Analysis
-
max time kernel
50s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 00:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://is.gd/147852z
Resource
win10v2004-20240419-en
General
-
Target
https://is.gd/147852z
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exechrome.exepid process 3696 msedge.exe 3696 msedge.exe 4084 msedge.exe 4084 msedge.exe 32 identity_helper.exe 32 identity_helper.exe 1892 chrome.exe 1892 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exechrome.exepid process 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
chrome.exefirefox.exedescription pid process Token: SeShutdownPrivilege 1892 chrome.exe Token: SeCreatePagefilePrivilege 1892 chrome.exe Token: SeDebugPrivilege 5528 firefox.exe Token: SeDebugPrivilege 5528 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exechrome.exefirefox.exepid process 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 4084 msedge.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exechrome.exefirefox.exepid process 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 1892 chrome.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe 5528 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 5528 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4084 wrote to memory of 3984 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 3984 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1904 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 3696 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 3696 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe PID 4084 wrote to memory of 1404 4084 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://is.gd/147852z1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbf4246f8,0x7ffdbf424708,0x7ffdbf4247182⤵PID:3984
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:1904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:1404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4644
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:3664
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:82⤵PID:3732
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:32 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:4568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:4424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:2480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:3700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:3996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:12⤵PID:4644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4820
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4356
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1892 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdadd5cc40,0x7ffdadd5cc4c,0x7ffdadd5cc582⤵PID:4424
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:548
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2348 /prefetch:32⤵PID:5132
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:5140
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:5364
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:5376
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3204,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:5440
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:5548
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:5512
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5528 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 25457 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fab64ea-96cf-4af0-8271-930a365f0a80} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" gpu3⤵PID:5644
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2380 -prefsLen 25493 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8a177d0-f8cf-4435-b306-17c6562cadd0} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" socket3⤵
- Checks processor information in registry
PID:5148 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3240 -prefMapHandle 3100 -prefsLen 25634 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47910aca-f8f3-4a15-a032-8f070bb41ec8} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab3⤵PID:5216
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -childID 2 -isForBrowser -prefsHandle 4196 -prefMapHandle 1324 -prefsLen 30867 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8ad8063-791e-4bd2-8214-77ff015b3c54} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab3⤵PID:5888
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4644 -prefMapHandle 4708 -prefsLen 30867 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {110b6591-92fb-4ff6-a50f-0287c34db504} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" utility3⤵
- Checks processor information in registry
PID:4320 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3944 -childID 3 -isForBrowser -prefsHandle 5072 -prefMapHandle 5012 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3da684e-bad6-4f4b-9ac2-6d05cf25237e} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab3⤵PID:5444
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfeb311f-3830-44ef-b683-a07a164f70d9} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab3⤵PID:5684
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 5 -isForBrowser -prefsHandle 5496 -prefMapHandle 5492 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4db36b5c-cd46-4c2f-861f-61e4e54d6015} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab3⤵PID:5736
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4428 -childID 6 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 27069 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90393764-02fd-4e89-82ca-a0d1770d042b} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab3⤵PID:1076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
61B
MD54df4574bfbb7e0b0bc56c2c9b12b6c47
SHA181efcbd3e3da8221444a21f45305af6fa4b71907
SHA256e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
SHA51278b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD5e20aad9f402f3686d974327a69828b4b
SHA1505217bd3c7607bf8de34f3103b9f93f2e02aeaa
SHA256baa1728f1b8b07e61328b7cc890d7709a3054e2d484380d352bca209682060ef
SHA51290dac7c2b68d6cce021e19290015025686fd2d0a1bd2bf8bc1bdb70aa0f93f2e61219c16f871a920ea027a220afd2ad04adb11b5290c51b6b90695fa034beb4c
-
Filesize
77KB
MD54a6db8e7a3493dd57ed035b76b7f3971
SHA164a5b39608c76542c3fe7ae885bbb2b95f98b690
SHA256848d2d3e3172549aecd034ffb570e69c3eb1984fb5e4234380c4ad446e5bf3ad
SHA512af363ce5d6c37fbfb2c75c25162a8d78f192125e16d19ff30082039c4e2f4787ba93583deb9017f18a342ca27daccce9c698e7651ebd05ce2f711ffe3575fe83
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
Filesize
6KB
MD57e774c77aa8248cf22e61dcbc4360bba
SHA188b0340e8d88b9f6174e46a5253c9da4aaf8ca2c
SHA2565f9562721e8017218c6d4f2b9e4aef0063977993f8d02ed151ad4f090c1c5739
SHA5120e4bcb00e57c0041f2ab586a93bc05464aba1caae371e514b2a12124080b0f98e685ac96119d80ccbfb1a59caf39cc496efe9524f2e7bef622abf2283c96a3fe
-
Filesize
6KB
MD5f6db00d2e9ea7c3aa14d075dedbba536
SHA11c7199256fbcd63e29cb4cd166f3ad623c9eabe9
SHA2564c28206736df8efda4ee4f311def5a2103c420fad8f032b40505e93565adb740
SHA512e21eff00695f68e3373ddf29ffd123fdf9b47e326f99b310bee78678f2df4683545ac07e3f14fedf470070991060ea966dcb65c9c4449bf46548ae241b784da1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5ea075d5a97894673aa35696f264290cc
SHA1887795daa2fc0ec0e0585f1b60ed881cca868c92
SHA256089933194635c76e56739e6d48d4cc4b0a5471a6f450fab8e1531bd5d1903cf2
SHA512f0fafa419e8e478c15b35a837b0ad64665c68f31188e596b67c54da5c3fa9df4a159414cb071a5e67ae86996c5561f8905d41ec908e162e6a4c32c57ce09890c
-
Filesize
8KB
MD56a45f1b0ff3222a9397360f42729e387
SHA148d05e3a5ffd93d19018e457035049e687977be3
SHA25634e1225a5d3c4076235234f0db59621c167a1e041387caf9f1e1742acfd7aef5
SHA512a32067c5f3a24b623de1313cd86c374ccd783b954b0daf984709f5b382f9e1cea38d7fbc8d89c27c6d0611c7169c85d5b833313a043f30f1d9d61fccdf271899
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\l594d31n.default-release\activity-stream.discovery_stream.json.tmp
Filesize18KB
MD5847d35e6869a3a97c49069a791934cdb
SHA19bc198079f77d0fd64d6fc5af2607f3a52ae3724
SHA256e3aa516b6cf5a07be98c9554e3f93f2c17af18e4a5acaeb42a0d080975046ec6
SHA51251e4b790c6ba7bc0a3ea2c6672b04fcfa19dd871792a55d9ed6c490bcb9088fb41d51aa9f15a51142e3860ce17a47fe183ad0aaf03cff5022e21e694da071bbf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD530b0a06d1c810e730107bff293dcdcaa
SHA1a5971530be282012cd1c625ca8f3b76bd4fd77db
SHA2567b0dd19d3d02dc2bf0454ce452f16f5640c0dfde170a17a27a2712c502f8792b
SHA5127e603d0c4d469c6096efb79b6127003accb584012b9bef8cd4e1579c2f7bb73fabfe1c2f13a447b3fd29f94dfefaac5da1ee0b1cd9e872b24ba353248bef2aa6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5c984b3e484b274336d84725c54843185
SHA1e1b339e95079430e642208049fcda96d92a3f808
SHA25623ef9c334dd7eb4eb874e48fe6777ab3766996e392ebe4ab6bd4d62f188611f5
SHA5120cf4ffc6bef112a63fce06fd0be1e8b761fcaaead9f95bd843fcf59713568ce7f7ac4e5b2f3382156a428f54d3b11f12046792b8011307e27f17e339d3b231a5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp
Filesize23KB
MD5d9eaf3a1b4d5a4ac8b5fcb63946bffeb
SHA135e52607a8fabe616a9163e210ff6131e8a02bf7
SHA256c96c9423cebb3be397e746b428d8ebad71dab3b8a28377d459b4199dedc996c9
SHA51273118f9bb79ca6c8bbe3318f09433a057686b92ad6732f03c460d76f7995d2b5f100b3e409ee3366f7a78c2e00a2d63b2d5e3b06385cc16e9fd5d5ea6c3e1bdd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\25a36f23-f395-4e27-8a5a-deac2298952f
Filesize659B
MD59bc977e4266fc9819ef2c37eedf7a675
SHA16564c4df1fcb9fd2a7c2523a96f2dd0741465022
SHA25641ecfd9e35140ccf9542064493866897be7fbc3fce9b4ae8fcc5dd9110c7047c
SHA5129b273f6e2e52445f8ac0cb2cab0f39d372d3dad2ec9375663177c2d56651a505d6cd4aa31a24bfb4669355ad30b5df059a9fc1f270877ea05445a824b9a9555b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\35895763-3c5a-4f56-9740-a57985f5ff58
Filesize756B
MD58fe55216df1da28ddce3f369599a3591
SHA17d5ef3d0a9d7038b447b3e06fc73d22e56d43c60
SHA2563f14cc1bf6520c97abfea7c9ad158bdfc9a1f72771625e79e156681139bb703d
SHA512863c356b269fd3b77f8be5b2db7ed2d6007a70b4040faae2568c1609a5cf9c5b3b3ad4c545291605cc1b87aeac47b9a630eb45c690a2cee6955bc550497b0260
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\b6b3ba2e-a805-4a9b-af83-134d2720004c
Filesize982B
MD5d896618fecd63fed7fda4a02a0ad5696
SHA15c0c793acf2886b67e28d17c36a3997fbb649639
SHA25608e9257b8c59c6854ebb0d50eb5d8b6e1af35bce5d84d67961f365d07403958f
SHA512167982439b9409ea05a9fcc347ea84469ba8397e3aa475e7c43f830ad4346ad080d6e8971d3458ce69a50724a73cbe390549876fb94ab5e968d7a856210516fa
-
Filesize
8KB
MD53c4a46e4a21a25d56cc754c23ea7b65e
SHA1a8028f60afde07efb9ba56b9fbb4c847ff93474c
SHA256c1f51a928be02f7ca9ca95907b01337f7c4bc8839d93d4acb56ad45dcbac740f
SHA51230a463a68dceb4fb62c066e14c5e157a0261adf122a67ca54091bc67c88a0deb923a9932eaf504914b00066f2fb64630fc2e80903fc7ff844de9b0a1ff2dbc56
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e