e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
Size

1.2MB
MD5

f4fa19f492290864259da9c9c458381c
SHA1

32f8b0b09a119e37ed8528a96e123a74c4d5e028
SHA256

e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911
SHA512

0d56b36d9641cde1ce89c1cc4d3fb82ff1b97a2351d1c43417f0b66448817480ef781186249f3324bf6ec81f6f2ccf8e4222fd09605f59c9e69dc97c3fb23327
SSDEEP

24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8aLR2Sbly7TWEPje:JTvC/MTQYxsWR7aLR2dW

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	firefox.exe
Token: SeDebugPrivilege	1272	firefox.exe
Token: SeDebugPrivilege	1272	firefox.exe
Token: SeDebugPrivilege	1272	firefox.exe
Token: SeDebugPrivilege	1272	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1272	firefox.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2060	1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe	89
PID 1336 wrote to memory of 2060	1336	e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe	89
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 2060 wrote to memory of 1272	2060	firefox.exe	92
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 2996	1272	firefox.exe	94
PID 1272 wrote to memory of 436	1272	firefox.exe	95
PID 1272 wrote to memory of 436	1272	firefox.exe	95
PID 1272 wrote to memory of 436	1272	firefox.exe	95
PID 1272 wrote to memory of 436	1272	firefox.exe	95
PID 1272 wrote to memory of 436	1272	firefox.exe	95
PID 1272 wrote to memory of 436	1272	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe
"C:\Users\Admin\AppData\Local\Temp\e1b059d1c0f696f31f95be0085eb22449bc5217844762a6ff6aeb0e50ee5a911.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7afeace-3fb9-40e7-83ac-55e654de90ef} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" gpu
      4⤵
      PID:2996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fc35388-e304-4296-b24d-a4c02c88589e} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" socket
      4⤵
      PID:436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2552 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3088 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72f0639d-e4e6-4c64-9f89-350d4709df2c} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" tab
      4⤵
      PID:2920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -childID 2 -isForBrowser -prefsHandle 3980 -prefMapHandle 3992 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84186e8e-2166-4393-825c-e711344b4a62} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" tab
      4⤵
      PID:3808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4784 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7aae6d7-3e17-4b3e-94c5-80964186a64a} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" utility
      4⤵
      Checks processor information in registry
      PID:5268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5348 -prefMapHandle 5320 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43caddcd-efa9-44dc-bb02-1d3b92f6d2a5} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" tab
      4⤵
      PID:6064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5500 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b693de0-7e10-407e-9e58-d778dc246aad} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" tab
      4⤵
      PID:6084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5752 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4460617c-8483-4fd1-8150-ccc102f88260} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" tab
      4⤵
      PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
6b8a0f1d3a78cf7b52156880e2d0bc0a

SHA1
0fc602fd3548c7e26fe67c125c008b16cc2a93a0

SHA256
a1bc41dc757847f88ca5fc7fe7d2cd4ed2cbebb19f5421202d8d173cd114a0be

SHA512
480f950e657238a26003b2fc79e372f8703ecf53025a3c5f0462113ce3714b4ee349ec84c2d11e7f01f5bddf88b24dd096203829122574068b15818edb8b45df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Filesize
13KB

MD5
3ba7367a8682ff3b5181af73b1457474

SHA1
04a42955a0c1fee0b96de9700989b61b0d624f59

SHA256
085d75dddc923ada4a75c654396af4537765a0bec6851f53e92dc75621a60d81

SHA512
4fb37913e35ba23b4f1d9fcd0114960f110cb81f5a7bd0e4f296a1e7aeb4d655a23a612edb74fde9dca337f86006099bf0a1767f99ccde7b588f2333fbb11dbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\AlternateServices.bin

Filesize
8KB

MD5
beb9e09fa7303d6ed2e3f7433b3bcbc4

SHA1
d6cf9d4a145c6e5f1faed1eb91267056b8ddca04

SHA256
5ad3e2930b1e5c1a6884b260b4545df85aebc401f902b8b4f8a8117f388853e4

SHA512
33470098db89d048d51d21368b1a3b6128113718ff691edf8107a9da6e98fb9d6499ad278780be2e9877b607ce15ecf0938d44cda06e9cbcc1afae5f1b30e9a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
aa0b864aa48b2baa5a8f90e75d6f1ac8

SHA1
a6ce56038b275453a9b23c33e5678899f8397d49

SHA256
50e3e718aa275e6096ff8184c4bb3cf9b0b5de4938bca399d8338789e4764b83

SHA512
e3ac5a4c040b2526b26767c9b6ad4801c80faf08dd445ec73f01db5b8ab3ce7099fb468d3c60425bc71c1ef843b908456c5bb5601f134e241867906265f49f41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
8f72e179d2b9c8b24496834001ea0552

SHA1
2607d758dcbc2c48b27eda33f3d649c58f14ec42

SHA256
acd9c96d78c1146d9bfa7bf008be4b1cd64adae1358090a6d72df34af7575ec3

SHA512
e6f2e81c5af97114f691dfb4310efa41d8c610ac03945f574e36c3039513a84140ac6ef4d5062433a0996513287197f164a3c616abeea70863cfc2d5860d491b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\8fd90409-23ae-4c8d-b7a3-ae35b3caedce

Filesize
982B

MD5
1216fb808e235d0e34f157ede674aa5f

SHA1
3b46c031ab74be7889beb0b2df86892538cceb86

SHA256
24e463164825f458ee39e45d41e61f363a824d8747c5036bd398205d17f49b9d

SHA512
4e099a9b13403dbddda6a5d36ee95a0dcf50b81a645cd015432b7af167dd87e5527bea27204635ddce2ba3a4048b438c59315f19376d4616fef0cab52d4c93c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\c20c453f-f8ad-4fcf-a9b4-004a31e8fe31

Filesize
27KB

MD5
213c7624d38bda9c6636cdd790112b50

SHA1
93d4bca33931882e7cfe2cb7e2d16146f10e267b

SHA256
0feb76b515a70027345dfec3519cbc9330f03cf58cfcd5a608241eccc5345ecf

SHA512
4bcc7475d13cc46af09ed53aaa6d8d21a517ea6c39465fe37036da4e218c1384a4c00ac3c733fbabdfba021d6b18685e40a7bb449d53d7cae055e45fafe8bd01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\f8dc78e4-7a87-44ff-8b8c-ae5e415383c2

Filesize
671B

MD5
16f675474633842e67b7f7280b408d01

SHA1
1264ee3532bc6016afad82c65ea51b58393489b0

SHA256
cdb2482954c65dcb65a07b58f81ccf889f46b4d90459e91e0ec19dcaaf8715ab

SHA512
b28ae58516e3bdb5f5393c2c6f75a8849b0a6006cc168b8ed16dd1122086eeb4014b962ae4133020d29c8870228d3e0590ddcd2e5ed3617bf21831ba22741549

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js

Filesize
11KB

MD5
efe26828ffa38d3b92daa22fa1e456d3

SHA1
4a4cadf66abace728e4484d38816bea0f9ba7999

SHA256
699e3f0f0802852e607eb21a07f07bd2dd4141f64feb04880f98043fb655eb0c

SHA512
288e13233a4c1df46521aacd25962c6e9f1ae8875b976bd0a9ee91934b201d0e94ae449d18aa9276909733afacd1b5cba7ebc257e3aee65aafbc5c3507cd4a4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js

Filesize
12KB

MD5
c7da9d5ec79c19229166d1b433baa637

SHA1
3e57611c1f3f9eb7f436e252a49e2efbce3a561f

SHA256
8591e8818714a93aa1979e7ad005a05111ec29f5c404f8f3506fafe5e98da20a

SHA512
71459870c39ec0d38083098ebbe3c4ad6f0acc47e6c3a74221464e1a26c883c8066d00c856804a039296d704b9b7adfb5226869068bccd5532f4d742cec15506

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs-1.js

Filesize
15KB

MD5
39b9ab3a2b9d89057828a36aecbb2eaf

SHA1
b1b30eefec3eb1816fa8b61f8b1fe4f9385db31a

SHA256
1175e1f69172f2aea824e43b11ad22c60298820e0f25791db589535d9ca2bea9

SHA512
884860a88a27993b28c4bd1a6f13213c8a3f67e5146b92a531b522f1c42a06898f4dcb3dd8ff01ab86c898efe92e99672716f2bce9ae310585b8760a75bb16de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js

Filesize
8KB

MD5
557a0d5a61a41629b2c900065405431c

SHA1
20d9d10e11dd53c4bad2e40a79fe9247a8f165ad

SHA256
970a9ed98d2c49cf6002ef627019f0eeb040383dde3245eb943bdeeecf45dd91

SHA512
9dc791ac27dacd68d0302e42fa9a0a64b9450ace9e455bff2fe556c0737172207a3f480fd1c82b64eac9e0dc6bea28c2aea4ba0dc1ec5d6f1f88ca7a0f94acbb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads