8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
Size

1.2MB
MD5

48fa5095677ff648963744841e7be2a6
SHA1

81c1f09032e8224dcf343a3cf1019f8ac4844884
SHA256

8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64
SHA512

63ec28b0e6aab4bde7513181ef3cc29aadef18fccd9d2a2c22ee7b794f76e7df34ab1ba7081cbde64d7431a0aa0a7974a8d705164462b7ab5dacd656e397ba3e
SSDEEP

24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aL72Sbly7TWEPje:ZTvC/MTQYxsWR7aL72dW

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	firefox.exe
Token: SeDebugPrivilege	1336	firefox.exe
Token: SeDebugPrivilege	1336	firefox.exe
Token: SeDebugPrivilege	1336	firefox.exe
Token: SeDebugPrivilege	1336	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
1336	firefox.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1172	520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe	91
PID 520 wrote to memory of 1172	520	8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe	91
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1172 wrote to memory of 1336	1172	firefox.exe	93
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 2952	1336	firefox.exe	94
PID 1336 wrote to memory of 1920	1336	firefox.exe	95
PID 1336 wrote to memory of 1920	1336	firefox.exe	95
PID 1336 wrote to memory of 1920	1336	firefox.exe	95
PID 1336 wrote to memory of 1920	1336	firefox.exe	95
PID 1336 wrote to memory of 1920	1336	firefox.exe	95
PID 1336 wrote to memory of 1920	1336	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe
"C:\Users\Admin\AppData\Local\Temp\8c64cc4aeada51e72d11574b72d712155cd223803ba6ee4c658e383bd6a2eb64.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e151e9a3-9aae-420c-b536-ec35491a9cd4} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" gpu
      4⤵
      PID:2952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d4c4e4a-b697-43a9-917d-7565ff463227} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" socket
      4⤵
      PID:1920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3328 -prefMapHandle 1564 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c13785-a7c0-4ed1-a88e-1fb8922ac2a3} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" tab
      4⤵
      PID:1592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 2 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {503c007a-0be2-4ff3-9b2f-c703b515e4c3} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" tab
      4⤵
      PID:3880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4712 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4580 -prefMapHandle 4664 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bbcf608-a3bc-46d5-ab34-264bab7db89e} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" utility
      4⤵
      Checks processor information in registry
      PID:184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 3 -isForBrowser -prefsHandle 5404 -prefMapHandle 5392 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad0ddd17-309c-405a-8454-73e96501f20a} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" tab
      4⤵
      PID:6012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5416 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {942739ed-f53b-4a04-9b3a-a4ba5fa43be9} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" tab
      4⤵
      PID:6024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5684 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ca3952d-2108-475b-8bc4-2c0054bb5aa6} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" tab
      4⤵
      PID:6036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
e33d2096c719214519c01307a71a4347

SHA1
e061e523961bd8e50de70bc6895fc376aae403b8

SHA256
73e40b619fcb1f2f49fd6fa68456092c6b5e26d500de2a50e15184eee16a6453

SHA512
44cbd42d9a0a0fe12392399d2b4ab909d6b1ea77ac9f1287e052000a61ea6e3d99d17256b764c820c41089025a90ac28fce8c353fa646798489440ec550b2c86

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Filesize
13KB

MD5
8e70a129eda4e303505647829d4a568d

SHA1
ba583cd9fa131239c6a7d345287fc684fd41ad47

SHA256
a212ccc9720e642ac8156d174cdba3418f37b528e4fba12d7c27721f1f204806

SHA512
a4ae7b648b040f2a1bb9d2a6c77b396fecb93f40d0f3c9438f0ba3457c46bdb99898eacdaba35184f6e7936378816a711d95b446d82054d35aaeef3e1da2dad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin

Filesize
8KB

MD5
8a01d1aba1db838b5115b7ff1566154f

SHA1
e72d411cc3428e171697a61e5e940793eda6ee68

SHA256
b6649a8455208deb66519387da3324cb84490e468b781647b7f11e85b2fe2919

SHA512
56164185aeb52978ba60d6c7fc6baa47bfd61ad37a07bfee985eff92308ef51e72c20f4db60c297f89a58333c0038e6144f6afc0bfdbd2db7a2f3692a922f469

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
591f552debfb54a7ac7fe7b1083dc805

SHA1
d905fae44b2122ef197a0d31f24699da675f4867

SHA256
fd53a43a295019a505aa8a9af52f224f497b7bb97935d0742eef0bd2ade9b0c9

SHA512
ac15e7904a5a04dd7f6eecc6b5edcda9931fafedff7287b7b8a2ad6d698fd1e4958dcfdf065d45b503ac6d55c6176fb80ea33fac988402089ecab140e0d84c72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
8c0f66caa9b810a9a1a891135df87f06

SHA1
3be5be8cec2ecbb91bb2450edf34e27be5505b90

SHA256
426fb36db33ec5ca4e8204eb4c2702d589ed4fe4eb7ddd8f208f841e7472c520

SHA512
a407d655d4e36a0adb95fb2bbc041c36e43216753fe9a17dfbef280994d6a8f6b9373b951f5a79877aec53f269ac3faa9da22bf060d15e3579711d59343767ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
65ba70fc6e6295174a870cb39f6f6f62

SHA1
0ba57c83327aec12e55181d5f860484a1507d801

SHA256
6ccd4609718aa1125753eddc7eaacabb80453249db995575bf0a5c63f711f148

SHA512
e525001ac760310022f7339cf8ab1b4ce0dba49e4ffd50d62cb17be42286be24b4de115e5426946ff9152ae58c32ee756b3386a3359d3c8a2882687d696793c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\3ea18936-9d67-4fa3-b5d1-b2805eeb48c9

Filesize
982B

MD5
012a63634cf0b440c85158c6385f12af

SHA1
919a4b57fdb66c5f6ee30c8449b7cb830e2cad1c

SHA256
690a42aa63bd916e6aeef150e3c8d3f8da4c31199eb000e4b5e0fd9f6ab5feec

SHA512
55b89531c39110ddab6d4a521e195035a03b7495957c1a1abb320926eb168b8ce237a14b002cc27a9a39a8b2a396f758a5b45684cb3e7a151f227e1b722ff1e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\d34fdb0a-3435-4e39-be02-6209b51c685c

Filesize
659B

MD5
cf78266d6310a98d277e8cb2fecc54e1

SHA1
4e53314d59300489ef83a66498bc0f26c2985541

SHA256
159e952d737cbab2021f988c5d82d2767e1172ec8d3054e3af47103bc1b5962b

SHA512
d634033997bd0db88fa563e1cdfc5ddec747b8152b4978a3a3a9fbadb7268e5737a0d1c74dab8c0eaedd47d70d4be748e936fbbe6dfd951dcc05136a19c3a09b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js

Filesize
8KB

MD5
048d197290434196d65e9947c9ed5e54

SHA1
afbb3b81a8486aa78003a6a978cabb5de20931ff

SHA256
0e09e7912e265f8703346a3098d51e219711406c26f917255b704e683b998360

SHA512
04d6ba6040961d4014db34d4b2b3e236a7c8509b5c8478737d2ca5ca0bcaf160bead38387524a0521a1ad34825c4dbd78d68ca604f6c6f483740afcb71c36325

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js

Filesize
13KB

MD5
9c4703ec693a62f04140724198dc9757

SHA1
30743a7f46d9f0bce605752fd50466491a66443f

SHA256
546e0f136b2656e31462c3efc9ef7b344bad4b42cecc13a16f68519191f8e9dc

SHA512
3771a86e350b6185740ede877ba19b9a2a8f130be279fe4246d125a431947528cde0eb3f3f050a36cc48d529865abeb1dbe244c8143db794b141fb50193fd3d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs.js

Filesize
11KB

MD5
43a9be4f56ee477b366e35037d53a0c9

SHA1
7bdd5e2a33d491a230f2d01eac60db237986c76c

SHA256
ee021d1d07e76fd293b97fdf041eb7bca5869b72a1a00cac87a4e733ff297e0f

SHA512
112f06be9616d668a650ef6b214c3b95a71603712b7aa8b01ba905e9cc3a506fd4e77b71a205869d80b051c625db292d0b197ad35f4b58ee301208e8a5645c47

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads