1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a

Resubmissions

13-11-2024 11:32

241113-nnbbds1cra 3

15-06-2024 07:25

240615-h82q7awbqj 8

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

luajit.exe
Size

89KB
MD5

dd98a43cb27efd5bcc29efb23fdd6ca5
SHA1

38f621f3f0df5764938015b56ecfa54948dde8f5
SHA256

1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
SHA512

871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
SSDEEP

1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4012	winrar-x64-701.exe
2796	uninstall.exe
2696	WinRAR.exe

Loads dropped DLL 13 IoCs

pid	Process
2608	firefox.exe
1372	Process not Found
1372	Process not Found
4012	winrar-x64-701.exe
1372	Process not Found
2796	uninstall.exe
2796	uninstall.exe
1372	Process not Found
1372	Process not Found
1372	Process not Found
1372	Process not Found
1372	Process not Found
1372	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
219	href.li
220	href.li
221	href.li
222	href.li

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259523341	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	winrar-x64-701.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\wvSJhdw2v0a.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe
Token: SeDebugPrivilege	2796	uninstall.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
4012	winrar-x64-701.exe
4012	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 3024 wrote to memory of 2608	3024	firefox.exe	32
PID 2608 wrote to memory of 1672	2608	firefox.exe	33
PID 2608 wrote to memory of 1672	2608	firefox.exe	33
PID 2608 wrote to memory of 1672	2608	firefox.exe	33
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 1344	2608	firefox.exe	34
PID 2608 wrote to memory of 2460	2608	firefox.exe	35
PID 2608 wrote to memory of 2460	2608	firefox.exe	35
PID 2608 wrote to memory of 2460	2608	firefox.exe	35
PID 2608 wrote to memory of 2460	2608	firefox.exe	35
PID 2608 wrote to memory of 2460	2608	firefox.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\luajit.exe
"C:\Users\Admin\AppData\Local\Temp\luajit.exe"
1⤵
PID:1768

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.0.62462500\952165839" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9914378b-dddd-4a33-a2f7-3364286355fe} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 1348 109f3658 gpu
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.1.282579337\1619515360" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7accd62f-f75b-4902-86af-25b7b4884e1e} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 1516 d72558 socket
    3⤵
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.2.1199919170\564524205" -childID 1 -isForBrowser -prefsHandle 2128 -prefMapHandle 2124 -prefsLen 21031 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {973f45ec-7d4d-421c-b749-634123e22797} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 2152 19873858 tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.3.94366884\1072481899" -childID 2 -isForBrowser -prefsHandle 620 -prefMapHandle 616 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5fd620d-ad41-46eb-938c-0a94abd382e4} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 2508 d61058 tab
    3⤵
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.4.2004673012\955154218" -childID 3 -isForBrowser -prefsHandle 2600 -prefMapHandle 2872 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {568e2ca0-332b-4d14-855f-8016f97d1452} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 2972 1bc76b58 tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.5.249027880\216368156" -childID 4 -isForBrowser -prefsHandle 1072 -prefMapHandle 3856 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ade54cc7-6717-4eec-a452-24133545fda8} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 3912 1e96b258 tab
    3⤵
    PID:2740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.6.1841760065\2024718665" -childID 5 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db8f153f-9bef-4f0d-92f8-a6c22b02d20e} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 3960 1e96b558 tab
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.7.39858507\470405618" -childID 6 -isForBrowser -prefsHandle 4044 -prefMapHandle 3912 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {346ec7a3-c86f-4488-b147-242e4887bf1f} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 4336 1e968258 tab
    3⤵
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.8.1333540771\918573167" -childID 7 -isForBrowser -prefsHandle 4560 -prefMapHandle 4556 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56f9ba21-d188-49b1-8e1b-67fbcd92f030} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 4584 21cf8558 tab
    3⤵
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.9.1202698747\1357901758" -childID 8 -isForBrowser -prefsHandle 4124 -prefMapHandle 4472 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6943f36c-541a-456f-939c-a0c2ab68e40e} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 3924 1b769858 tab
    3⤵
    PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.10.1012474828\1395718605" -parentBuildID 20221007134813 -prefsHandle 3048 -prefMapHandle 3036 -prefsLen 26531 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07092069-55ba-40a9-89b1-bb705c5414a9} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 3052 21dce558 rdd
    3⤵
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.11.1662497992\635573265" -childID 9 -isForBrowser -prefsHandle 2440 -prefMapHandle 1868 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa36638f-e2d7-4294-903b-7005d47b5d1e} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 1884 19836658 tab
    3⤵
    PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.12.1596638781\74231630" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4884 -prefMapHandle 4888 -prefsLen 26531 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {502e6e62-28a1-409f-9a28-68ccc472f6a7} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 4872 1c71e558 utility
    3⤵
    PID:1536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.13.1050931487\1735149398" -childID 10 -isForBrowser -prefsHandle 8748 -prefMapHandle 8752 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {465068e7-17cf-47a2-8bf9-e1b772fc50f3} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 8736 21e39958 tab
    3⤵
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.14.1166582109\1515526415" -childID 11 -isForBrowser -prefsHandle 8764 -prefMapHandle 8768 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8544b99-a52a-4e69-ac34-4a8585d01e77} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 8312 d5f558 tab
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.15.1392153655\184091540" -childID 12 -isForBrowser -prefsHandle 8312 -prefMapHandle 8764 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c72fa4f-4160-4d4a-991e-a9bd6840daf5} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 8432 21a80458 tab
    3⤵
    PID:3268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.16.1338332237\1414731431" -childID 13 -isForBrowser -prefsHandle 3184 -prefMapHandle 4460 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {53bda570-b53c-4b96-82bd-6105b814996d} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 3188 22eedd58 tab
    3⤵
    PID:3264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2608.17.980038206\283695308" -childID 14 -isForBrowser -prefsHandle 8724 -prefMapHandle 8712 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a207ee7b-8f64-49d6-8fa4-e3a24be708fc} 2608 "\\.\pipe\gecko-crash-server-pipe.2608" 3960 23e37358 tab
    3⤵
    PID:4024
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4012
  - - C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system executable filetype association
      Registers COM server for autorun
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2796

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Temp1_wvSJhdw2v0a.zip\openMe.rar
1⤵
PID:3928

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_wvSJhdw2v0a.zip\openMe.rar"
1⤵
- Executes dropped EXE
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Rar.txt

Filesize
105KB

MD5
b954981a253f5e1ee25585037a0c5fee

SHA1
96566e5c591df1c740519371ee6953ac1dc6a13f

SHA256
59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

SHA512
6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
45KB

MD5
1c44c85fdab8e9c663405cd8e4c3dbbd

SHA1
74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

SHA256
33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

SHA512
46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
316KB

MD5
6ca1bc8bfe8b929f448e1742dacb8e7f

SHA1
eca3e637db230fa179dcd6c6499bd7d616f211e8

SHA256
997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

SHA512
d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
3.1MB

MD5
53cf9bacc49c034e9e947d75ffab9224

SHA1
7db940c68d5d351e4948f26425cd9aee09b49b3f

SHA256
3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3

SHA512
44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
df5e80bd05e71b70eacb0efd1aeed69c

SHA1
e6b4684332aa4f7592ecbac23594c8124709cc7e

SHA256
cb3a58813cc9551c4673062a438ed3f51c1a48e47df74e108da241e1dd88b5a4

SHA512
8ec5b0875a881f9637e3103cf730fbe898442e5d0b0ea8c33060146d286b54e007a908c00ba54ad325a4be0c45368ebd789f84021cf6b6be99ca5dbb20089ec2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
35066abe3297a482d34b45da8dc9e680

SHA1
c25c6aff91c7ded2248e5c9c9d94e44e33df2b96

SHA256
b7d63b69901784dc3def46687c9a6a25a7c333274babc90b6256238a82f3bc66

SHA512
92f677ef9edc50f7d40e30c80047fbfb88a3c33e521381c71988c3e19372dbddbf82fa6135c517b28773d8d79b2d8bfd555bb65547b022898571494f0d7a6590

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\cache2\doomed\439

Filesize
19KB

MD5
19e2a37ccd5c02e8633b04145b7e5ad7

SHA1
0b9e1ac8b3c068eb245917f89198ac6d608b49d8

SHA256
fa437fd13f748ef8937c4c436913fc9c3f0dfa643f2406a12dcbc204a3ab9fa4

SHA512
4bceb44ee587248fdd9d8ac95da90742e6e69dbcc52d4f90848466407efd9d66fd397bd5a392e63be83958b056b317099f3848caef2783df1248f4120b06bc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED5D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
90099261810dc807096b945d09fbb664

SHA1
9c7ce1dccdec4381d813fcf2474e5c618ef1186d

SHA256
e1ada8638b74f927fda9480c9b7101e9476515f2f0013ad530e120522e5ab07b

SHA512
2046060d91267a97dfa7ac95440c8b5a55d4941ce03b301008884805e141ff14a89ce01021c3191e066961bd9b180a69b07cb5b7ff0a58f268e52fbcf83adcba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\pending_pings\21031ddf-0a76-4fb9-be30-01e6202649d7

Filesize
11KB

MD5
4ff0777864a0adc983c9880584065ec6

SHA1
a3bcfcbbfb30c71a78061727b7f6134873fcb184

SHA256
999e587b97c7f6cc47867f97bfa867650731c348ad9e04a9a8b447125613e3cd

SHA512
221904ae6030b6c1931e55999f4a68ac1712c9c7d770e16d9dfb3da38d317d63e69d32dcd737d003268f1f96ef0ebb0672cee6920f3be5c9f308425666db3b19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\pending_pings\bc2099b9-ba62-4b37-a4c1-095f0cc2fc36

Filesize
745B

MD5
8e8bd0136366a1d2911a0efe8869924d

SHA1
478e32b89b9026933e8501cf48191bd7ea45fa1e

SHA256
2104be9ba38579452ccf48b66988a156273375d78f65ef3cfc0061fa242f4b1d

SHA512
5d211674a93d86761fcdac0f9721ace309efc35659fcf58be540f29abd76542ccd6c3214dd8ac4652156a740af72ddef1f654dd08762f23082f15191ee36ab23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js

Filesize
6KB

MD5
91ba48f66dc6fae0a9e04f65da1cb3e8

SHA1
3b63eff1d3ac7b2f89f9bdd314df4cbbc077663a

SHA256
d2e8826bab0a346413c09d50db92477254e754cff530c45e7dd08b010058e110

SHA512
eaf4880fac9802e2457d7d83d59499044cea2cc47950e5f3864e41d744cbe3c9bf7d584239fc795e9f4e67cbc24bd2580045ff14b7221fabc7a8abb3d6c83605

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js

Filesize
6KB

MD5
65f3bcc8906e08869daa8ca811156b56

SHA1
f4f770bbc45f57463a7fb1e265c7bd7b84d5b7e6

SHA256
b64e4d26bd2b3b172a61d732f1d23b6255716bed19cf8da36b34719b9451c6a1

SHA512
7aa6a99ce94e2999eabc34155c6188adfc5522e02f60dac827e16437cd1e2d8b5a471dce0116834acb0f29533fb0c8d09801d8e2c10290a319bfac633d27c662

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
63fab118fac3c056084085bf5f5fc5a3

SHA1
44e527ab27dd77700e66e9f82c1cfb48309047f9

SHA256
c17d45413b6c37c993446e50e193e73e9e96b8d24e84ef22a6833d8df15ce16b

SHA512
48ddb9e09c09bec18f5243c25e274d282deb352a9deac1f8f8de1f8f20d0c8ec98100892740cc2a4697eb0e13050a42928de2df8af36b6f62115f9053ec6c360

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
4a5975ad9604881af029887b719f6d7e

SHA1
56458f6758468dc8e04f315637dc740b5a01ace6

SHA256
1eb6b21a7cbbc788b20102bf740e089b84e964a2cce4b71e6b20a0d194f2e739

SHA512
7ad13a7635225763f8dc5d1b171eba904118c6431c048267c328052edd8c0e826a23199ca77293fa578e598219a3ed55d2b87db4b83765522ccb170bc645cd4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
ff0da525676839d5202d578076559c3a

SHA1
346b5c519d8ed9354771abfcb78b547224d33c9a

SHA256
b7761307a2697b94e7a69bbdc36f2fdd1d6ad5c067545b48721dce497028e44d

SHA512
4edc9f483398ef0c2f92071389c2991d585e5d780dddaff05ef632b48d6326b2be9a57b175b6ca25f2356f69d9f02076eba30b7d1f8da41e811606b9bd74c310

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
63bf649a6c2bd67d0122da57ac78bf55

SHA1
ba84a653f7933849c41ecf43109c4ab5eba3a2db

SHA256
c9f34dd65b565fa760a8c218291cda2ee94fc7a19071f9e09a489eccbb4cffed

SHA512
59bdd59d0b2c5e3cd891a78a5de4dc2b32e8ca67f250c89b8ec1ec6981caf4d78b50e6dc3108ef921453bae943bb60878078394bfafee995e0950fbbabca312a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
fdae3df3e0f9b59b0fe977d5f9eddd22

SHA1
1119bc741bd0f92097af393eeaf7a9ab7fe38774

SHA256
d5c2afc4182b6caf4a7189f153dfa2591ba03fb344f67c33cc99445378317768

SHA512
1dde297894efbad53fd66a0c058818c5b5ac298f96176c07709b823b6b9e00eb1da02d3e0acb4057261c189edfd1b5d026852be80ae7abbab5f6c2774779b493

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
21KB

MD5
cfa721446559f7a4bce3e80bcbeb834f

SHA1
7fdcc83eb02a5e55e77e41fd333cd9eaf53d188d

SHA256
4fb2c4202c57b9d358a88ae095ecd19be6035afd54a1839345685dc674750742

SHA512
73f15e8c7c0e71d417dc7a191133ddb5bc16ded802b18ad0b83e22f1d2cf3b0698d43acfebcf15cedc6a5822606b0574e7a3f912e50ebc04d6f2cb4b14ff297a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\storage\default\https+++www.youtube.com\cache\morgue\12\{55026307-741d-4a21-9a3b-e92ffde55d0c}.final

Filesize
4KB

MD5
216d5100e6461081d6164e9c0bbf0456

SHA1
63aed06ca1176168b7d8fb8e20a07bf877e96b6a

SHA256
57a8069509f1b91eda7c5593478b64cd9a2e0fcf94214dec19320e8eccd95a5c

SHA512
b70bcd70d91da39178c3db4e92ade598ed6c0a8204d608e7c279cfaedd72baadfe401b8ce9a44352f54d003011a74a981e9e27354e2cb19f0f3854b8387b21ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\storage\default\https+++www.youtube.com\cache\morgue\249\{53570836-04e8-4574-aa92-7e5ab020ecf9}.final

Filesize
78KB

MD5
aee23d6075f7ccf0bccce95c3b370569

SHA1
db578d7a14719e82cdfbb2bb203e2c63e1f76d2c

SHA256
8d8355994824442b0af64dba9f94dad96d8153617a46f0020a0b6a8176eb8c02

SHA512
3f19f5f222111c2406812595566cfc760e29b78e9d0fbd55bc0a5e85ddad96db00fcc319e96be158dcbc348e4f61c6a435e2540d68d433d39dafc3017f641b59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite

Filesize
48KB

MD5
2738868382720d98c6cf54a6824a604c

SHA1
c0bfd6b958f729389b6339496a663ed252ec9ef6

SHA256
849f6a965a0791b8956e54709f5e5737e150bc07cd9aebe47cb77056e4fe0462

SHA512
539d94fbd3f848e695b086eeab2980ad6d397d29e1448ebb97918955a2a97134aded31a2ff0e7eeccde11186de5116c97c519c0c49418b9ccfe012d6c81528a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
8KB

MD5
2365169ba45fafd45787f9819d67f286

SHA1
625c553e5d21227f029a07235f9270cc9e31fbad

SHA256
7509b441630fda72f21b69285046ae6d692e67939937447937993d809578f162

SHA512
147daf0523c0da400f9ad1e86f6c55a31bcd04926e5b1a2699ecb904e3ff293e9532d3eee05a5920f2cb47e58df83708a873890fa746c231c5576098bf19d9f7

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.gkFmf1up.exe.part

Filesize
36KB

MD5
8147d62cc47269438229bc03aeb66629

SHA1
20334a16bed40d48bf5c58d752390d8769e357bf

SHA256
94a01d73484090ffdf8338237a0a61fc977d6cf70402948f8a680664a7071705

SHA512
cfa2b04ff19a18397cdf935cae58b258ffa10bdb62103a19eeaa94e692975bc2db531b6349dc42aceab22e0c120960ae09ec0587f01d2ad263016639f1350e36

Download Submit
C:\Users\Admin\Downloads\wvSJhdw2v0a.TxpIGN9U.zip.part

Filesize
8.6MB

MD5
6bcb2ef23ce750c4c130be1d2594d24f

SHA1
823f65cf08a3e47695e35688231dc77c29dab23d

SHA256
cce2f13f31cc5bd27c752b707a8c62784c6dc10c5ce94625ee6a6cb50200dbab

SHA512
8b1ff7b1167a748556e9cbba307d2e1d82597e32c04e0291de738c74af66741a7ea3e424fd7f0cafca8a4e3f35c98fc9b6ce3049ef1d09fa5095c18a32ac32d4

Download Submit
\Program Files\WinRAR\Uninstall.exe

Filesize
477KB

MD5
4783f1a5f0bba7a6a40cb74bc8c41217

SHA1
a22b9dc8074296841a5a78ea41f0e2270f7b7ad7

SHA256
f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c

SHA512
463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e

Download Submit
\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads