Malware Analysis Report

2024-11-16 13:32

Sample ID 240620-y98h5azgqp
Target Feather Nowy.exe
SHA256 66116a575982dc2aafaa6dda428fd3b3f273b9a9b1d7e0ed789983a1c16d4c47
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

66116a575982dc2aafaa6dda428fd3b3f273b9a9b1d7e0ed789983a1c16d4c47

Threat Level: Known bad

The file Feather Nowy.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm family

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Drops startup file

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 20:30

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 20:30

Reported

2024-06-20 20:33

Platform

win11-20240508-en

Max time kernel

200s

Max time network

196s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nowy Feather.lnk C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nowy Feather.lnk C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nowy Feather = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Nowy Feather.exe" C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\schtasks.exe
PID 3016 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe C:\Windows\System32\schtasks.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2072 wrote to memory of 4916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4916 wrote to memory of 4988 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe

"C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Feather Nowy.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Feather Nowy.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nowy Feather.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Nowy Feather" /tr "C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe"

C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe

"C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.0.709696403\1340442566" -parentBuildID 20230214051806 -prefsHandle 1768 -prefMapHandle 1760 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {230eb4b8-a816-49f0-91e8-fbfa9baa88a4} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 1848 1974690d458 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.1.513284064\1409289038" -parentBuildID 20230214051806 -prefsHandle 2360 -prefMapHandle 2348 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a00e5ef-dd7a-4027-95fa-e3fa5bca1f8c} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 2372 19739b86558 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.2.1096958685\924794091" -childID 1 -isForBrowser -prefsHandle 2824 -prefMapHandle 2820 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1280 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df1fa52b-9958-49ee-9e12-b2a94195f32e} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 2932 197491edb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.3.1475303174\1110001194" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1280 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {809330bd-7e53-41ac-bfc5-7beb4d22da58} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 3576 1974c333058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.4.962251313\1350704960" -childID 3 -isForBrowser -prefsHandle 5064 -prefMapHandle 5068 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1280 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2bf7760-afa5-422a-a099-5aeb7b10324d} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 5012 1974e8acb58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.5.1444558165\1741890090" -childID 4 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1280 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88ae4eaf-e123-44aa-8791-16c0b3a06d9e} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 5192 1974e8ae658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4916.6.1672436971\1104303316" -childID 5 -isForBrowser -prefsHandle 5396 -prefMapHandle 5400 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1280 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d119628-db82-4f4b-869b-9ee8278b0a2d} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" 5384 1974e8ada58 tab

C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe

"C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe"

C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe

"C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 127.0.0.1:33694 tcp
US 8.8.8.8:53 lake-french.gl.at.ply.gg udp
N/A 127.0.0.1:49787 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
N/A 127.0.0.1:49793 tcp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 lake-french.gl.at.ply.gg udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 lake-french.gl.at.ply.gg udp
US 8.8.8.8:53 push.services.mozilla.com udp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
US 8.8.8.8:53 push.services.mozilla.com udp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
US 8.8.8.8:53 lake-french.gl.at.ply.gg udp
N/A 127.0.0.1:33694 tcp
N/A 127.0.0.1:33694 tcp
US 8.8.8.8:53 lake-french.gl.at.ply.gg udp

Files

memory/3016-0-0x00007FFC1B913000-0x00007FFC1B915000-memory.dmp

memory/3016-1-0x0000000000E70000-0x0000000000EA2000-memory.dmp

memory/3016-2-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

memory/3620-3-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozfkmo5e.soo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3620-4-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

memory/3620-13-0x000001F6FC7F0000-0x000001F6FC812000-memory.dmp

memory/3620-14-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

memory/3016-15-0x00007FFC1B913000-0x00007FFC1B915000-memory.dmp

memory/3620-16-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

memory/3620-19-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6903d57eed54e89b68ebb957928d1b99
SHA1 fade011fbf2e4bc044d41e380cf70bd6a9f73212
SHA256 36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52
SHA512 c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0b59f3fa12628f63b5713c4833570d7f
SHA1 badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb
SHA256 2332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d
SHA512 01724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 190b28f40c0edd3cc08d0fd3aca4779a
SHA1 425b98532b6a18aa2baece47605f1cf6c8cfbd11
SHA256 8a2c650430d93841587c726ffff72fb64e02d2da24c9d8df17e835d1124d53ce
SHA512 8d1c7a20b324937face0e0c9249d635b3dfcfbad004928de731baf0d72df9ee64fb3f482451d20eb55fa0364311a9806e9d49ae4eafca38d6b58a988f8807110

memory/3016-55-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Nowy Feather.exe

MD5 cc40307c984c4da5778486f9f8e490d0
SHA1 e0d09dd90cd8e6f2ac21bd91e7003c9bc0a15355
SHA256 66116a575982dc2aafaa6dda428fd3b3f273b9a9b1d7e0ed789983a1c16d4c47
SHA512 ec50078cb9d4cbbf29242a567b1b39e679676cead105e3babb73d20f3d09acf0a83f10e2ba73208dada2e34dea13f16df7ff1c919cee40fe9c1fc3b3cb4d81e4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\activity-stream.discovery_stream.json.tmp

MD5 f2b09c9bbac325d8e217f707b3bb88d3
SHA1 368bc7eda64c9f49b8265a6ece4674143cb535e6
SHA256 009f0a6c6e6d015411b22f2c51274ce06abb8db3cd413a531c1506f5c921ac44
SHA512 fe5d325eb058c1f373aa01090327924e53bda500edc3cc62c2c652f94a7e209b69721e220a89ad3e3c7709142d4632b89364c4798d1a6c89f505def0b7ed315e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

MD5 99512df2259a0802306742ee620e0d79
SHA1 9c535d4a969c560eed0e3588b5f5789b72b09372
SHA256 3935423f42ab5f1bc3d0c74418fbd92d48919b3dc8293da09a39f972f944bbde
SHA512 6694ed8a81d142c439900d15558683c9c1f0d43492b0b51eac5803f3efaee1b753bf5cfcc1ab86072ad5a5c4d8df42bd264e7721f03303ffededb66c467420c1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js

MD5 98eae1f5084f0dd81b2f593ad84d0592
SHA1 a0500fcd1c6cd20ca55b4dfe5505a18f7aff49c4
SHA256 438f264d9a6dc823544851c4b9b6cfe28b02e643171a1c3ca125003b4d16e6d5
SHA512 2be9f87f2d241cd1339182bcf3be90a48abe2b28bf3daafd7f2d1b81d04d73c1dc1134f10b80ae69f0fdeaf93c0121fddcafd5ee43a5284d5cbddb4908b6cea9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d6c0ed033892aed34733abc43ab39461
SHA1 3339c33bd55c8ce6c36ce7c73a5729a4381ef9a6
SHA256 cec682b0b23e3c37e1369a4f09fc74071c54b4e07c3a1d057403606977d29e90
SHA512 f241015f2258c1c13337e4ff8c1d9e5fa73e88aab8f1ba7e36f696adfab5533f47022cf11320812d8e144ba32b9dd74c1592a535caf01f37c751cb488482d09c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Nowy Feather.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore.jsonlz4

MD5 d58a33ae3fe7c5461b13250ade378063
SHA1 b1bc0d3705cdd6ab496a29930811a7b253cbed7b
SHA256 d2c9d231eb741b9aca3d6cd265310618a017df3157026ed9f82139654e43527d
SHA512 57e423abc3787ba28b65c52161b1caeb921d604734d96bf6e42d8c4bb058ee56ec61e4f1c17bb34850cecadbf5465176c850dc7cb5de84af192a818ede0e7184

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionCheckpoints.json

MD5 700fe59d2eb10b8cd28525fcc46bc0cc
SHA1 339badf0e1eba5332bff317d7cf8a41d5860390d
SHA256 4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
SHA512 3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4