echelon | f544d908dca93097fdf1f99a4f697783f6aedd5f575df7408669f489771708b5

Resubmissions

06-04-2024 10:32

240406-mk6gpagc4y 10

06-04-2024 10:23

240406-me8pvsgg43 10

06-04-2024 10:20

240406-mdjz4sgf86 10

Analysis

max time kernel
140s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e251129e83d32c1744bce1cbc8018c03_JaffaCakes118.exe
Size

1.4MB
MD5

e251129e83d32c1744bce1cbc8018c03
SHA1

75f3bff3c62f3a1c3b68bf0e88b9d441a03b999d
SHA256

f544d908dca93097fdf1f99a4f697783f6aedd5f575df7408669f489771708b5
SHA512

806cc52f2f2fcd7618f6ca12251ef7c3d3b708820b01d96d69c7c953541c3622e633278f5215669bb0c3b10b623cdf8321893f1b6c8e20089bd307a44f5c6a65
SSDEEP

24576:NvU/JLZY+IROxI5+5TsiPutQSmV11hfUSbZmyc9VCKTwaRhP8IGaHQrs8t:C/JXT5TsioQSmV11hcSFmyOVCKTwaRud

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3600-4-0x0000000000140000-0x00000000002DA000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXEfirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings firefox.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

5664 POWERPNT.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	firefox.exe

pid	process
5664	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e251129e83d32c1744bce1cbc8018c03_JaffaCakes118.exetaskmgr.exe

pid	process
3600	e251129e83d32c1744bce1cbc8018c03_JaffaCakes118.exe
3600	e251129e83d32c1744bce1cbc8018c03_JaffaCakes118.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

1796 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

taskmgr.exefirefox.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1796	taskmgr.exe
Token: SeSystemProfilePrivilege	1796	taskmgr.exe
Token: SeCreateGlobalPrivilege	1796	taskmgr.exe
Token: SeDebugPrivilege	2288	firefox.exe
Token: SeDebugPrivilege	2288	firefox.exe
Token: 33	5392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5392	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe

Suspicious use of SetWindowsHookEx 50 IoCs

Processes:

firefox.exePOWERPNT.EXEnarrator.exe

pid	process
2288	firefox.exe
5664	POWERPNT.EXE
5664	POWERPNT.EXE
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe
6128	narrator.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 4844 wrote to memory of 2288	4844	firefox.exe	firefox.exe
PID 2288 wrote to memory of 4696	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 4696	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 1256	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 3128	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 3128	2288	firefox.exe	firefox.exe
PID 2288 wrote to memory of 3128	2288	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e251129e83d32c1744bce1cbc8018c03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e251129e83d32c1744bce1cbc8018c03_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.0.1533286211\1796129069" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4a9db6b-2157-4042-aea2-352ba0535dca} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 1964 1f4a63cfa58 gpu
    3⤵
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.1.1909807760\1847833866" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb33fbeb-b75a-48dc-a609-4b4b55c5a13b} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 2364 1f499c6d058 socket
    3⤵
    PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.2.2142981124\1273771379" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 2936 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c269561-8860-403f-a70d-7a1d2e5c1825} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 3112 1f4aa5ead58 tab
    3⤵
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.3.2118091918\1969988840" -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d535fed6-84a4-4140-b5a8-eb0c3d9ac48f} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 3316 1f4a8d13658 tab
    3⤵
    PID:1168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.4.1391700296\13197241" -childID 3 -isForBrowser -prefsHandle 4208 -prefMapHandle 4396 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {766897fd-9bed-448f-8993-5fc7d3aa79c4} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 4532 1f4ab47e058 tab
    3⤵
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.5.1490204226\1860912623" -childID 4 -isForBrowser -prefsHandle 5140 -prefMapHandle 5136 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e282a1a4-8d21-4be4-a1ef-b249178c427e} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 5172 1f4a9df1b58 tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.6.1083898108\775932542" -childID 5 -isForBrowser -prefsHandle 5192 -prefMapHandle 5172 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e698f831-6ac5-4a35-adb6-b2865675dd76} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 5316 1f4aab7cf58 tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.7.2123726727\1480771135" -childID 6 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de62b74c-ed72-4198-b41c-d0c092f51774} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 5500 1f4acaa9558 tab
    3⤵
    PID:4800

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5664

C:\Windows\system32\narrator.exe
"C:\Windows\system32\narrator.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6128

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
PID:6436

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:6468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:6536
- C:\Windows\System32\SystemPropertiesComputerName.exe
  "C:\Windows\System32\SystemPropertiesComputerName.exe"
  2⤵
  PID:6964
- C:\Windows\system32\systempropertiesprotection.exe
  "C:\Windows\system32\systempropertiesprotection.exe"
  2⤵
  PID:2796
- C:\Windows\system32\systempropertiesprotection.exe
  "C:\Windows\system32\systempropertiesprotection.exe"
  2⤵
  PID:1704

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
PID:6492

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2660

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:6860

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
PID:6992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\20RAD7Y0\update100[1].xml

Filesize
726B

MD5
53244e542ddf6d280a2b03e28f0646b7

SHA1
d9925f810a95880c92974549deead18d56f19c37

SHA256
36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

SHA512
4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

Download Submit
C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_02DDF48F368D4196BA8034C343445F61.dat

Filesize
940B

MD5
4d8d26908234423a6ffa54ad2b9a3938

SHA1
9b5f6c758aac50321746832deb8caca86416ee56

SHA256
7e3aecd923c0d731985815c6a91082a4d20c1590949223082d11cb37e5d05218

SHA512
8ee0be0c4002ff3700d71fc9b80d69745919e60aea84f4d6450e3922482a1e3e12a230fb8746fc8b46805abc47cb6232ff82ae847e553db4f8e7e4f4e56d484d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
81a81ed08df5c463186cdd310b398099

SHA1
3e2e404eae93fe0cf567c2cf746a452edac56ce7

SHA256
6376b2d8049551f1666188ea8ef313840c315cc67170f01377ead6a9856a66c3

SHA512
45f9bae747875eae385b9450cdc06e81ebc01e0510fd3b65603f49c088780aa00002c74eed1f2814ab4d8718be30e62121e9c8067f928701b06d703765b25086

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\datareporting\glean\pending_pings\402848fb-277e-441c-8472-8a3224cffd42

Filesize
746B

MD5
a0acf72419b5b2d7bd778b877a023a42

SHA1
1b12f22c1b8e4ad50b8b091a9b3ad34eccab2536

SHA256
a93068606c7d88317dc96689d988da886b8b872dffb2922a2f6b9379ebdf9c36

SHA512
cd0ae5e3fd4b3bd688e9ebffe7af50f600b9f8e4c4186325baaa807f83ad26b9891459f9ace53c90b9df0adf167b5ffb36caa2495595c55251b29df4b990826c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\datareporting\glean\pending_pings\dec68677-462a-4d96-9fbb-e3cb93b5f42a

Filesize
10KB

MD5
653004a25d5933f027b9187f16e673db

SHA1
86f630642e0f492d1bb762ff319896affb85dc42

SHA256
e8bc59807ced83ce55d3c133e62f64a7ac58a83e31033f4701544a22ec44260f

SHA512
c35f8b3ee9c88a72549df1102964cabf57b1772b9dfb644fb2fa4d0958bc134ca2ce37da4486d25ede57499212fc79c735beabe543f16a7ba13cc26be118ae3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\prefs-1.js

Filesize
6KB

MD5
5cba88f7cafdc91ef3278d8ba94fe7b7

SHA1
ed4342c6ad3ae47dc95d78cbd9840725687982fb

SHA256
e9d17b13aaea58283b66bf6c8fb9573c10f5cc8fbffeea56216c653e2b74bc8a

SHA512
51948f94957cf178af26fbf13a119d6793d4c5286a01eb7f2fc023774f0bff4df14def44a6552d5e3b56ae4714bd9499d574658be1d50247212d0f9d65301972

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
99b7e4a2bedb35e5a9baea50386503ba

SHA1
35c569e13bb338df0bb23b8db4b38df5d3e0dfb6

SHA256
62ad3ed7e2d11287e51522e3ea2d4230f8fa38ed4329b9e6fb9163d7809430e6

SHA512
a73c93dba3e766f3a5114ba5c058e7c0aa27fadcf82d9f7d543d122edb066e5cab8c39cbeb2883220c03d32d7eaa215e7204cbc6510ee7f6bc11895d99e53260

Download Submit
memory/1796-7-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-12-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-16-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-15-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-14-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-13-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-18-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-17-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-8-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/1796-6-0x000001A295500000-0x000001A295501000-memory.dmp

Filesize
4KB

Download
memory/3600-0-0x0000000000140000-0x00000000002DA000-memory.dmp

Filesize
1.6MB

Download
memory/3600-5-0x00000000028A0000-0x00000000028DF000-memory.dmp

Filesize
252KB

Download
memory/3600-4-0x0000000000140000-0x00000000002DA000-memory.dmp

Filesize
1.6MB

Download
memory/3600-1-0x00000000028A0000-0x00000000028DF000-memory.dmp

Filesize
252KB

Download
memory/5664-104-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-111-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-107-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-106-0x00007FFA06E30000-0x00007FFA06E40000-memory.dmp

Filesize
64KB

Download
memory/5664-108-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-109-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-110-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-112-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-113-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-115-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-114-0x00007FFA044D0000-0x00007FFA044E0000-memory.dmp

Filesize
64KB

Download
memory/5664-105-0x00007FFA06E30000-0x00007FFA06E40000-memory.dmp

Filesize
64KB

Download
memory/5664-117-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-118-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-119-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-121-0x00007FFA044D0000-0x00007FFA044E0000-memory.dmp

Filesize
64KB

Download
memory/5664-120-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-116-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-102-0x00007FFA06E30000-0x00007FFA06E40000-memory.dmp

Filesize
64KB

Download
memory/5664-103-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-160-0x00007FFA46DB0000-0x00007FFA46FA5000-memory.dmp

Filesize
2.0MB

Download
memory/5664-101-0x00007FFA06E30000-0x00007FFA06E40000-memory.dmp

Filesize
64KB

Download
memory/5664-100-0x00007FFA06E30000-0x00007FFA06E40000-memory.dmp

Filesize
64KB

Download