d461839fe85a8194cd4d39cbd184c451e371facfee373e2d69859ab706c05947

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad1dde8691f26ca55a64c3a8d1adaa7f.exe
Size 3.1MB
Sample240801-g67c8a1blh
SHA256 d461839fe85a8194cd4d39cbd184c451e371facfee373e2d69859ab706c05947
MD5 ad1dde8691f26ca55a64c3a8d1adaa7f
SHA1 3840264a5058b616395a0ba81ffab83b37f11b8c
SHA512 213ce5576d2d6cdd134ca0a56bf501e73074235039284a5f5229903c6864e4bf43740efeb0b3865d4e5d892b486385d672c51e159b0c35120e5bc88fc71c296f
SSDEEP 98304:O38dlhNBcSw4et7YG71yZRK2LyAM3XFXU8iSY2XSEJ7D9vNnk:0wlmr4aYG7ARjLaVXdzXSS/V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5168-355-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-364-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-366-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-494-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-1503-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2479-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2480-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2487-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2488-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2489-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2490-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2491-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2492-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2498-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe
behavioral2/memory/5168-2499-0x00000000004B0000-0x0000000000F9F000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe
Token: SeDebugPrivilege	5112	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5112	firefox.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe
5112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 1224	5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe	86
PID 5168 wrote to memory of 1224	5168	ad1dde8691f26ca55a64c3a8d1adaa7f.exe	86
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 1224 wrote to memory of 5112	1224	firefox.exe	88
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 5788	5112	firefox.exe	89
PID 5112 wrote to memory of 4828	5112	firefox.exe	90
PID 5112 wrote to memory of 4828	5112	firefox.exe	90
PID 5112 wrote to memory of 4828	5112	firefox.exe	90
PID 5112 wrote to memory of 4828	5112	firefox.exe	90
PID 5112 wrote to memory of 4828	5112	firefox.exe	90
PID 5112 wrote to memory of 4828	5112	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ad1dde8691f26ca55a64c3a8d1adaa7f.exe
"C:\Users\Admin\AppData\Local\Temp\ad1dde8691f26ca55a64c3a8d1adaa7f.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d017eba5-6138-4bde-a549-c45b01f94e76} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" gpu
      4⤵
      PID:5788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0996daa2-24fd-4a7a-a426-1de6ac7cff6d} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" socket
      4⤵
      PID:4828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2824 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 1328 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a90d226-1dad-4379-bcac-45a88348fb5b} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:1556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 2 -isForBrowser -prefsHandle 3696 -prefMapHandle 3692 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c35502-1ca0-45cf-b03d-dfd3aca6314b} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:1228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4644 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4692 -prefMapHandle 4688 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20c4d956-f7e6-49b7-9439-76f5d5e4f245} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" utility
      4⤵
      Checks processor information in registry
      PID:4712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 3 -isForBrowser -prefsHandle 5252 -prefMapHandle 5192 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f288e15-a6c9-45dc-911c-9ea737a350eb} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:5676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5416 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e51f9ea-5ab9-4c55-9a95-c2d31eb337ac} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:5652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5640 -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e77aad4-8d51-467a-adaa-f209d9beeaea} 5112 "\\.\pipe\gecko-crash-server-pipe.5112" tab
      4⤵
      PID:5444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\23yzs2h6.default-release\activity-stream.discovery_stream.json.tmp
Size 19KB
SHA256 6a1e9ede77b17014c84c0aaf9416a2923fe0f5cb1e955f086e90d955d4488e30
MD5 0760ebe238dd2f6ef18fefad11ba5a00
SHA1 cc50cceed82cc4879a47a608393152e4f1772f01
SHA512 8fe933d8a97319bde558e3fedf29f46ff9988140157d9e385264901781da20ef47a733b504bd9496718bd74627782e4b3a609641f661d280d118265b95a444a3
SSDEEP 384:kDnZ9hw2ktk0Os987c25EMkddl7QSm+7vRC8zceyaE:MnZ9hw2ak00CdPAMC8Pyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\23yzs2h6.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 7fcb400e4b113f817f192cf87e455f681cac2de693dee739304f29aedc7aadad
MD5 4569a47b871ad2c1c9cd4de7e58f83e0
SHA1 32402695675914517ae99eca71a74c1eb9902d0d
SHA512 3e86c3f8d465cbe8ce443af1dd89681166eeba98b3d68f160a11f2daed6d43059342587aa80bafe1600987dbdba5132f825d2792e868c562b90263468ad20995
SSDEEP 384:H485u9fiGLm4pU4ft2WlOX8lPLZZB7t0lpDIIjPa:nUBi8mCU4ft2WAX8tzB7eD8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\AlternateServices.bin
Size 12KB
SHA256 9a81a38336741e97cfe7af7efac3316812a6e8e7d005bfa620f75ceaf2b71a56
MD5 9e5b599d1ed040fce3575484738ace52
SHA1 30cabd8c5dd53d99e7c585fcf96f95e89fa84699
SHA512 24c66b262da5ec30db24043d6d5268064346517989826df259710697332bcdcdd3fde742d999f8786cd32c51db896db675d5ba549aa97a1d2fc57d096e7982e8
SSDEEP 96:e5oTebOJab6pebvpf+abqbObzgbgzRbubib:e5Mu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 16a639c05ca763e29fadf775648a9f042624265a7c657eefe7e1742fa1aabcfd
MD5 a18b57958c5f8eebafceafb59bc85020
SHA1 2bf1bfc4749ffdd7ebf5c0d68fec637cfefab049
SHA512 6ba47db7a43ec01756c82b1812ed024d1a79f392835560b1a70961723e5eea82a89ba279df90680c2c651591039664f3471715bf77a95cb80787ae6882a8ce40
SSDEEP 96:BP5pPQGu0mFl66JozGzgClKtmSSPSMF9ZbkW6ShmXvPP/PrWI:B+/66JozGzgCl6mSSPrvZboShmnPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 706358738fa8d82af1d66800988dc4bf5fde9814116fee79bb137ee03c87fcdf
MD5 6f3cf5b2072e674320b9aeb5a2566bf3
SHA1 27d2804f09d2285d415a9297d49df2ec15168482
SHA512 6e3e6b14e69b786cf2b9876422575a411610b85152cd340ed20415fc9139fc5857cd572f7af7a5c81c84175646567650d02c0fbf7fa2b83be268e39c2d46a6db
SSDEEP 384:rboplDVPQjdpzrJDDV7ACb5bYe+/66JozGzgC1bM:vaulRDV7ACb5bYGEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

177bb371-cbb3-4132-9d79-0b3f13e3b841

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\pending_pings\177bb371-cbb3-4132-9d79-0b3f13e3b841
Size 671B
SHA256 c53eb36d6f80beb31106aa43dd71729afa8ac182acd95c6cdb0bdcac77332727
MD5 5f299d9faf2a2d8163feb9bd5573117a
SHA1 179f8a0e5d5395ef8aadb81c1688b6481a46b04e
SHA512 10bc736e01e40bccd9525da2bdd22111eaf457e1f1acd6ea2da956a3db3b8e9a256b2e1ea8a50f30a20a8b176a5111227060f302de7e025ee0f8f1b5846b9e9a
MD5 SHA1 SHA512

Submit Download

c914b9d0-52fe-4680-a966-ca233dd5e775

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\pending_pings\c914b9d0-52fe-4680-a966-ca233dd5e775
Size 27KB
SHA256 5f876074e0105af8c179c050bba88a6cb42a8e497b93585b3eed938527125a3c
MD5 519b967b1f6412500e6a5f5670edfe56
SHA1 dd848c62c9291de5c1149c58b85d35474241e030
SHA512 75f35db3558ccc4da3af3d8f01ba7ae34a4197707aed9075e5ecf4fe087056969303a0d4102afaf3ff7fbfd850f915047d5d07d8d216e05608041286ee245e99
SSDEEP 192:szLjIRjbfzvEXPSHbJEEmmRizMJc1CKosgQWNdrOZEsYJRYfqG3xJk24jUlqMksL:g03zSSHblmmRiL9vjY4Fx0lL4bfn1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f14a3ae5-cd73-4f00-927b-3a16194ef63d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\datareporting\glean\pending_pings\f14a3ae5-cd73-4f00-927b-3a16194ef63d
Size 982B
SHA256 321f6de2735f8258df3a1c595213bd5956df4266309a3111e1b0b771f91b1bca
MD5 2b620b3f430bfe120cd54075971d6839
SHA1 df59f5c8b74964b9e626cea256df639a5a7db824
SHA512 1d8fe93710d7628005ce69a63263bce840e93cf5ed3fea41a6b8f52c020d4a93223ca5dcbf288f6c105069d6a9fa35c5d8d1254e8e070479e66a98b15ef8cdc2
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs-1.js
Size 15KB
SHA256 dcb97710928a1e8daf6156d92e2bc5d95f01e64a8c96704e8243b019eb88ca80
MD5 ef92a131d05b075b61f7c57b05ab955d
SHA1 a59010be51db0e4389331acde8cb64aafe8a87fa
SHA512 8c4010f859fcf23702b39f3f42c6f786b6fc5ce40ae47830db10d37e1260b970650198ed6b12e09f5e50a6f5a16aaaee4522691f7966c64e3a09f5867b5f8c2d
SSDEEP 192:rOn5RZf2jVrA77cdXLIy+MJ4lTaXS+5a3EEiBw8HQ+/XDAH:CaA7gtc0eEXwN8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs.js
Size 10KB
SHA256 eab6ce165c29c71f85c1e7123ae76b5836ae3b1375fbc9811a6da6e36fe7cbc0
MD5 088a937b20d2b3108a55c2689456ecae
SHA1 9fa4282d6ff66840abca3499e63e0c16f0cab512
SHA512 a9de56b8a10ea9fbdb58cad958315c41eeffc0a1234675d70cddc8f62a8483c0de4144422f4b6024fd3a47e61fb7809bf40f397b42b928ef61beb69161cdd78a
SSDEEP 192:k5n5RZfEgB7tqczFIP+2zcdk78Cz14y1ZvQ0kkaXn5a3EfBw8Vn:YYczeMXCzKy1ZvweEZwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs.js
Size 12KB
SHA256 1e890834d64ea822b4257598eb16693db79197b0a75f48fdf0242afe6d253cf8
MD5 70ac74086981cb39fb2b6bc2ea16610e
SHA1 b351ff2a47f74368c0c5752625043acfec6c7f64
SHA512 f12685b6db8501e5162dbcc6ba1077642daf7c54c87a24081f8e9839a18c2ef8f5b550a031910e5e16c17aae1c9e0d2ea652eebe65885df01c7cf7d7a4e9d067
SSDEEP 192:r5n5RZfEjVrA77cdXLIy+MJ4lTaXW5a3EQBw8H0z:vEA7gtc7eEGwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\23yzs2h6.default-release\prefs.js
Size 10KB
SHA256 28e321c53adc171003ab1cdae2b1565b42652ea2ad373dd096ed900c55deff23
MD5 01991ae22717bc5d2f11f6ef3a3a0ff4
SHA1 d4a39ab713eac82b3e5ba3afe09042d1c668b642
SHA512 9c3837b2da0cbe4141b1bfde05cae2ce116334c9634358d2e46d3e814af5ea52b828cc745b8bf38b9bc45baa1f23eea0ae1c180098267742f24077c496b369f8
SSDEEP 192:k5n5RZfEjVrA77cdXLIy+MJ4lTaXW5a3EfBw8Hn:YEA7gtc7eEZwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5168-1503-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2479-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-365-0x00000000FEC20000-0x00000000FEFF1000-memory.dmp

Download

memory/5168-494-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-355-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-0-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2-0x0000000077002000-0x0000000077003000-memory.dmp

Download

memory/5168-1-0x00000000FEC20000-0x00000000FEFF1000-memory.dmp

Download

memory/5168-366-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-364-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2480-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2487-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2488-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2489-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2490-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2491-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2492-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2498-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2499-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

memory/5168-2500-0x00000000004B0000-0x0000000000F9F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads