chimera | 5698d21c2b45070e70349fd8c7358afcab0d36fdd5bac0a1f8174a1dd6d311b2

Resubmissions

11-03-2024 15:52

240311-ta6s2aeg21 3

11-03-2024 15:51

11-03-2024 15:43

11-03-2024 15:38

11-03-2024 15:35

11-03-2024 15:25

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nitr0-G3n3rat0r.exe
Size

23.8MB
MD5

f04a56628a19894bd9c0403757656f79
SHA1

1c4d8f4c61297d9128c5922b097c9a1619dea695
SHA256

5698d21c2b45070e70349fd8c7358afcab0d36fdd5bac0a1f8174a1dd6d311b2
SHA512

8f03e5b400d54a7569eaa6fffb408692cd35bdb498ce0b735cd4b49d6abcebed90e61c9246987abafbd30124b417db54f2f8fd93ed1b602b5ffb14944a824685
SSDEEP

393216:WuLrpBgQTSBfFZNRwSo6oDfDg4c6AHZgOGF3hi:r5BgQeBfFXR66ob03pZr63

Score

10^/10

chimera ransomware

Malware Config

Signatures

Chimera
Ransomware which infects local and network files, often distributed via Dropbox links.
ransomware chimera

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

Processes:

resource	yara_rule
behavioral2/memory/1956-268-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

Processes:

flow	ioc
289	raw.githubusercontent.com
290	raw.githubusercontent.com
291	raw.githubusercontent.com
292	raw.githubusercontent.com
287	raw.githubusercontent.com
288	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

303 bot.whatismyipaddress.com

flow	ioc
303	bot.whatismyipaddress.com

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

Processes:

firefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{15B9D482-B9AD-4F1F-A57E-D8B79E180C69}	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

firefox.exeHawkEye.exe

description pid process

Token: SeDebugPrivilege 4092 firefox.exe
Token: SeDebugPrivilege 4092 firefox.exe
Token: SeDebugPrivilege 1956 HawkEye.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exe

pid process

4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

firefox.exe

pid process

4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
4092 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

4092 firefox.exe

description	pid	process
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	1956	HawkEye.exe

pid	process
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe

pid	process
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe

pid	process
4092	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 1624 wrote to memory of 4092	1624	firefox.exe	firefox.exe
PID 4092 wrote to memory of 1724	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 1724	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 5004	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 4460	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 4460	4092	firefox.exe	firefox.exe
PID 4092 wrote to memory of 4460	4092	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nitr0-G3n3rat0r.exe
"C:\Users\Admin\AppData\Local\Temp\Nitr0-G3n3rat0r.exe"
1⤵
PID:2160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.0.1577762955\1883053064" -parentBuildID 20221007134813 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd97d8c3-2ebb-4fe1-8518-68202a55eb06} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 1960 253911de558 gpu
    3⤵
    PID:1724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.1.1778276158\154638710" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04120251-d744-4525-a9f5-51e0dd27673f} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 2364 25390b31158 socket
    3⤵
    - Checks processor information in registry
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.2.527988164\1994946982" -childID 1 -isForBrowser -prefsHandle 3444 -prefMapHandle 3440 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63db9490-7a70-4cec-8773-489feaf96357} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 3456 253951a7158 tab
    3⤵
    PID:4460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.3.565107073\1678039784" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 2876 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4aaaa6d3-7093-4526-87e8-f38adf43589b} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 3648 25393c19658 tab
    3⤵
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.4.2054300352\546660749" -childID 3 -isForBrowser -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28aee9ec-59cd-4e34-a34f-23edc6eae912} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 3800 253f7b66258 tab
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.5.2095681958\31976760" -childID 4 -isForBrowser -prefsHandle 4920 -prefMapHandle 4904 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39061ffa-3fa6-4856-97d5-a2017d78a4ff} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 5048 25395790d58 tab
    3⤵
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.6.1449604283\228001599" -childID 5 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2b2c4dc-032c-4f41-b13b-3bc66911416a} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 5176 253974ae858 tab
    3⤵
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.7.1109940386\1018256334" -childID 6 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71fa73c1-26eb-481d-a4d2-300ed8734d02} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 5384 253974b0058 tab
    3⤵
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.8.650552568\155392157" -childID 7 -isForBrowser -prefsHandle 5864 -prefMapHandle 5868 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9982af74-5c76-4ec3-8f4b-8dfc36c35d03} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 5840 25393aee358 tab
    3⤵
    PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3812 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4780 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4876 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5752 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5436 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6000 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5464 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5228 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6156 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=5544 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6316 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6480 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6648 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6652 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6932 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=6792 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6128 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6692 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=6628 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:1
1⤵
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=7572 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7660 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:4552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5756

C:\Users\Admin\Downloads\HawkEye.exe
"C:\Users\Admin\Downloads\HawkEye.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
03b27ef9da0a5b0ac2af64e1bc67ad4e

SHA1
dbf97235097ee0af01bf971072dd8d3e106d57bf

SHA256
1a4434884cff51143880f2eec582f1cccb8a801ed4f3f4f06f0a721d6146d00e

SHA512
a2cdc5973a2fb890b5bbb6e6aad93ea5d597bed16af02a12354efb79f6e18d0ee1b90c443b76df6d6207e77de65319d14e91af45c4e6e9aed539d22e5c69231a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\8c20e396-c22b-4169-ac31-8dd356e31e05

Filesize
746B

MD5
b1cf9c415172dd9372db9952d3f38b76

SHA1
d9b6c1d094473dbbb6faea690af4a3a962474198

SHA256
8d07147f18a98b5f2130578a8e697f8fe47b904da9a758389be6087f4ce79d06

SHA512
02943870b0322f1659c687a0959033004ca7c0bfbf1a074c57992ca2b30086ecf7d43d476eb20e48595314cc17ad2d227c8e1068c722a8e703a72e6639e8119c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\8db9b0f6-d57f-4243-8363-b48a2ab0c587

Filesize
11KB

MD5
f12d606f91f00c6a8a6ce26e49331424

SHA1
2ee352f3cc1d0cb741ef2d9d821ded19aeb0c3f3

SHA256
782fb59e116f7b0ba7e856b182fb3b8420b3c630370ba258ab9efd997fdf4ef1

SHA512
e780c345a9bee1ac25c5fee0d19330d6f9bc1ddddce5049527eff78b663c81212accf230bdce733c1ed7bb2cf0ce48e0c9c6e04491d2d298937d178973af86c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js

Filesize
6KB

MD5
778df290e1384be044367f2efdb0c01b

SHA1
c2f92fd34cd6662835df2458ad2ebea508d1fb61

SHA256
0a5fa2b928d619692b00f8451ca62793baf3d8111377a5d8062f1d1e34e1ce7a

SHA512
6a7f2063ae9f7b2b65924a955acd60224a0ba09c388815546765d97c0c98e3fc6f417a9708b05691580907ef0de6dbf9a66b53214cf451e714b27f3adfc6e88a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js

Filesize
6KB

MD5
7a4481edefd18a96e07d1cd15f1f83b4

SHA1
fdbf1a49d272496cb43b1430da2170db011bf04a

SHA256
680e62a37ec85d57811b5ab4676570dbfc5c6bb7472199671de031766784694f

SHA512
583caf08db039655a4f33db370b3cba532569ba72e770b7bc729cbf5c89af7944475911086718162d08c0e5e1ee36cd2aeea0f3c612dd100cfa5fb2330ef5850

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
c74e9a08dcd5aa90ff575796a5fcc1c7

SHA1
fa36419785e304917592066e65ec878dee26c100

SHA256
f6dc59049fb4f69bfb0b9c36415edd7cdfb433a318e237808376eb95f965d07b

SHA512
daed681e6babdef5ed0c59cd156b8cebe347c7d391c18efba424c520277ab5155b23533be2724662f8249f4b5003cd61a27cae9dde76506c166ea36b06d158ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c2e11b8392ecdf50d396e3df82103e0c

SHA1
6de622ed6a610f93f6043d11264d1d3a38c59b2e

SHA256
a6b1313e16b4837af75a6f31595bb99c4d62b9c60d2808635344397a0cb2dc5a

SHA512
3b9f4e35378126a7cb1aa919df9160394bbab2aeddf3f6519eae950d39a92ae73371befb7295849ea72d718909bd685e283e53b45443eae83387e47e26c4fd77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
144a8d729a4c3dba4d6502ff83c6666f

SHA1
db395b74be791c1ff5d8e2c9b5fc54f80e015369

SHA256
23a160d8305eb0734c05dc0cca12d64e661caa40abd9170f6e57d0929884cfc7

SHA512
f1490aefb28e91d39cd974ec038169e79cc887c59d752045aa5fc2e5241a6479e3dbe3c0fae190b418f5815b476c9e90a2d3001168e22c5a8852e148f13ad30b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
00998bd63199c51b19444146ad62f523

SHA1
475594eb3ee0075ed479189c8eb92caabb71cc91

SHA256
9eeff100f10cc9695e38ade5bd86810720c6fcffa1ee7ec224733d17f4918566

SHA512
3718f752dc73584561b44acb86958f974ebde6519e5d7c26725d4a64eb69d5b5a04453b571da8086dce79ec33f99bc10b93d8dc57a6aae71e07ec8dda516f3ad

Download Submit
memory/1956-265-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/1956-266-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/1956-267-0x00000000018C0000-0x00000000018D0000-memory.dmp

Filesize
64KB

Download
memory/1956-268-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1956-273-0x0000000001550000-0x0000000001650000-memory.dmp

Filesize
1024KB

Download
memory/1956-274-0x0000000005800000-0x000000000581A000-memory.dmp

Filesize
104KB

Download