d461839fe85a8194cd4d39cbd184c451e371facfee373e2d69859ab706c05947

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad1dde8691f26ca55a64c3a8d1adaa7f.exe
Size 3.1MB
Sample240801-g67c8a1blh
SHA256 d461839fe85a8194cd4d39cbd184c451e371facfee373e2d69859ab706c05947
MD5 ad1dde8691f26ca55a64c3a8d1adaa7f
SHA1 3840264a5058b616395a0ba81ffab83b37f11b8c
SHA512 213ce5576d2d6cdd134ca0a56bf501e73074235039284a5f5229903c6864e4bf43740efeb0b3865d4e5d892b486385d672c51e159b0c35120e5bc88fc71c296f
SSDEEP 98304:O38dlhNBcSw4et7YG71yZRK2LyAM3XFXU8iSY2XSEJ7D9vNnk:0wlmr4aYG7ARjLaVXdzXSS/V
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2416-164-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-165-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-178-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-219-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-267-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-268-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-274-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-281-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-282-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-283-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-284-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-285-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-286-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-292-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe
behavioral1/memory/2416-294-0x0000000000D70000-0x000000000185F000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	firefox.exe
Token: SeDebugPrivilege	2772	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2772	firefox.exe
2772	firefox.exe
2772	firefox.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2776	2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe	30
PID 2416 wrote to memory of 2776	2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe	30
PID 2416 wrote to memory of 2776	2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe	30
PID 2416 wrote to memory of 2776	2416	ad1dde8691f26ca55a64c3a8d1adaa7f.exe	30
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2776 wrote to memory of 2772	2776	firefox.exe	31
PID 2772 wrote to memory of 2536	2772	firefox.exe	32
PID 2772 wrote to memory of 2536	2772	firefox.exe	32
PID 2772 wrote to memory of 2536	2772	firefox.exe	32
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 3012	2772	firefox.exe	33
PID 2772 wrote to memory of 2876	2772	firefox.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ad1dde8691f26ca55a64c3a8d1adaa7f.exe
"C:\Users\Admin\AppData\Local\Temp\ad1dde8691f26ca55a64c3a8d1adaa7f.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.0.937079712\450216582" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ece5895-5377-4235-b86c-3cbbe0b004e7} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 1344 113d5558 gpu
      4⤵
      PID:2536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.1.1256249912\807556204" -parentBuildID 20221007134813 -prefsHandle 1528 -prefMapHandle 1520 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11315c84-4547-45a5-a00f-aa399d0039d8} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 1556 f3eb258 socket
      4⤵
      PID:3012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.2.5254695\1966536772" -childID 1 -isForBrowser -prefsHandle 2068 -prefMapHandle 2064 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 784 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91512fa7-e9b9-46ca-81de-8088406ebe80} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 2080 1135ff58 tab
      4⤵
      PID:2876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.3.16325112\1152601689" -childID 2 -isForBrowser -prefsHandle 2748 -prefMapHandle 2744 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 784 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8df6be75-5d7a-42fd-9d95-278e15bf9da3} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 2760 d61b58 tab
      4⤵
      PID:1088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.4.730369000\921541730" -childID 3 -isForBrowser -prefsHandle 3740 -prefMapHandle 3724 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 784 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13b7345e-1671-4d6f-af01-f85294dd2b9c} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 3752 1f1c6d58 tab
      4⤵
      PID:2296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.5.661288825\1860894472" -childID 4 -isForBrowser -prefsHandle 3848 -prefMapHandle 3852 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 784 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c280d635-a7d3-4831-90e1-4f3e399ee1a2} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 3840 1f1c6158 tab
      4⤵
      PID:2248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.6.1398177326\37774134" -childID 5 -isForBrowser -prefsHandle 4012 -prefMapHandle 4016 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 784 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd756be3-5ebe-44b0-a426-dc0bc0bfd03c} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 4004 1f1c6a58 tab
      4⤵
      PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\activity-stream.discovery_stream.json.tmp
Size 27KB
SHA256 6fd98f20918d51dae72c8faca5112b7f85b9eb630b8904dcf3d7c198f5affb06
MD5 db56464168519be9a38ef93c039f3006
SHA1 9421b3a7bdce9f33a0b3bddf8f213a97f1c488d1
SHA512 0a15b7e79a5ef6721d69a4a6b63fb91fa62479f3ae5b77743c7bab6d2d9c1059a8ad86051d0c4824df638914f4c027ed627ab2ed16e0afe0e23e1854b4621e97
SSDEEP 384:z/7r7FYebRKbF4lC1ABOsfVTt6tMBdxY5V1HwkkMIWbqKfyaum1je0KJc:z/P7/bRKilQgVTPULQ8IWmKfydSMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 335a624da6e75dc310a034128010801e3612a16ba058ad1efeb1aa2d2ec4d2ef
MD5 c16faab2c182a0dfd2196126b62340b9
SHA1 bd9de91a3d1d588c1e830fcbc8401c50342fd9e7
SHA512 4e49d862457c4a69376ed9ddf9c84f201330e7163400a2b4dfcc810095ce57d93d4efe83f0b6f17e83c6f4cb9ebce92dbf5c00b831f961f095c7030cbfcc0bbe
MD5 SHA1 SHA512

Submit Download

299fe8eb-06e2-4ff9-bda8-cd4a3bbb3621

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\299fe8eb-06e2-4ff9-bda8-cd4a3bbb3621
Size 745B
SHA256 a9f2399411fb15f15dc7aa65609fe0e45c4a6a21473a07e53ed5849c1d28ebde
MD5 4c8bb89e7ab1150133498019f10da818
SHA1 6cfb61753e8e23c758456526d47fbbbc1ddfd627
SHA512 f96d3db22ed01703c201e4be8037df452c7dc2ac6acb99bf996a3cb5998a27d5d8a6695ac9d2b13072740ce3c89b694b23b12e6f44aaff323700ab94c56ae6d0
MD5 SHA1 SHA512

Submit Download

44934d82-557b-4cbb-99b6-3e93f01813ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\44934d82-557b-4cbb-99b6-3e93f01813ec
Size 11KB
SHA256 ff27b88bf3b0668e9eb0601511c86f71f702112676cc0c1c0136bd6bb7498acc
MD5 972b6524b75047ce564b42c3d381f3fd
SHA1 23e0d211cbcc84c0689277d2a5f3b1a0d1e544aa
SHA512 d99641f04cb08294554a896b9b59775841d6fb9575199a060176f240f4ca491bfcf2b9a6afb9cf68c5a16b60646ed7a8208da7134bac28401c882bc6aec08bc0
SSDEEP 192:M8+Xuwawx0cySHxSSjO74LWeWf6ShK8zpZMbWZPhzbDyCkOLvThy1ADIEcEhbUkg:MT+A+cx2y
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 7KB
SHA256 d8c4eef2e014e5e81cfc800903ca249f90b151f5bb229efe3715299ceaf82ba8
MD5 fa7de880dbed8385df8f67ef742ce8ad
SHA1 5628a0bb52bfcccc33f00d89edf447df4ed3c9fa
SHA512 352f2d9e04065adfb09f7c11fabff8abbf1f3f62bdb53768f1a8b4cb3e3608d1559caaf32599164aac5ce69cd08eea6589b9033594adadae4bdc2182bea21857
SSDEEP 96:xHD5nUTeqGqPrdboPeOTzS+PXAnpjaeHq26OuXMBw8H7Rz:J5nIRjdboPewPXJQAOHBw8H71
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 7KB
SHA256 c6f2dcff3ab88d6afe9160c638f3d81ac7d72cd2f304d13bd42193d86558db94
MD5 38a54480832487a7f737fb6979cea8b1
SHA1 41febcb27e2a9da874ba25917b73d9626b483701
SHA512 553add45fc30c2824d2078ec4a2f211df23514da1c62e091cbf0f4cf6ed370cfa531ffee38fd49d361b07414d3d6274715178bb4ef9436326ebf427f8534305d
SSDEEP 96:xHDynUTeqGqPrdboPeOTzS+PXAnpjaeHq26OuXBRBw8H7RZ:JynIRjdboPewPXJQAOGRBw8H7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 6KB
SHA256 f2ca1942548a4c50abc8be7e0a9e4f4cd27faa4929cc64b14f2f50c86d5ee34b
MD5 b69b2c89532453cd164dced15dc8c124
SHA1 968079c07f158ac884a2c910ee13139d49f2a45f
SHA512 30818d7bc7d28d097305dd91f919d58c9a2ae7a9e3a5e0033cf188ae363fa48decff97833694555841ce1517e41722c82cb722cb032edbc50dd0a2d992266c91
SSDEEP 96:xHI5nUTeqGqPrdboPeOTzS+PXAnpjaeHq26OuXuBw8H7Rz:O5nIRjdboPewPXJQAOdBw8H71
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js
Size 6KB
SHA256 ed672ce1b9aa097a98dd846c45a6a9d5afd0191cdbb05b41e9dfecbc759a5032
MD5 0833b4c93bf15343e6632c2178c7922b
SHA1 931bbbda88554c40d3e61c3ce9b0feada1450f07
SHA512 066c2394adfe1f2dd2516b9c6f9f86327a68c68e50376980e66b169877e180941ec1417ed61e4574dafebed67671cd8724ec56996a1a0f33d24f5dd07885baee
SSDEEP 96:xHI5nUTeqGqP5db/9eOTzS+PXAnpj0Hq26OuZBw8H7Rz:O5nIRhdb/9ewPX3AOSBw8H71
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 87a5ba31c01e29239c18b94b51725b02d5fab11c49563bc9ca0049450fd9b39d
MD5 c3fb313a45341726284f4610f659e975
SHA1 2019a59d537173990cd3286df98c615d5295cfa7
SHA512 1c2b23ac3d8b4793e3dc6e57df5326ae15c496da04fd1a361dfb4bcfdd33c05b7edde37f561756703eaaa0424685e878ae5aa7681021f771d540e64db49bfe5a
SSDEEP 96:6zje0fInxA6lEGJF7GtFM7k0zf8W8Qge3ZwS20X8rBR:WdcW6CiFAFM7kcuemgXqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2416-219-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-268-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-178-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-166-0x00000000FFBD0000-0x00000000FFFA1000-memory.dmp

Download

memory/2416-165-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-164-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-1-0x00000000FFBD0000-0x00000000FFFA1000-memory.dmp

Download

memory/2416-2-0x0000000077150000-0x0000000077151000-memory.dmp

Download

memory/2416-267-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-0-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-274-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-281-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-282-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-283-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-284-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-285-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-286-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-292-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

memory/2416-294-0x0000000000D70000-0x000000000185F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads