umbral | 78f8fb8537ad3b8545788459cb6429ebbae3bfca197b6396bf197857789cc32f

Analysis

max time kernel
78s
max time network
80s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05-08-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperV1.13.exe
Size

231KB
MD5

282abb0f0ec32631b00061b682a1d930
SHA1

48497f3020dbbe6d1f74654d3df0995ccbee2f16
SHA256

78f8fb8537ad3b8545788459cb6429ebbae3bfca197b6396bf197857789cc32f
SHA512

1a90ccba732d8d4eb6db1b79c496c536f9021cc63a5202619fb7a133b06c61e5875df62c39a532230cdd1ab81c3a9d8b14d80f430925f05eb760a66d63f76ce2
SSDEEP

6144:RloZM+rIkd8g+EtXHkv/iD4upqVKInDAHZMK7bCD+Qb8e1mipi:joZtL+EP8upqVKInDAHZMK7bCDT5w

Score

10^/10

umbral defense_evasion stealer

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1267765281216794646/lx9j6q1Dzqb93V7znVQDCxb5MQYo-P_nPkX7SZyoUosbxCFbPkNDLm9ahT6TFD_sDEWT

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/memory/2404-0-0x0000022627940000-0x0000022627980000-memory.dmp	family_umbral
behavioral1/files/0x000800000001ac2d-225.dat	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Downloads MZ/PE file

Executes dropped EXE 19 IoCs

pid	Process
5036	BootstrapperV1.13.exe
3900	BootstrapperV1.13.exe
4900	BootstrapperV1.13.exe
2032	BootstrapperV1.13.exe
5072	BootstrapperV1.13.exe
2484	BootstrapperV1.13.exe
1620	BootstrapperV1.13.exe
2276	BootstrapperV1.13.exe
1220	BootstrapperV1.13.exe
5036	BootstrapperV1.13.exe
4884	BootstrapperV1.13.exe
4280	BootstrapperV1.13.exe
4860	BootstrapperV1.13.exe
2856	BootstrapperV1.13.exe
4280	BootstrapperV1.13.exe
4884	BootstrapperV1.13.exe
4276	BootstrapperV1.13.exe
2856	BootstrapperV1.13.exe
2864	BootstrapperV1.13.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\BootstrapperV1.13.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\BootstrapperV1.13.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	BootstrapperV1.13.exe
Token: SeIncreaseQuotaPrivilege	1164	wmic.exe
Token: SeSecurityPrivilege	1164	wmic.exe
Token: SeTakeOwnershipPrivilege	1164	wmic.exe
Token: SeLoadDriverPrivilege	1164	wmic.exe
Token: SeSystemProfilePrivilege	1164	wmic.exe
Token: SeSystemtimePrivilege	1164	wmic.exe
Token: SeProfSingleProcessPrivilege	1164	wmic.exe
Token: SeIncBasePriorityPrivilege	1164	wmic.exe
Token: SeCreatePagefilePrivilege	1164	wmic.exe
Token: SeBackupPrivilege	1164	wmic.exe
Token: SeRestorePrivilege	1164	wmic.exe
Token: SeShutdownPrivilege	1164	wmic.exe
Token: SeDebugPrivilege	1164	wmic.exe
Token: SeSystemEnvironmentPrivilege	1164	wmic.exe
Token: SeRemoteShutdownPrivilege	1164	wmic.exe
Token: SeUndockPrivilege	1164	wmic.exe
Token: SeManageVolumePrivilege	1164	wmic.exe
Token: 33	1164	wmic.exe
Token: 34	1164	wmic.exe
Token: 35	1164	wmic.exe
Token: 36	1164	wmic.exe
Token: SeIncreaseQuotaPrivilege	1164	wmic.exe
Token: SeSecurityPrivilege	1164	wmic.exe
Token: SeTakeOwnershipPrivilege	1164	wmic.exe
Token: SeLoadDriverPrivilege	1164	wmic.exe
Token: SeSystemProfilePrivilege	1164	wmic.exe
Token: SeSystemtimePrivilege	1164	wmic.exe
Token: SeProfSingleProcessPrivilege	1164	wmic.exe
Token: SeIncBasePriorityPrivilege	1164	wmic.exe
Token: SeCreatePagefilePrivilege	1164	wmic.exe
Token: SeBackupPrivilege	1164	wmic.exe
Token: SeRestorePrivilege	1164	wmic.exe
Token: SeShutdownPrivilege	1164	wmic.exe
Token: SeDebugPrivilege	1164	wmic.exe
Token: SeSystemEnvironmentPrivilege	1164	wmic.exe
Token: SeRemoteShutdownPrivilege	1164	wmic.exe
Token: SeUndockPrivilege	1164	wmic.exe
Token: SeManageVolumePrivilege	1164	wmic.exe
Token: 33	1164	wmic.exe
Token: 34	1164	wmic.exe
Token: 35	1164	wmic.exe
Token: 36	1164	wmic.exe
Token: SeDebugPrivilege	428	firefox.exe
Token: SeDebugPrivilege	428	firefox.exe
Token: SeDebugPrivilege	5036	BootstrapperV1.13.exe
Token: SeIncreaseQuotaPrivilege	3056	wmic.exe
Token: SeSecurityPrivilege	3056	wmic.exe
Token: SeTakeOwnershipPrivilege	3056	wmic.exe
Token: SeLoadDriverPrivilege	3056	wmic.exe
Token: SeSystemProfilePrivilege	3056	wmic.exe
Token: SeSystemtimePrivilege	3056	wmic.exe
Token: SeProfSingleProcessPrivilege	3056	wmic.exe
Token: SeIncBasePriorityPrivilege	3056	wmic.exe
Token: SeCreatePagefilePrivilege	3056	wmic.exe
Token: SeBackupPrivilege	3056	wmic.exe
Token: SeRestorePrivilege	3056	wmic.exe
Token: SeShutdownPrivilege	3056	wmic.exe
Token: SeDebugPrivilege	3056	wmic.exe
Token: SeSystemEnvironmentPrivilege	3056	wmic.exe
Token: SeRemoteShutdownPrivilege	3056	wmic.exe
Token: SeUndockPrivilege	3056	wmic.exe
Token: SeManageVolumePrivilege	3056	wmic.exe
Token: SeImpersonatePrivilege	3056	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
428	firefox.exe
428	firefox.exe
428	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
428	firefox.exe
428	firefox.exe
428	firefox.exe
428	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1164	2404	BootstrapperV1.13.exe	73
PID 2404 wrote to memory of 1164	2404	BootstrapperV1.13.exe	73
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 5104 wrote to memory of 428	5104	firefox.exe	78
PID 428 wrote to memory of 2084	428	firefox.exe	79
PID 428 wrote to memory of 2084	428	firefox.exe	79
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4120	428	firefox.exe	80
PID 428 wrote to memory of 4584	428	firefox.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.13.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.13.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.0.453001530\1652728368" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1700 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5967194-b84d-44d7-8efd-48384fb3525c} 428 "\\.\pipe\gecko-crash-server-pipe.428" 1780 2402f6d5758 gpu
    3⤵
    PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.1.1758324879\2034654424" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {109fcbcf-4593-4ae1-a699-65755bcf2281} 428 "\\.\pipe\gecko-crash-server-pipe.428" 2136 2402f231a58 socket
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.2.1275025490\1140526427" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2932 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66c99083-d00a-4a86-8f62-755c11267f04} 428 "\\.\pipe\gecko-crash-server-pipe.428" 2924 2402f65b158 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.3.955956523\1951866760" -childID 2 -isForBrowser -prefsHandle 3484 -prefMapHandle 3472 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dad8a4af-93ed-44ae-9a2e-5a0ceb08320f} 428 "\\.\pipe\gecko-crash-server-pipe.428" 3508 2401d362858 tab
    3⤵
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.4.1138471361\1047083009" -childID 3 -isForBrowser -prefsHandle 4316 -prefMapHandle 4312 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7aec789-559c-445c-a49b-a9711f2b88c1} 428 "\\.\pipe\gecko-crash-server-pipe.428" 4328 24035d51258 tab
    3⤵
    PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.5.2014861901\1521576222" -childID 4 -isForBrowser -prefsHandle 4800 -prefMapHandle 2532 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18d584e3-4ec4-47fe-ab95-097d5fe11937} 428 "\\.\pipe\gecko-crash-server-pipe.428" 5000 2403616be58 tab
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.6.1046081551\1179776684" -childID 5 -isForBrowser -prefsHandle 1636 -prefMapHandle 4780 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec1c631e-44a6-4832-a41b-1f6dc43c21bb} 428 "\\.\pipe\gecko-crash-server-pipe.428" 5020 2403616ca58 tab
    3⤵
    PID:1164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.7.613966904\2121166569" -childID 6 -isForBrowser -prefsHandle 4344 -prefMapHandle 5020 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eda48857-2dca-4f8b-9be2-44fe3d039875} 428 "\\.\pipe\gecko-crash-server-pipe.428" 5212 2403616e558 tab
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="428.8.1936740747\1182563030" -childID 7 -isForBrowser -prefsHandle 3068 -prefMapHandle 3544 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be3b9ae5-ca97-4e3d-8e5f-f740e017bdf8} 428 "\\.\pipe\gecko-crash-server-pipe.428" 3008 24036c68958 tab
    3⤵
    PID:1912
- - C:\Users\Admin\Downloads\BootstrapperV1.13.exe
    "C:\Users\Admin\Downloads\BootstrapperV1.13.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\Users\Admin\Downloads\BootstrapperV1.13.exe
    "C:\Users\Admin\Downloads\BootstrapperV1.13.exe"
    3⤵
    - Executes dropped EXE
    PID:3900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4564

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4900
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4856

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:2032
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4388

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:5072
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4900

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:2484
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2140

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:1620
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4480

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:2276
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2776

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:1220
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2776

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:5036
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:532

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4884
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4556

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4280
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:3736

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4860
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5100

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:2856
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:4124

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4280
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2592

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4884
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:1768

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:4276
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:5036

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:2856
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2420

C:\Users\Admin\Desktop\BootstrapperV1.13.exe
"C:\Users\Admin\Desktop\BootstrapperV1.13.exe"
1⤵
- Executes dropped EXE
PID:2864
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" csproduct get uuid
  2⤵
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BootstrapperV1.13.exe.log

Filesize
1KB

MD5
53ea0a2251276ba7ae39b07e6116d841

SHA1
5f591af152d71b2f04dfc3353a1c96fd4153117d

SHA256
3f7b0412c182cbdefb3eedafe30233d209d734b1087234ac15409636006b3302

SHA512
cf63abfe61389f241755eef4b8ed0f41701568b79d1263e885f8989ce3eca6bf9f8d5805b4cc7304aaaa5c7e14122b0d15bd9948e47108107bbb7219fd498306

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
c7b9e4455cf1fef4175979bbf4ae0dfb

SHA1
90b6174a9f0825b08bde5ddeae1e8b2a8a6550be

SHA256
4eb8af2073c5250302943b6d635234dd96e252c82f77ba557fbc7d27f8d5804b

SHA512
8bb5da964f894d6f247906ea327792ad251bf57a46475163dee657b0783c904121882995ec3fa8bf8468cfe38e6df172892efaf5dc180125e2046e103a223f03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\88fd74fd-64d5-4fa2-9726-ce860fc1a08e

Filesize
734B

MD5
994a9889320d90ad570cd9f7eee177f0

SHA1
a7ac998260146bdbf7151598f4c8a524196b9ad8

SHA256
f38d51a33cfab63df9e86e896949f8d53c5c6c7165627bf902b74731f3eb24e1

SHA512
d40d080484da73f18f21170c5913687251b0179542ec5aaf8255beed4259ba324815d61c75006ded4e2c863b9dc1402a41bf57f8a4a6484b9ccfa773cd3c71d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\downloads.json.tmp

Filesize
787B

MD5
b1c398bb147f8f87854361ee6e618e65

SHA1
ea8df1063bf24c77039cb4eb2b09dc01ed289cdb

SHA256
9b258df41d59847b04a09318a8cbe1cea2fd31941457f7f7c717fedf8f14b5aa

SHA512
0f7058f1a7bac9593a2dcaebaf8912e531ad75b3b13ee1e59d74a2ca479542c9b70805c1054b67fe3374d651ea19fdc54f9f0a25ea01b4a3f805372bb07e974c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
f274f4fb4106be6e4b8fffd74f2f3066

SHA1
81348446f8563926e4140e54824636ee840e7115

SHA256
c984dced38890c28891e8b595626eaa4a01f6729c4e105efd1caf0708e97ed59

SHA512
9b7c34ee41ef7f43184e835d4d3217381f62d0680cadcdeac898e06676a1d0045335217dbf10e0ef02a52bd6eb9731e019e988ddd92473bae00b6d8ad72a1b80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
320ff76cc6482aa61e274dff90ad1aa1

SHA1
ab2dc289cd0a86fdb864fca38dc2147ae59945c9

SHA256
34cfa118b506803e01f7c45580a2a2f5e5e551433437c1f5f0e01760cb3ce420

SHA512
90b96f4f2de2bef62233ed16ee3b8f7d5843df9edae33a875b370d2405b29e212d0a247ebc9b531d111978aa9223504dfcae992e315726683060374b41b833f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
83269dc5bfe1034681c9b7dd6d812b51

SHA1
a359d5fa64867cedef443ee67f6fa6efa6aad497

SHA256
24d88578f00f03535328b53bdac38327eeeb6296fb4d282c08beb1c4ba1fcbee

SHA512
278d4d3bca57d916ce4a5da0914db35bf3d47fde61858ae481a3e7e9554fb0a0b34123cd45eda8b2b2ae12fd9e939e004c53f3b80a4bf71f3051676f7806e942

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
78f27ed4ef9418f3f56339f2e3bae39c

SHA1
28b90b3843e61d3580ad3b0c979a0a7e33999c58

SHA256
49b6e982c55cf8dc28d9533c1073aaa701eb49dfa99a6564090fe44868d0202b

SHA512
a6ca7b52813a650fb9e723ebd882751bfa67475b624312b024f01800a50c9839bafecf6516a7cf9879febff48f4d0391cccef7c91cf18cdcd1433489c9917316

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7b8cb70d21cbef46e0d60edd91f8ce7d

SHA1
c560617f2d3a7c9306c2f9d7cecb345927ae3f90

SHA256
d79fb89e9809a7a931755f7e00b9f73a61b51ea1cccc2e5595e239f517963a46

SHA512
b80abbe271cb1092da7e422fb7eaa84a65f7b91e420961140efc3cbe3a8c57d530615af2cd53f3486245bb5998b89ceae921cc24981e8b8aedf95c1564f55df7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0d0013d9708d9fef539adc917f5b87f6

SHA1
5e071e6b4d8abf007c8bb78ee948caf5bb0439e1

SHA256
f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b

SHA512
851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388

Download Submit
C:\Users\Admin\Downloads\BootstrapperV1.13.exe

Filesize
231KB

MD5
282abb0f0ec32631b00061b682a1d930

SHA1
48497f3020dbbe6d1f74654d3df0995ccbee2f16

SHA256
78f8fb8537ad3b8545788459cb6429ebbae3bfca197b6396bf197857789cc32f

SHA512
1a90ccba732d8d4eb6db1b79c496c536f9021cc63a5202619fb7a133b06c61e5875df62c39a532230cdd1ab81c3a9d8b14d80f430925f05eb760a66d63f76ce2

Download Submit
C:\Users\Admin\Downloads\BootstrapperV1.1w9JZj5k.13.exe.part

Filesize
15KB

MD5
e1c920ae0a7123f99fcdd9709b4a5e55

SHA1
37a668e6d6ac98a29e2a9c7549a828395ca2ac85

SHA256
87b124679f4c738d9d9ce2b58c00f47df6ecb293d8775a276abc9536af6e786a

SHA512
a7c0d90d8bea48cc53b635451597c9d20d2c97b842c8fef3fd8115f6a82edb453c1f38297364ae34a1aa6a94bcee66da04b31b1754cdd267762cb62976bf2438

Download Submit
memory/2404-2-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/2404-0-0x0000022627940000-0x0000022627980000-memory.dmp

Filesize
256KB

Download
memory/2404-4-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/2404-1-0x00007FF99A1F3000-0x00007FF99A1F4000-memory.dmp

Filesize
4KB

Download
memory/5036-229-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/5036-230-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download