e87f5bbfac24e2639cec971a9c252

SHA1
3704bc63733605b838282fe377402f71f64c00ef

SHA256
13378ddabe7252a52ea2d0a03b01f0666faf19881c1ad399672070d1bbfdffe0

SHA512
1d2d2dbf0a06000f60232de81fa52285ed4c7337568e5551e6d2a04f56f2b1f3c8f43da179ec085a7bb334f8c6b2fcc8e762d79ba6e85e65b59d3b0eb2aab695

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\datareporting\glean\pending_pings\33eeae74-c03a-4fc3-b296-62f7ab85a98e

Filesize
746B

MD5
24dd08b8e34a29fb729d485c493a64c0

SHA1
f28a160f867e401137a519147da7f9ed25b05f12

SHA256
c9651458507d508e37264164fc223049d68097b3cdc656ba487f2db210fd2f00

SHA512
ed0fd2efc16942c9b59bed36d77def5d670283e065f03419dabae8a0abc4f0aa32af2931ab7b5749afc162d3dbaa631a55fd5e0acf2f60fe979a5630e25ed659

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\datareporting\glean\pending_pings\37359fbe-244f-4024-a81f-9a6480dd77fa

Filesize
10KB

MD5
1d92fa33e61875637e11efb409fe0937

SHA1
008d206b38162b2d8ec4cc9aff716eb289352ae2

SHA256
959720d69248b2fa30fae71d519a1259ed548473176929a68b118327bb0bcdfa

SHA512
188cb4acf16bcaa4ed65903afe59aa318258d47c2d9f41daa48beabd8815559cca20df80fdf9d5948324ee135b01bf31f9d60565d2ca3be5cedd996bcd7afea1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\prefs-1.js

Filesize
6KB

MD5
20a011c6da71f1ffb233de59f9507e80

SHA1
363746c8c458ab9759c3020c8f774335ce0324da

SHA256
22c56c1d96a402656741ace65335b4e5a06d97bc96e891c91a0a98fd94d57278

SHA512
72123d5b2a71e376e88fa9361cd390ebb9dbb490ec2bfadeb880582cec0ebf47a1890af3b1d1d3673e6b99fe745fbadffff378aef0f88f8bc1e041d853a46287

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\prefs-1.js

Filesize
6KB

MD5
f42ae6a47474ca5e6df87db773eb1b36

SHA1
da1a2700d3a3d1f777cd6f49f0696ac63a474d19

SHA256
38484f815eb2d94d39dea2d45ea0d93fb0b6ed2822b224b1858f16f7b06f4625

SHA512
b1085f4f48bf0cec3857b396eccb2beeedf0fddbe2e04690fca377ba49e07be6682153341d6893e11e87f75ab041461eadc8be6faab08af10dfe4d8d798466e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1d375ae702a81e0d8e29ef786cc6a5ab

SHA1
211dba640cca08a3cf1ee5070daf5651437fa546

SHA256
2ff390c82f916e3ac7207ddeba7b38d722d75e695b6c22205a4e220201128694

SHA512
5e25063c7dd9ded88d47dd40285f6cc2e69d2f4207efb1a158cbc5c3055de34eefbf398f7f0c64513142f05d97a56e3e3406bc2d6e33aa4623bc832e69926543

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9b40714c46e423e8b50b2606c20c61df

SHA1
bbc9df677ee2d69e899eed7c8c4f9d3e02f21c86

SHA256
bd8001295defef35ee43aab3f1bb1bcc5645d4ad94d22dfed8671a49b1f9e963

SHA512
f196e7c836977b8c2fd6cf2fbe1f034c6260a08b2ea63397405626d67e8fda680a725c76871cf6173ae026c6ea717c52484533707a3132a64f47cce9c3af49f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
683e78c7b1786ab4037d6d03165150a1

SHA1
43788939580c4a70c52a8ecaa5f292b4ae9a7cbf

SHA256
1be162988ccb2054d99a76292018f9fa9ec156dd1a79d6b307c1196771f858f1

SHA512
10f77aafeec05adb976111936b2fcd3af3492b998ce4c5127e020ef62b38687d506858b9e4f78802d87e247c627af60bf28aecfafef8fceca0097a89659bd002

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e0364d21525098c8fbb86f8b9d847671

SHA1
3756fa446e4c758230323f81a2f256648a4868a4

SHA256
9410ae8cdf8264ce5b75208f2dabea0ed430fbaae34db55aa95bd7f3e53539c4

SHA512
6a5f6b285d96d3796fd67f4652b02d1d4018e705a495e6ed180a59fe67f3b95a8b97995d8af402bd2fe690e9f3596200d55062c02bc772211ac7488d973c2c6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
31dacc6f9bdd305f4ac112fbb99b19e3

SHA1
c037b70ceb6f2eb9c63daa4e7f90f6921598a1e9

SHA256
3918d956cf157a80083eb05afc09225f31c2bb1ce3fa76798f999548272c168f

SHA512
76ae9e02c871489bc851695e552a36959b17f7233ada31f4863d5267f1f02d380829859764903095ad18b4c1260fbb11f35a655a1042e3e0764bdf500779d077

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ubtcfhsb.default-release\sessionstore.jsonlz4

Filesize
5KB

MD5
dc8b18dfa4ee612b4e31a23a7809e837

SHA1
e23aa6c3c10118396514650d384563a06e0f14d5

SHA256
ce0aef1e3d401d7f9a22d2a0770f89d092505af68b3f7751e41dafe41f072afc

SHA512
dd217539e5cc4c2455d15cad738575be002fbaa294a31212486f14a9314d9f33dcf178ea4a2fa7b5466f4262ad70384aa6768c027b29286bc76417c24eaacc0e

Download Submit
memory/1204-7-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-6-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-5-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-0-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-4-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-10-0x00007FFBD12D0000-0x00007FFBD14C5000-memory.dmp

Filesize
2.0MB

Download
memory/1204-8-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-3-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-1-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download
memory/1204-2-0x00007FFBD12D0000-0x00007FFBD14C5000-memory.dmp

Filesize
2.0MB

Download
memory/1204-9-0x00007FF7FAE90000-0x00007FF7FD89F000-memory.dmp

Filesize
42.1MB

Download