hxxps://google[.]com

max time kernel
47s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE is not expected to spawn this process	4760	2544	DW20.EXE	115

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548901686108259"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "54"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2544	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5776	Process not Found
6092	Process not Found
6108	Process not Found
5136	Process not Found
5144	Process not Found
5152	Process not Found
3664	Process not Found
3424	Process not Found
672	Process not Found
536	Process not Found
2592	Process not Found
5264	Process not Found
5508	Process not Found
5516	Process not Found
5360	Process not Found
5688	Process not Found
5696	Process not Found
5700	Process not Found
5740	Process not Found
5748	Process not Found
6036	Process not Found
3108	Process not Found
6140	Process not Found
5164	Process not Found
1008	Process not Found
3284	Process not Found
4128	Process not Found
5716	Process not Found
5720	Process not Found
2536	Process not Found
5864	Process not Found
6128	Process not Found
5156	Process not Found
6080	Process not Found
864	Process not Found
6048	Process not Found
6084	Process not Found
5712	Process not Found
5760	Process not Found
5784	Process not Found
5868	Process not Found
3536	Process not Found
5836	Process not Found
5844	Process not Found
5872	Process not Found
5892	Process not Found
5980	Process not Found
5992	Process not Found
5996	Process not Found
6012	Process not Found
6016	Process not Found
4900	Process not Found
5860	Process not Found
1836	Process not Found
2264	Process not Found
5840	Process not Found
5656	Process not Found
5944	Process not Found
5348	Process not Found
4836	Process not Found
2992	Process not Found
6124	Process not Found
5352	Process not Found
5284	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeShutdownPrivilege	4104	chrome.exe
Token: SeCreatePagefilePrivilege	4104	chrome.exe
Token: SeDebugPrivilege	5280	firefox.exe
Token: SeDebugPrivilege	5280	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
5280	firefox.exe
5280	firefox.exe
5280	firefox.exe
5280	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
4104	chrome.exe
5280	firefox.exe
5280	firefox.exe
5280	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
5280	firefox.exe
5788	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3540	4104	chrome.exe	85
PID 4104 wrote to memory of 3540	4104	chrome.exe	85
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 2544	4104	chrome.exe	91
PID 4104 wrote to memory of 972	4104	chrome.exe	92
PID 4104 wrote to memory of 972	4104	chrome.exe	92
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93
PID 4104 wrote to memory of 4536	4104	chrome.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xe0,0xd8,0x104,0xdc,0x108,0x7ff842539758,0x7ff842539768,0x7ff842539778
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 --field-trial-handle=1832,i,6268555455479896760,5030192777007903745,131072 /prefetch:8
  2⤵
  PID:4732

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3428

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2544
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 5196
  2⤵
  - Process spawned suspicious child process
  PID:4760
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 5196
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.0.665931957\914329634" -parentBuildID 20221007134813 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b04a6581-94b8-4c46-8971-70d17f1410d9} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 1996 195459eee58 gpu
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.1.2136654903\1536765979" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a3f5e1-fab6-4088-8e4f-c6500c0b9fc5} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 2396 195458fa558 socket
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.2.535364296\164017370" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 2996 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58902c4a-d1e3-43f7-8938-565b516b4fe1} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 3144 19549b80e58 tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.3.174883946\1470715209" -childID 2 -isForBrowser -prefsHandle 3352 -prefMapHandle 3348 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e1846c2-e2c2-4dc4-98fc-10bed77673f8} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 3604 19539162258 tab
    3⤵
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.4.2049964706\390516750" -childID 3 -isForBrowser -prefsHandle 4384 -prefMapHandle 4380 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cb4128d-1eab-4605-bc5f-4bab2bf948b1} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 4348 1954aecb258 tab
    3⤵
    PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.5.1570413441\1028374225" -childID 4 -isForBrowser -prefsHandle 5080 -prefMapHandle 5072 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e13af5d6-4566-4e79-bd98-9909991f732e} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 5068 1953912de58 tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.6.1227708304\1481265649" -childID 5 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5999f63d-9b43-4ace-ba49-2334ce1b70d4} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 5172 1954c019158 tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5280.7.503796981\118742545" -childID 6 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce309175-1609-4f4f-a701-82781c951c82} 5280 "\\.\pipe\gecko-crash-server-pipe.5280" 5360 1954c018858 tab
    3⤵
    PID:3536

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3906855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
198KB

MD5
06d38d9bf028710762491328778f9db6

SHA1
83e1b6cbaad5ca5f6dc63453da324f8df28de193

SHA256
91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

SHA512
b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
20ce26a1f38ca89ea86363670ee4e966

SHA1
58333fcd3957d6891c2303d1d6aca86a0426602e

SHA256
0ecac126e374bbbeb79cd2e28f11fe6820243f4e65074cd5df1dbb70389a6569

SHA512
96adf61265dfdaa6b2a92ed604a1cc7a488ada2e4f466cfd7ad0f0cafc3ce297a482ec0cc30a619a0ef6e2eba965fd4c5edb8f542a7616952d0d678601917908

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b5e0be75d9336791f4a6f5fd01120bd6

SHA1
261a906f658500694319efc9b1d3ec5f5cffce15

SHA256
df2cf690b557452692acd056b1b435bbfbe24c6a6f8e135e3508a1daf07d89f9

SHA512
1237f3122eca8027f63df6635e54e09ed52a8a07ec735e8e5d87c866611126ac1213a4107b9e1e9e226b8015ff451f226a6867482478320bfd5a3bc44b4e99f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b41a54284f2708600227c0600e1d2b22

SHA1
ac74d1287ff4f61d1ffcccb13e28186fe9cb52bc

SHA256
cf23163d18b48642918778fb19fa4d9f14ff09a6a2068ac20daedcb52db5f25d

SHA512
256603596bd3014c7c9b14837dfde49957525a21aa9eec3eea50e8de7eff1aee72144b10633bed78dcdf3d4d0de1bc303b86d70c9fceb712b18500e60c49c8fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7fe60390488862d72020b0a51b7550ab

SHA1
e963228b22d70ad077413288aaa3a6db2d282e5b

SHA256
d5ed4566d2e7ea9bfbf8018427a214f6377488d4b104ea0e65a94271d8ed8a4a

SHA512
4028082e3f91ffa24e81adf2d8663900877253b7a7d11b872eab96db48393396b6d7d64bcd6ecebd777a7589a2e64c11958ba3c2c207a710d3138791701e1c8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
72bccda100c71d8fea39528289984dd6

SHA1
6873d232f4d6fb7141985723b043cdbb4fccfc02

SHA256
1e190c3ae273fec52801a467630c7b7274b93e50e4114b4d48432e2da4bb24a6

SHA512
c528bb3ed9d35fdb02e8d94c2773b284cd0155d7a96b4e17ca694019ec32605dcc9ef2d1986b94542a723d176e8096fcb859153c1193b1c45f7d9726c2ea2cd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
29992a694b5b6c33ab3d77ae54b2b111

SHA1
6fc81eeaa62118428445ce381b13259635ea82ac

SHA256
8a96d027ff610e0dc0b3ca527ef103812f944c6ecafc7b84c3019e43f728df5c

SHA512
0f50c8da781c8bf42a8563989e589d0bbf7966de9a277dac7d6a70d871b632094038207f030dd7379607420d035d659f4dafe773bd841a3c08977abd606d0bab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
363291ce2f2ff804771c10e5e401b84f

SHA1
7882246806168769700fd920d010006aa3392f28

SHA256
7022b18c243c648aabe17ed3b2e95caa13c107c1b706865304f9af33745f7c87

SHA512
3c5bb79602cfe7348f9b7f012108ecd58e807ca3f0eec799c69764d4f6e0ac5937316da78c4171b8e38db618986661fb1ed2087d2bd8e23bbfbcaecf69d96c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\datareporting\glean\pending_pings\1fe13b30-91c2-450d-b9f3-f50b865ca7eb

Filesize
746B

MD5
786d8ccb3a1950e8b083a0a243699487

SHA1
fc910c61538360f2715089526d4c6c7ff1745c0b

SHA256
7aa6e1a41b5023023ce2e5e540aff4b41bd0ca077a02f477019dee145beffcf1

SHA512
78786be51b5c7a89a7214ea75d70308313c38a651c19d064a41f45f9a594224202e05708b12ea8a39fd52ccc11fe363b57514cdb315671d1f47db5057b925b62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\datareporting\glean\pending_pings\8d2f23b1-9b86-4b52-bc6b-6ce7f55abd72

Filesize
11KB

MD5
15459d2f20112debcc5ad8b9af87b999

SHA1
8cb179c9263b27506ae87f14d787d38584ac6c00

SHA256
9403a71023642f9d8d52afccbfddafee437840f4c39cd95c9e8c57fc67988a04

SHA512
209f91128cd0233e67aff9b30b6d44c08aeb6a950701a59551d1327d0c080271b5012000c71c6aff42b37471b9941a0f995d811f66f17bab08818ce73804169a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\prefs-1.js

Filesize
6KB

MD5
0c9455d94f2ca30ab4573ba79e20339d

SHA1
82677a70c7db07269ecb8afdc86e9e9e074dd34d

SHA256
85873751f4ae2a0ad92450eab04e3edc1c0503caf1295d8c254f63cf3766ad6d

SHA512
2745a51c3f82d475ca8f1ab7eb47660a8355c73fe6625707fc2727a366925b286d16016d80fc8abbaf163e84edcad66c6391651f4df2c3aa5da2af4787a61531

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\prefs.js

Filesize
6KB

MD5
1c7a06988f92b85768df5f342a205445

SHA1
66dbe9498771eadb486082a5be93c9b4eb391f98

SHA256
a80d524f834a267b528ae3f75bbea481d36e5b8ca333b10730649fe9189bd0aa

SHA512
601df238d960edba1201199efd2f2295968642b2a3d5ebca60b02958093c1c5e72622a5d1f10e7f52d7e602edba2c5b07cbf00fb7fda455f74ba3ebf5be94b3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\sessionstore.jsonlz4

Filesize
419B

MD5
bfa25cc55cda709660065f78b6d791c7

SHA1
a72fc4cdb8c0b541d68e8cdfa75c15eae99e646f

SHA256
82194b1d5f2d36ed7a4cb2f114964c69d15f97bcdb4305cde69645e1b8b62fef

SHA512
0dce1c1cadc72a717d5d300ae56aec1d1831efbf7fbd1a9b711d453b41e8210518677d05777691d6f5856f223d0c223b509ad223738ed45f37755876b02d6adc

Download Submit
memory/2544-152-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/2544-163-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-154-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-155-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-156-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-157-0x00007FF80EAB0000-0x00007FF80EAC0000-memory.dmp

Filesize
64KB

Download
memory/2544-151-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/2544-158-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-159-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-160-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-162-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-215-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-161-0x00007FF80EAB0000-0x00007FF80EAC0000-memory.dmp

Filesize
64KB

Download
memory/2544-164-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-146-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-153-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-145-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/2544-147-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/2544-149-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/2544-150-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/2544-148-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/4760-198-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/4760-213-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/4760-214-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/4760-212-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/4760-210-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/4760-211-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/4760-209-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/4760-208-0x00007FF810B10000-0x00007FF810B20000-memory.dmp

Filesize
64KB

Download
memory/4760-199-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download
memory/4760-197-0x00007FF850A90000-0x00007FF850C85000-memory.dmp

Filesize
2.0MB

Download