cobaltstrike | hxxp://156[.]247[.]14[.]253[:]5555/

Analysis

max time kernel
248s
max time network
250s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://156.247.14.253:5555/

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

http://www.stylejason.com:2096/3bbf

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Blocklisted process makes network request 6 IoCs

flow	pid	Process
133	2316	powershell.exe
238	2316	powershell.exe
254	5596	powershell.exe
255	5596	powershell.exe
385	2316	powershell.exe
399	5596	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\infect.ps1:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\infected2.ps1:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\index.profile:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\index.bashrc:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\index.bash_logout:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
3468	powershell_ise.exe
3468	powershell_ise.exe
3468	powershell_ise.exe
5596	powershell.exe
5596	powershell.exe
5596	powershell.exe
3468	powershell_ise.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3292	firefox.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	3468	powershell_ise.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3984	taskmgr.exe
Token: SeSystemProfilePrivilege	3984	taskmgr.exe
Token: SeCreateGlobalPrivilege	3984	taskmgr.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
5204	notepad.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3300 wrote to memory of 3292	3300	firefox.exe	88
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4488	3292	firefox.exe	89
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90
PID 3292 wrote to memory of 4008	3292	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://156.247.14.253:5555/"
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://156.247.14.253:5555/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.0.1225174709\651378469" -parentBuildID 20230214051806 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 22244 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e9012a9-fbd8-4730-bdec-a2ee8bb9c18a} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 1900 1c5ffa12d58 gpu
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.1.2110813306\2070961078" -parentBuildID 20230214051806 -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 23095 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74b6c3ae-a202-4abe-8112-11f968067032} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 2492 1c5f0086e58 socket
    3⤵
    - Checks processor information in registry
    PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.2.203408229\1253354144" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2940 -prefsLen 23133 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d237548-3f57-45c9-8f09-1616b5178a7b} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 2932 1c58724e258 tab
    3⤵
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.3.1410064329\332977387" -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3648 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {592a860a-aa41-4443-aa02-343f0cc3e00b} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 3660 1c589203258 tab
    3⤵
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.4.449338208\1958654830" -childID 3 -isForBrowser -prefsHandle 5140 -prefMapHandle 5132 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2f41de6-1ae6-44e5-adaa-fc6aafe9b6dd} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 5148 1c58af20d58 tab
    3⤵
    PID:696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.5.907844758\1426160065" -childID 4 -isForBrowser -prefsHandle 5288 -prefMapHandle 5292 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35f9a8d8-0ecf-48e3-8fab-561471c8c1f1} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 5276 1c58af21658 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.6.394684776\1988752317" -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9540e3b-cb9c-42d1-8285-aed19224f757} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 5136 1c58b05bd58 tab
    3⤵
    PID:2072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.7.1390464461\837968660" -childID 6 -isForBrowser -prefsHandle 5680 -prefMapHandle 5188 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4b168c8-8e0c-4f49-bceb-279fe602da7a} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 5548 1c58b05c058 tab
    3⤵
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.8.1762525068\2113418025" -childID 7 -isForBrowser -prefsHandle 5440 -prefMapHandle 5360 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aed4a4ed-7294-4e5e-a686-33cb395c4a7b} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 5428 1c586d89b58 tab
    3⤵
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.9.1591825134\1783023495" -childID 8 -isForBrowser -prefsHandle 3816 -prefMapHandle 3844 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea7707d2-8b5c-4c58-b182-24a4bcb84003} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 3624 1c5889cf158 tab
    3⤵
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.10.984485844\1860349566" -childID 9 -isForBrowser -prefsHandle 5328 -prefMapHandle 5260 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d4a9fee-a2bb-4c9e-880f-30fd46b924bb} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 6168 1c58797f858 tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.11.1610143108\200817589" -childID 10 -isForBrowser -prefsHandle 5276 -prefMapHandle 5752 -prefsLen 27737 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2bfe549-3889-4fc6-b4c8-504761424855} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 6204 1c5889d0958 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.12.299990952\1202176867" -childID 11 -isForBrowser -prefsHandle 4180 -prefMapHandle 4252 -prefsLen 28138 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4a40003-44c2-4c19-86ae-959d2e36d362} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 4292 1c5897fae58 tab
    3⤵
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.13.1774440470\2136546229" -childID 12 -isForBrowser -prefsHandle 3856 -prefMapHandle 3852 -prefsLen 28217 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9989e941-3262-404f-a606-3f9e1f34b03d} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 3928 1c58b005058 tab
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.14.1798032157\1066874753" -childID 13 -isForBrowser -prefsHandle 6292 -prefMapHandle 6268 -prefsLen 28226 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {129b8388-65b0-4ba2-947c-1aed36e50a40} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 6192 1c58d230558 tab
    3⤵
    PID:3656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.15.709345271\65894512" -childID 14 -isForBrowser -prefsHandle 4948 -prefMapHandle 4792 -prefsLen 28226 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eda392e6-e439-415b-b775-217d8e0650ea} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 6300 1c587c24e58 tab
    3⤵
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3292.16.1560695178\968667009" -childID 15 -isForBrowser -prefsHandle 3856 -prefMapHandle 6684 -prefsLen 28226 -prefMapSize 235121 -jsInitHandle 960 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {379fbc54-383b-4e5a-951f-1a4b108cd4dc} 3292 "\\.\pipe\gecko-crash-server-pipe.3292" 6888 1c58ad9b058 tab
    3⤵
    PID:792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6044

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Downloads\infected2.ps1'"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\Downloads\infected2.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Downloads\infect.ps1'"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5596

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
8fe7bd6cd1d64bcdabbf2e2ae72c5a28

SHA1
5e1080c3b8cc4c5bffc73ffe6d45fa073335d0de

SHA256
5054cd4d79ca09e90169cdaee05c1e3dfc5d6fa1ad1275e11fd094521fed3fb8

SHA512
658004888ba70fa4a8c4b573d439496532c08b81afdc0b2419187c2ec9f3e42408d9a7c2bd2c73efd06fd5ada7ea57e1bb5d188e57ead32a7c0c900a82099f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
6a1d732af6eb2d5e39917fb6d0d3cd40

SHA1
2981e90b27d16f79c07433cd177d5f77b0f26b42

SHA256
fb7e11ee05163c7dbcc973b194c6789afe2d8949c693b2e5b5ae71eb615fd563

SHA512
01750f3b62298f335786bcaddbd127c79c91cde0c2b2200dea8299e0a6ec45287b4cec597dfb556bde0d9ee7ac1227aeb26f05b7ca4859e6633aa202128dfca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4d38d10cd0aea11e1db9105ce7ca543e

SHA1
b3818150888ca8f69b0c090a020d39d956bded09

SHA256
549fce1bd58a27cd30516252a61a0ded049d7421379019783b35863161885b88

SHA512
4d47b35fc1cc2bef42c5993c7b2e7921ea5528e1571dc6319b547866b3571af18bab72caecfb76e17d410661e35f1dbb8e720d0c8477fd47fc8f69049cc0af00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
27fc93cd95d8a0b81def33b40c24d723

SHA1
37aace145547c3a88e928904aa82b88d0f110e31

SHA256
6d715a37d4caaee8c83b9020fecf41b091650780997b76064ade57f93218216b

SHA512
3059685e15b79bd2370cf6de33b3ba3dcf0f5d47984cf82d32acaa2656d85aad9a8214ab3757a3df59524a24dc756a5fee00ed6f3263ba61e6c5f553ca35a5f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\doomed\12457

Filesize
16KB

MD5
e2d8ce44d7f6a5865e63d29345a88e48

SHA1
6c6ce21cf8523e368ccc2d27180089422d1e71b6

SHA256
7ef28890899a2d45248573d36e210c974048cdebb91725057c60cc407d83729b

SHA512
6411a3a69df5e558b2f3f2e2935995e4d8f9cfadd91b0b929f774cddb42df841211882ec8c938c9e8a93b91382bf0a4821d2a77b5398eb6fd7396b9fc6129ceb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\doomed\21975

Filesize
15KB

MD5
5e3b1820dac5ccee6dbbf5d8fa9b86d9

SHA1
19c086db84af3ef3f822517ac39c6c8463425aa4

SHA256
6dfeeaecd8a184534a4abb624b68b1a03f8376de72c0e186eac7b570a66248fb

SHA512
171fd7b8a1ac430d579a81389a1c137d5ebe06011472b6954c9de6111acc9ae55df7bed13666c61a11144f502abd1d96fa15e322bd4f029830b90001ea9001ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\doomed\5349

Filesize
9KB

MD5
5a55b00bd57f9954b08d8382960a2b48

SHA1
e811067adc67c0c7a14fc32f0cef6dfde4554bdd

SHA256
de8cadfcf293880b497e7a5c2f4ee0608ef10d062a89f0d4c972091989f9e84f

SHA512
054e0fc4af6401bd09c2f05829c03388612f544874d54d5914182bbb89107b223990f91a4196e96c5b9cdbd9cbe6c74004260a766b5b1f5bb45677260b124840

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xgut1z79.default-release\cache2\entries\4EA42D4B27502BA7C55CC1ED92713898ACFF6F68

Filesize
207KB

MD5
2a7a7871b532abb4a5941667518582df

SHA1
7908367a846f0f6624d841fe6d0fb0aefea5cab5

SHA256
96412e69145ba17fd44347cfdb6a959d2e1b161559465d00135113c8206fea23

SHA512
f6d7c99437c201ebcde5717b024a5a72d70a40ca3a3bbe3de8c4ab4d2b7e7c3a580e63359fc86c465f64e24e414eb05163f379a1a6eb8dd96ecfc63dc2077be3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dg2ykn51.xkp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e3cee55d87b208849f976d79e325a4b3

SHA1
9c403f3cb9151563c92f5fbf2a8724d016c059ee

SHA256
ca606bae0c996cb212bc3ee8c91e095e72ea3dd58dbccd84c8c044f462286bb5

SHA512
f99f39a98b2ee7316bf6cdeebfff4d398b0b87561f20a11546725438d145a92555a3df2594d29100023f869ff96a2f39b674ecd6fbc1b63ac9be06874acb2766

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
002239e17e746b76e081b3785de25799

SHA1
90989242b991f5d4d085aba9db254ff848c1555d

SHA256
a7375424aaf0239a6b9518b0b65b512c1848899b414d6ba63127e77435295dae

SHA512
82b30f48cd03b35cf632228e13b4198826a5eebadce03db2457876e935fa93d875e71e70262e10bd34ce928d69a053bac470976d558db2759b9785f717e2e610

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\prefs-1.js

Filesize
7KB

MD5
3791323c0471683dcc58aaeeaf020374

SHA1
44cc8b807a8492663fadb0eb9accf536b61c895a

SHA256
e5e68b5fe13a95b14d53bade07b9a3eeb58f47f75f98d0e9c411e57ec08957c2

SHA512
1bd5ccd5ee6e217732f9b661f1cd003493d8deabda3a32fa51364238289c4e2fecd5848dc8bd70e019cb2c45ba71c7999b00fc383939029da61763f6e2042ef1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\prefs-1.js

Filesize
7KB

MD5
c4114f09b9d452a4a0563b794b76a3a7

SHA1
7e20180077ea144981a673dfc042ce4f6f0b624f

SHA256
ac8ac8d68885ca1d41ec98c5affd530cd1f0c72d37d7a0533438c2ba4aaec5b9

SHA512
2143ba73d062a0e72664c8e4ee2ffad1522ea5a2872af022ef08e0c974a316ed77d9255b823885fdc119b457c9852fec6a60b24e9843b5b285bd3a2ab2f84f2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\prefs-1.js

Filesize
7KB

MD5
4090d7bd0be7dab54a94f7d16691e930

SHA1
3b5d9ee09216fca55b761cd8945c289acd656542

SHA256
8d764023c4adf97e6eb2fbde7fe15c5c331c7ff6fa7f81287f85113bc266f9bb

SHA512
5ff789dab28ee10e3de6ef09f5b1083c4f87072e8437b8231d4f90b2bd221ef79b9b5239af6dba945a97d1c234cb27f4f17c99becb8b165b3ba2f282001fcd3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\prefs.js

Filesize
6KB

MD5
d7a9035eea3f972c404b53cc47f49cf1

SHA1
01a67171c27cb5d38238fa61c396fdeea51afde6

SHA256
c20b75e80901855d6ad9a8081888f075809f73f2ade9be7e8fc7234a02a9eacd

SHA512
36b7bdb6834b9c5e2f0540f9105d8f4023b2a01d8e6e03e3c6170b610d0454f9bbc983346cac02bcd3ec7ad2d3f1bc20437f7173e9ac90d6109a09f4ccf82ee5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7b2e26564c69125af9ea291101cb4306

SHA1
8f9d5fbf8444f713ccd4cf4c869234555def02f2

SHA256
6c9fd7a9e693b5e2767e424a0a2cb5ab07724ae3e63b2925cc078c19ef7e449c

SHA512
8d7a6a3158eb0556fe47c83447663fb015c864fba216d9235af68ae201a49bf3bb6d2b0bb5cf0598ff5ab0e7a7f30417709d423ac7069463b584193311ff3890

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
6a624cb0ce2d3360f83c5dc6b0c2ce04

SHA1
04d4e402e1378201344b0a49eeb168b9e292bc00

SHA256
6d4e9ec8a6ab9bca241399ffc673f018e5b55334c8c9056597125945deab1a2b

SHA512
c8741c45db92b90c3b619e53d8a8a2c211483ee3d477beaf8cab218ac428a5a3b2458d18da602881b93685e002721f7c04bc5bd858a2a4a05514f544b884e8cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b043b2a60706b40155b21aff601c4175

SHA1
16712989660e91b766cc8d3ae6316e448fda59e1

SHA256
e12bfb56f48ce69365dff1b91c49a2d32b6d96c4bb825a1086427a0edcd8f361

SHA512
595187bede13b7a7f717ce84e46314789ea7aad0897d6c513b4840aee1ba477155413c686fa8b375ff14afc043d1849560fc9937533261aa75b02d2b7d6191f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4e800cae966acf7fa6798243ecfac5df

SHA1
38de9e35df2851a0a6468c332eb3c39d95f762ba

SHA256
1d219927f17c0e4dec3f51c5bf55ee50e2116b1e8fef10ece454930bb7d14e05

SHA512
9f94fe7397e9040cd7c7a781be0af8fe781c1850d70b8ada5fe373cb0eb2fa27fd2a849d1789f0421765b92f6fd33af805ca4d68731942350a6dc2be6ae83447

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
ae948c40a19b9c55744db379916acbfa

SHA1
664b217dd4065dfac26b05162cfb138736babe9e

SHA256
317b71fb58214b2206f63ada91f01aee38988ffc952379dbd765bd6ac1e23a71

SHA512
edbf5ed200c09dee616f44e4643b376f6c5349b2c24221badcac30ab3a4c85b1da425431bad1dd39e08669b6bdbd140d2d07f89a8385f1e3ddbc18fa08406916

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
fb9d3e33862eae92cb4de29911597fa6

SHA1
34af84a0b4cadeb4d8a1badb0caedb16d6c0f96a

SHA256
b7f2a1d7cf83e096ae89af9aeabb1f81cffdaec9dc6a809689c944fc3f4a18b9

SHA512
a8dc2d3dd9ced0ce600c34d172813add2053811d04b3028f85eac46dce2e7a72d8f6bc187751189df2b6c55c9e02fa273a07cef21986a9f942480aaba526cbf7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
f7c9d6ec0bfa02fd3840bbc26dc5822f

SHA1
4a346391108186068566ed96ce8cb7e08c48e396

SHA256
8bdd8ac6a38171bb0c1543f97c62fe72221af339f47e910376a7718233b4c098

SHA512
53e3907a52c9a28a5392992ff780cddba0ab1c3934b722a32f4307ac7a61842732f3240dcaa84cd1333ca39f918eb8e22b2b97655335ead0eee2a1dbdc5e9b9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
1ea781cf1b26061da703f2429cd98e24

SHA1
3fbae5a5731c9f1a4b56d3d822cbfba694b99253

SHA256
e73145d837f87d9c8cf0450f74b157655b34c87e541e515927ffbab7f1985134

SHA512
7e749ba1c3bc71178ad63bf7efb53a2fb07e6b511dfbba6238aa15d32174d76a14839e3277d4879e665266ed4e010d5bcf48262b3cd05241c804a99a77d2aff5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a3dbb7a9a0b84a9cc279f78168a4ee09

SHA1
66f88ad2d1c4b5fcc42d1ad9e30ab6ff807b3c63

SHA256
54a315a3a2d035d462cb60e525a4adc12a13898c1a1e1daf053e0f780da7e577

SHA512
b9815b4c4f0e14a8a55fb1e596d43100c34b7a0aa55ec6efb18464f82f65c709d63568b0ec222d7b01ccd02e3f93681681563ca1f0205a7286bcb9218aa13799

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\sessionstore.jsonlz4

Filesize
6KB

MD5
a214868ca32b74bc3c8fe4c4469487fe

SHA1
d5cc8d418d952a4139844f0086739a430afdd0d4

SHA256
2f9d62b9ceffd5bd1aed22db3cc0bd166a3462f94b6395570721ab847add98e8

SHA512
c8ad6ac944d7f8aac01222ebb3c547c4656c37d229b877b2b77ea33270b6cc6db67dd00c44f0de8a04809f4f13fa63eeab52a8577abfb135f30d7722362b0d36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xgut1z79.default-release\storage\default\https+++www.virustotal.com\cache\morgue\2\{a6d23b33-5f9a-4028-90eb-cdfda34ec802}.final

Filesize
47KB

MD5
c366a3613bd3d6329d43d12117ed4059

SHA1
d3e8e59672d2ce345769afd88a71fbb90d70943d

SHA256
582807864cf6905f2404f2bb7e84789d15afbb0bd5c9566e04cf7b8cb6c29a7b

SHA512
7087bec44839f155caa8a57a65d4fcc117796edb80a991a9bcea620be9d0a497841148f36f09fa4995ef4dd7bd65c566760ff9f32c48a154fb3cacf1737a127a

Download Submit
C:\Users\Admin\Downloads\TknTSvji.part

Filesize
220B

MD5
22bfb8c1dd94b5f3813a2b25da67463f

SHA1
dc216ac4a4c232815731979db6e494f315b507dd

SHA256
26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56

SHA512
c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2

Download Submit
C:\Users\Admin\Downloads\ZQPN95WZ.part

Filesize
3KB

MD5
1f98b8f3f3c8f8927eca945d59dcc1c6

SHA1
c4d853993e323432cb84359de2c319b9a767b729

SHA256
342099da4dd28c394d3f8782d90d7465cb2eaa611193f8f378d6918261cb9bb8

SHA512
33bb97936e54fe797b5046ece9c04313306fdc1470c959593f5cc2c641066372f2aee759db3a1bf45470b10c98ca964388172ded77eacaf2500e428d4f00331f

Download Submit
C:\Users\Admin\Downloads\_S0pHwQu.part

Filesize
807B

MD5
f4e81ade7d6f9fb342541152d08e7a97

SHA1
2b9ee6d446f8f9ffccaab42b6df5649f749a9a07

SHA256
28b4a453b68dde64f814e94bab14ee651f4f162e15dd9920490aa1d49f05d2a4

SHA512
26544e0b85ca6d7cca3b8ace7d01f712e24020f07b6a6ad54a6942909040221f09bf922a4d0da555ce64ceebb4934b28719a23a0e6401337a69d4a0170bd8e4c

Download Submit
C:\Users\Admin\Downloads\infected2.xC_Rlnw3.ps1.part

Filesize
402KB

MD5
bbefd537823f5b32a4bb74aaf6d9f6b3

SHA1
e748fd211f721d7a5bc9f1781a0327e780f51dc5

SHA256
f26ff31c0888e6a9d8ea0fb2fff892ccda4deda9158d954f2ee2e0562c1879b2

SHA512
dd87907a0e5aa56f4f654c3755e3701181bbd5a45016218b9f566617346d3ed1661d8fdf0f84fb9ea73959f9ba5a4467525f8b52d72e05e0a87e462096856ef1

Download Submit
C:\Users\Admin\Downloads\infected2.xC_Rlnw3.ps1.part

Filesize
2KB

MD5
fa156c905c3d9f483a607c2d01abf02c

SHA1
4eeeb5f9c8b226de9575b7175591dfa7a0ce9477

SHA256
b99610117ea8adf52fcdd57e3a240140afb109d7d27ca564c68befdfc45bf92c

SHA512
d915013008f7c00f3ba140793094659b8e6c8f689edf72d9666273a3416059dea150d51949d569837928cb9cd0a5c094da578f2bff17ffe80058ea6799812e5d

Download Submit
C:\Users\Admin\Downloads\tjzgUVrZ.ps1.part

Filesize
3KB

MD5
3372576f21e7cd0d4a5e4e7dd211dba0

SHA1
3029d955dc5f030dde174e7bd8c1a86cb62b0bd9

SHA256
ac8a5271c09dbfb1a486487743c6cec1a4c81ef56bf5e05d88b7d4b4d2e31482

SHA512
3a3eebcf5a8b2d3445d32772102f68c835ca0937a910ddde02195ae70314a489419ad529f77d011c033fc083063d7b707e2d6528cc56acae6e85b9d106d6f30e

Download Submit
memory/2316-226-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/2316-250-0x000001929F1A0000-0x000001929F1F8000-memory.dmp

Filesize
352KB

Download
memory/2316-205-0x0000019285250000-0x0000019285272000-memory.dmp

Filesize
136KB

Download
memory/2316-245-0x00000192838C0000-0x00000192838D0000-memory.dmp

Filesize
64KB

Download
memory/2316-733-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/2316-244-0x00000192838C0000-0x00000192838D0000-memory.dmp

Filesize
64KB

Download
memory/2316-210-0x00000192853E0000-0x000001928542B000-memory.dmp

Filesize
300KB

Download
memory/2316-211-0x000001929F1A0000-0x000001929F1F8000-memory.dmp

Filesize
352KB

Download
memory/2316-207-0x00000192838C0000-0x00000192838D0000-memory.dmp

Filesize
64KB

Download
memory/2316-208-0x00000192838C0000-0x00000192838D0000-memory.dmp

Filesize
64KB

Download
memory/2316-206-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/3468-225-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-568-0x000001E6E1000000-0x000001E6E103C000-memory.dmp

Filesize
240KB

Download
memory/3468-285-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-740-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/3468-223-0x000001E6C1AF0000-0x000001E6C1B28000-memory.dmp

Filesize
224KB

Download
memory/3468-224-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/3468-260-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-227-0x000001E6DDB70000-0x000001E6DDBBA000-memory.dmp

Filesize
296KB

Download
memory/3468-228-0x000001E6DDB20000-0x000001E6DDB2E000-memory.dmp

Filesize
56KB

Download
memory/3468-229-0x000001E6DDBC0000-0x000001E6DDBF8000-memory.dmp

Filesize
224KB

Download
memory/3468-259-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-258-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-253-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-234-0x000001E6DCD70000-0x000001E6DCD78000-memory.dmp

Filesize
32KB

Download
memory/3468-246-0x000001E6DCD00000-0x000001E6DCD08000-memory.dmp

Filesize
32KB

Download
memory/3468-254-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-255-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-256-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-251-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/3468-249-0x000001E6DDD90000-0x000001E6DDDB6000-memory.dmp

Filesize
152KB

Download
memory/3468-567-0x000001E6E0FA0000-0x000001E6E0FB2000-memory.dmp

Filesize
72KB

Download
memory/3468-263-0x000001E6DC2D0000-0x000001E6DC2E0000-memory.dmp

Filesize
64KB

Download
memory/3468-248-0x000001E6DD1F0000-0x000001E6DD1F8000-memory.dmp

Filesize
32KB

Download
memory/3468-247-0x000001E6DCD10000-0x000001E6DCD18000-memory.dmp

Filesize
32KB

Download
memory/3984-742-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-753-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-752-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-751-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-749-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-750-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-747-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-748-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-743-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/3984-741-0x0000020256060000-0x0000020256061000-memory.dmp

Filesize
4KB

Download
memory/5596-729-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/5596-295-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download
memory/5596-296-0x000001366F0C0000-0x000001366F0D0000-memory.dmp

Filesize
64KB

Download
memory/5596-297-0x000001366F0C0000-0x000001366F0D0000-memory.dmp

Filesize
64KB

Download
memory/5596-300-0x000001366F090000-0x000001366F091000-memory.dmp

Filesize
4KB

Download
memory/5596-376-0x000001366F820000-0x000001366F878000-memory.dmp

Filesize
352KB

Download
memory/5596-302-0x000001366F820000-0x000001366F878000-memory.dmp

Filesize
352KB

Download
memory/5596-301-0x000001366F420000-0x000001366F820000-memory.dmp

Filesize
4.0MB

Download
memory/5596-366-0x00007FFF7BDA0000-0x00007FFF7C861000-memory.dmp

Filesize
10.8MB

Download