Malware Analysis Report

2024-12-08 03:01

Sample ID 240510-3e33dafh5y
Target Photoshop.exe
SHA256 ee28d2a74a1bb0daab49959e17e4f7d3ebca97d52bab57b850753a0b47408870
Tags
privateloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee28d2a74a1bb0daab49959e17e4f7d3ebca97d52bab57b850753a0b47408870

Threat Level: Known bad

The file Photoshop.exe was found to be: Known bad.

Malicious Activity Summary

privateloader

Privateloader family

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks processor information in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 23:27

Signatures

Privateloader family

privateloader

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 23:26

Reported

2024-05-10 23:30

Platform

win7-20240508-en

Max time kernel

121s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2540 wrote to memory of 2588 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1624 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2588 wrote to memory of 1000 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Photoshop.exe

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RevokeGroup.asx"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.0.1898068250\1797860591" -parentBuildID 20221007134813 -prefsHandle 1256 -prefMapHandle 1248 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e410e316-c2d0-4448-9767-353099b9d727} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 1344 109d7058 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.1.11436306\363003628" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c78357-d87d-4b70-b735-d112f305149c} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 1532 d70158 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.2.568563742\571585641" -childID 1 -isForBrowser -prefsHandle 2032 -prefMapHandle 2028 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c425d70c-6264-451f-86eb-4524e80c33e0} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 2044 19058958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.3.662460630\1954515709" -childID 2 -isForBrowser -prefsHandle 2412 -prefMapHandle 744 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba7a2cd7-625f-423b-8bc0-81338cd87943} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 2428 d62558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.4.167385338\2129182162" -childID 3 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cf2fbe4-35b7-42bd-9657-abe0f6c69b55} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 2748 1c2d9158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.5.635029241\1255558224" -childID 4 -isForBrowser -prefsHandle 3824 -prefMapHandle 3820 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3eb618c-19c6-4394-b21c-ce11ff208f26} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 3836 1f70c158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.6.1581111877\2133441564" -childID 5 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6408bd7a-9e19-4979-9654-9fe5092d96ea} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 3932 1f70c758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2588.7.1573333264\2023593589" -childID 6 -isForBrowser -prefsHandle 4144 -prefMapHandle 4148 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {313299ca-325d-441f-b132-c2bccd7417c9} 2588 "\\.\pipe\gecko-crash-server-pipe.2588" 4116 1f70d658 tab

Network

Country Destination Domain Proto
N/A 127.0.0.1:49207 tcp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 44.233.67.78:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
N/A 127.0.0.1:49214 tcp

Files

memory/2992-12-0x000000013F620000-0x000000013F718000-memory.dmp

memory/2992-13-0x000007FEF67D0000-0x000007FEF6804000-memory.dmp

memory/2992-14-0x000007FEF5680000-0x000007FEF5936000-memory.dmp

memory/2992-16-0x000007FEF31D0000-0x000007FEF32DE000-memory.dmp

memory/2992-15-0x000007FEF4350000-0x000007FEF5400000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\datareporting\glean\pending_pings\f44a1f78-adc6-433d-9fa5-9af54bce4d1f

MD5 00bce7978534e2d20ba684049bcb2dec
SHA1 8ba3cb2ce69e7819e8bb78f5f612c3c773327587
SHA256 46737756dceade184c054831e3bcdc33ffa3360fd53d5d01d53d671046638516
SHA512 f043257165e0c6feb6bcf957d9dde330b4084fdac8ab19408d999bc4e40851ab6c6177e93096731c3446bffcc7c2fcfec2cb54d315d807de6bb88e55986836b6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\datareporting\glean\db\data.safe.bin

MD5 5fc7398623832667f2643c35b77b2236
SHA1 1069deb5f969ed33f4993f3be15062fc83edfa0d
SHA256 f8d041178e4732fb6d34194dda07ef56035d169b6c26221d259d999e4961a2b5
SHA512 facb05873281bc311b0977c0e57ffaaf42924cc2f9237d950a2cfd5bc6bb67390190d99969a691ab9065bbc679e0e455c57d20ecc3e3b0f219aed46c1b52c7f0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\datareporting\glean\pending_pings\56d7583d-369b-4cfa-a4d0-2678feec1a50

MD5 4b50723995409340ce723ea51208c546
SHA1 4471c8829517a8aedc20e6155edf1762d283dc3a
SHA256 1461cbd8a93cd2623dd42ffe433bc98f9eec841706d76f91048e247d0f9686f1
SHA512 047fe35dbf461da4166f4541cf1f2dfb27b61baaee3a6d2151afb3e3144e2443cd99f53be20aa0e88ef155c543a12b205c2b00826940e71bad9834b362610c1c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\activity-stream.discovery_stream.json.tmp

MD5 b13ab408e49d6fdddaa9a7fdc1684bf8
SHA1 73957f275136c632ce4e9b58827851a235c6f8ce
SHA256 5d87173e8e13d87e45f000e9b4aa0758d58cb923e6b87ab4550733ac2c39e721
SHA512 92028d0b1db9800faff25c9b33479ab1a1ec16bd2359688ba335c2afa826a749e42d4321ff0a33d7b990555a4196d8e583d82476c2d091890a142007a84ac315

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\activity-stream.discovery_stream.json.tmp

MD5 d01e15a4076a357cbe7c49ed7d52b64d
SHA1 3148f341d664ac5f99955896d8e2f4e7b828a126
SHA256 bf4697a7e0d7248a2e6093963b749fba7ef2d1e23ddabc09f35999d8bb5b3e56
SHA512 9fa618b5ce2001f18172bc1b6b14ac39aa8c0d61841e5351d1552fa0c71e81e599ba3d2abe0650462771f9424e2d482788a0a92c161c4f1bd921cd16dbc438c4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\prefs-1.js

MD5 97ef3656df0ae3e657846d8e969f3d49
SHA1 a8453c4ec4160992bd665831b1be7ce45e38e5c8
SHA256 a62cf9d332ede695f2db50b7006738c9e919d522d2a9bf0ef985602d545b6fa4
SHA512 6e5a0853579207d7daa78d6d9b38422691c1e563d6af5d7e999d96e89ccb09c634a93b9697c27f10668da4af81fee16c47227d1d0d05f13adeea1a3856653e18

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\prefs-1.js

MD5 97d3e9d1b5deeb509aaadea6fbfff835
SHA1 ffe4dc764ae8712d2c2e626a81f76dfa5983ff64
SHA256 e5cece56fac9172fb01b9b5843dccc009155e0d3da7d791764e0642b7b632f87
SHA512 47b62c3e6f9910ecf2a8fa491876c42e7ac6f7ab12f4a396048fa7a7410026a319fe395219733f7d7534c5e8c1b402cbba45b56e26956220bf00cbf758155b6e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\sessionstore.jsonlz4

MD5 3ba3f0d0efe7163551a670210a351ff2
SHA1 1b586bdbb4bdd873312140d6baec5ecbf29e24c1
SHA256 c8f6b3045469b207c1804301bda7fd90c485d1b37060306c40466e28a3980466
SHA512 01e636406429e43fc7522c4f26f61ed3d97ce532b57f81740a89f20aad51f9be4d4a92757657969e860a43220d5d32727575e286d2618049d1e8e931a4f1d11f

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 23:26

Reported

2024-05-10 23:30

Platform

win10v2004-20240426-en

Max time kernel

91s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Photoshop.exe

"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

N/A