2f1c3f37c6468ebb385731ae5867a7a142ebd58cbb6791f3208a19504cc7e822

Resubmissions

05/07/2024, 22:54

240705-2vvkhayaqk7

05/07/2024, 22:51

240705-2s416azhrf7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ 4.0 Clean/MEMZ-Clean.exe
Size 12KB
Sample240705-2s416azhrf
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2133704870-72480668-1360283475-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2808	AUDIODG.EXE
Token: SeDebugPrivilege	4228	firefox.exe
Token: SeDebugPrivilege	4228	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe
4228	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4228	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4700 wrote to memory of 4228	4700	firefox.exe	86
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1604	4228	firefox.exe	87
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88
PID 4228 wrote to memory of 1344	4228	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\MEMZ-Clean.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\MEMZ-Clean.exe"
1⤵
PID:5056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.0.1533450942\248485325" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1744 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ae19bb-88ba-4e4e-8c83-005e34e065e5} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 1832 230ccd0e558 gpu
    3⤵
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.1.1570871268\1157184416" -parentBuildID 20230214051806 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd44217b-d7a1-4b00-b05f-6d9cf5e2c240} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 2360 230b8b88a58 socket
    3⤵
    - Checks processor information in registry
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.2.1879693099\338121305" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2872 -prefsLen 22213 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da387431-a7ff-4302-ac3f-6c6e8bf497f6} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 2992 230cf9f9658 tab
    3⤵
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.3.1543457301\1125492513" -childID 2 -isForBrowser -prefsHandle 1256 -prefMapHandle 2500 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78f6788b-dcc7-4221-8bf7-b950c5f8b5d0} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 3496 230d245a558 tab
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.4.109046630\747900629" -childID 3 -isForBrowser -prefsHandle 5168 -prefMapHandle 5164 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c70e8337-e43f-4731-9f6c-2b22e53c98fb} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5176 230d1d9ae58 tab
    3⤵
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.5.427861867\1570025282" -childID 4 -isForBrowser -prefsHandle 5132 -prefMapHandle 5136 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac467443-fc8a-4537-8b97-ce42e5c40994} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5292 230d1d9c958 tab
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.6.1888562027\969660329" -childID 5 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fd4594e-76c7-4203-906f-6bcebf66794c} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5460 230cf349758 tab
    3⤵
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.7.544528045\605838079" -childID 6 -isForBrowser -prefsHandle 5852 -prefMapHandle 5844 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0689eeb-1dd3-4fce-a2cb-a1ce364648a8} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5860 230d6459858 tab
    3⤵
    PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.8.1807439338\1413807575" -parentBuildID 20230214051806 -prefsHandle 6084 -prefMapHandle 6080 -prefsLen 27695 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbc1b409-f461-43c6-a3f7-78cd772aca44} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 6092 230d64d2a58 rdd
    3⤵
    PID:1828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.9.535054279\1590752639" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6000 -prefMapHandle 6004 -prefsLen 27695 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e7bff2a-fc0b-4417-8327-ad350762e278} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 5988 230d64d1b58 utility
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.10.1573199766\836961829" -childID 7 -isForBrowser -prefsHandle 6340 -prefMapHandle 6356 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1fbebec-aa83-42ae-b6b3-f7eff7970b5c} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 3716 230cbd26a58 tab
    3⤵
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.11.98018860\1552188195" -childID 8 -isForBrowser -prefsHandle 6604 -prefMapHandle 6600 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c00a0a7-5af0-4d48-9345-366011259e19} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 6612 230d2848258 tab
    3⤵
    PID:1868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.12.355970184\314951168" -childID 9 -isForBrowser -prefsHandle 6804 -prefMapHandle 6800 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a08dd7c1-a403-4cb2-8c1d-ee9acf378358} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 6720 230d2845e58 tab
    3⤵
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.13.2102245273\1155081191" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 5584 -prefMapHandle 5596 -prefsLen 27695 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17abe971-63cf-43a8-93da-9fb0dd45822f} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 10928 230cc0a1c58 utility
    3⤵
    PID:244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.14.984645257\161093332" -childID 10 -isForBrowser -prefsHandle 10744 -prefMapHandle 10748 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f31e4ff-00d0-47bc-967f-846e868a52ab} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 10732 230d5a78b58 tab
    3⤵
    PID:2504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4228.15.1336448479\647077060" -childID 11 -isForBrowser -prefsHandle 11036 -prefMapHandle 10564 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5efe7b91-f5cf-4215-8209-6410431aea7a} 4228 "\\.\pipe\gecko-crash-server-pipe.4228" 11048 230d6d4d758 tab
    3⤵
    PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 a202aa7cc6beb18bb66c8dd652c6798cc891bcab80fc3dd4d3e92092cc64c383
MD5 fd2546da2e81e2a4b4659c04452e4bfe
SHA1 2a3006c8af06585e80ab817c26d7f54c6ceeb6c0
SHA512 c407b8575105bc42ed6edb7b5ef8f0af9382cc1c3aa47fa39ddac64deff352679b879a38e390a09fa96c8f6506af92c0ec1898d28fab1028c610e1426c57f259
SSDEEP 384:zYAMsqZZeCVJ2LKMcQmWNstfuJv6T/sQUg4s9NHkW8Rf0yau3QzObxezObxFjl:zYAMrnFVULPmO8sBq9Hlyd3vbHbnjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\activity-stream.discovery_stream.json.tmp
Size 27KB
SHA256 1317ba423015ba54a38a132f84f3674c6b371d56a15d397cf64c8a2234fc0c6f
MD5 affe0d7e74f30e00ed1ef00f29161a7c
SHA1 e2aee736e42d96eb0e64d74262b944ec627a3efd
SHA512 42e502ec22132af007a9139211b0294d29f06b25a2c3dcfcb03734ff139deb2dd8517ae2c49ee37afafb21f827c493f5bfd00c93eba31130ca86520ee5a8ea76
SSDEEP 768:zklv3a8Ivan4QwZXx652Mrvn2yd3vbHbnjl:olyZin9wr652MrvtVZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

81B21244DFA07CD79E5FC20CC51257B0B2224274

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\cache2\entries\81B21244DFA07CD79E5FC20CC51257B0B2224274
Size 756KB
SHA256 08d2eb3c28e2bf5d74907c0f71bad3f5ce5521a282b23be92cc095ac1cc32ed1
MD5 98f3d61a1c48b0aaa63a7d7f4c1e226c
SHA1 1a3942823ccdc92ae88421c53c1ce89fcf704d64
SHA512 0572e2cb66b4275a5fd7f6ee842353ca484c3c3df635f72a5fe857be962d789155e3e3b4570bb97c4335a9ec021ab89584f275d0eb1392090fc7ae4c02474f81
SSDEEP 12288:DvP3BMAMj6XDZaIzq+x99MGQutyQ7lJqVTxXRfmSAg9hCcwxuCFwXBdAkGebwole:DvvyAMj6XDZaIzq+x99MGQutyQ7lwVTg
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\prefs-1.js
Size 6KB
SHA256 34dbf6378e4df106c025550967c0c28f904a65263abf89ddd61e8dc9b5edd0d7
MD5 bbe2c9372edf724f7293aada5d418080
SHA1 91b16785f1350f32336b5b1bde009dc0dede1cfb
SHA512 18799aaa7c8172a818405088c1cb22b0c8771547fc862b89e098f7139070508fbdabc250c7e1968fbfc03061a4be96f77d88145010d1a4ffaa725d8a6a924184
SSDEEP 96:xHt5nUTUOqGqqfU8rZULHzS/0XlnBOj8y3I2HYTyE/3uBw8H8RKSo:r5n5RqfHrZ0q0XbG3IY8/+Bw8H88So
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\prefs-1.js
Size 7KB
SHA256 62bffb51228d7192a3a5ff04a39a485f2ebc7a632f3628ce7bad4aa1915b87d8
MD5 48c0746894e9253ecdbed4261727548b
SHA1 2b873c9fed7809bf158991ed8b25e69e27d3b18b
SHA512 479d346b0dc26aa38baf11f706bcc41c943ec2f75f379fce466d44a37b2c8bb22e3c5565f911cdb6e96530eb1b99f177b3d6ec35c056e8cbbe04b468426508bf
SSDEEP 96:xHtDnUTUOqGqqfU8nALHzS/0XlnBOjO3I2HYTyE/3uBw8H8RKDSo:rDn5RqfHnIq0Xbt3IY8/+Bw8H88So
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\sessionstore-backups\recovery.jsonlz4
Size 16KB
SHA256 95cad85ba8791599a79f1e918dbc4519aab598fb9d09ae917a9603c99bc1c32f
MD5 e857a86532537ad00bcf1c6c1d0519fe
SHA1 2d0c1bad6848c001524a916f2a0957e431aa26da
SHA512 468016e3d7bd0c6d3f94dd0a046ee19d8fadee3e8f238d548df7dee29d8c22189a3645c009ba6171bbd6d40ac39bc756ac6c56d7887d509b8105f15ab500f379
SSDEEP 384:1YvEc+hXJp3hL2IMqDh6MjgqxdrirKG2/GiKV2ERxJMx:1Gl2pRL2IMqRjgq3cKGiGvVRRru
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 9bb93760c53a7f813ee5050ddcea952ecfe9ae12907831d244e47e58a2d7a0fe
MD5 1b1278b068f9a16ce7e1b4b1405375d6
SHA1 29e175c84a55fc71f7942d1cd8d6e1bb81b8a669
SHA512 5d54d7540bc6a18758efcb271bc75a7814dc97ff30fafe841ed793e3e5835b1f284eeb493d7227406a6d3500e120ce950aa9a86265ceaa72e09519d1563e6f2f
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b5ssbkd8.default-release\sessionstore.jsonlz4
Size 16KB
SHA256 54386afe946f4c1abbd2d5d1e8dc3ce77eb910cd79241cf00b0f705318b84d91
MD5 3f09500c17337742a12834e0338ce94e
SHA1 15fdf922415bd816e9273912ad5a1f883d674d5d
SHA512 5fe855f85c23be2cae962ae6398fb39aba427d79a5d3f2ab2692051952c95940f1910c08a2a432756716650bba6efe19f085267ffd4a2987199528e733a9443b
SSDEEP 384:GNvEc+hXJp3hL2IMqDh6MjgqxdrirKG2/GiKV2ERxJwd:Gtl2pRL2IMqRjgq3cKGiGvVRRr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads