Overview
overview
10Static
static
101/0178b79b...bd.exe
windows7-x64
101/0280cde4...60.exe
windows7-x64
101/08b76206...65.exe
windows7-x64
101/0e4fc438...91.exe
windows7-x64
31/0fb86a8b...05.exe
windows7-x64
101/25898c73...8f.exe
windows7-x64
101/2c2e9491...3c.exe
windows7-x64
31/2ef0f582...2e.exe
windows7-x64
31/39884fc0...82.exe
windows7-x64
101/3a72ecec...8a.exe
windows7-x64
101/3bfcb4f7...71.exe
windows7-x64
101/4103411f...f5.exe
windows7-x64
101/4e0fdb84...95.exe
windows7-x64
91/5297372f...33.exe
windows7-x64
51/68292f38...e4.exe
windows7-x64
31/6da4696b...e5.exe
windows7-x64
71/7021c9cb...78.exe
windows7-x64
101/752f5cc5...60.exe
windows7-x64
101/7c7cded8...0c.exe
windows7-x64
101/97d29ffc...84.exe
windows7-x64
101/a306cc84...03.exe
windows7-x64
31/ae1a168f...74.exe
windows7-x64
71/b13f2364...d6.exe
windows7-x64
81/b2a1d168...9d.bat
windows7-x64
81/bb29aeb6...bd.exe
windows7-x64
81/c8e5a24a...f5.bat
windows7-x64
81/c9736cdc...97.exe
windows7-x64
81/d58780d1...a0.exe
windows7-x64
101/de19e016...d0.exe
windows7-x64
31/e886016e...51.exe
windows7-x64
31/f0f496ec...f4.bat
windows7-x64
81/f28599b0...23.exe
windows7-x64
10Resubmissions
11-12-2024 15:32
241211-sy44nssrdm 1009-08-2024 21:57
240809-1t1vfs1cpm 1006-08-2024 13:01
240806-p9f97szdlm 1006-08-2024 12:52
240806-p3672stdkg 1006-08-2024 12:29
240806-ppa8fsygqr 1006-08-2024 12:26
240806-pmc92ashlh 10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 12:26
Behavioral task
behavioral1
Sample
1/0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
1/0280cde4a65664a05361129dc1cfa10bc17b3fa9567103ce6eb9d07b06f8f160.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral3
Sample
1/08b7620610fc30c54e5cc095a54ae6d2949f68b0f224c285283e1612c254ef65.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
1/0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral5
Sample
1/0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
1/25898c73a877d87ba289bb4ab9585eb36eba9d27d47af678a86befdbf9aa938f.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral7
Sample
1/2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
1/2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral9
Sample
1/39884fc02ed9a51ffcc9b298916be79307f15f1518b6ae2021dd07af0aeecb82.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
1/3a72ecec34a29f53a1d73677a0e6f4c2e19087a32f1808f8f4ff643f62128d8a.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral11
Sample
1/3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral13
Sample
1/4e0fdb84649ad15a0722789512aaef15c7bfbc4cab82b2a7b0ea52ac9594bb95.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
1/5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral15
Sample
1/68292f388207f8ec69774dbad429e67420881ce46ecfad55f23182ec3a8893e4.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
1/6da4696b804777582ae586a4e9f42f6c18ccf540222d70dcf3374ee291e674e5.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral17
Sample
1/7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
1/752f5cc5a7b0f986286d09e8288c0958bc1b798477ca0d09dc2658c7ab109060.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral19
Sample
1/7c7cded8d1c0784881859ed03340d81c24ea9bf5d9972963cedf0e40b9856a0c.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
1/97d29ffc3556069c807b5c0ae2e2b109ae329feafc912d64f8b7f437bea47d84.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral21
Sample
1/a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
1/ae1a168ff481173d18034d14a767c0801458e95cc3016dc8d82212d0c083a474.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral23
Sample
1/b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
1/b2a1d168dc4234e687d0969b6a1901ac7e69c0d4bb72a1a4c76ba67fa6a14f9d.bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral25
Sample
1/bb29aeb6ceecc37829b40e36f91a4620d7e0aae16b1ceea70bb70135e11172bd.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
1/c8e5a24a6d2fa68d7976457a19576b381e6211202500af5280b0f3b256446bf5.bat
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral27
Sample
1/c9736cdc4ade9fddb9b293e0366f182f972154d98169b58e532b7905c310bf97.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
1/d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral29
Sample
1/de19e0163af15585c305f845b90262aee3c2bdf037f9fc733d3f1b379d00edd0.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
1/e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral31
Sample
1/f0f496eccc61594c53ded581b6683a77072f607ab018ec0a770a0aa7c7f45ff4.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
1/f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe
Resource
win7-20240729-en
windows7-x64
General
-
Target
1/a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe
-
Size
1.2MB
-
MD5
81d3df03a7bfb9112626bdcedae6df90
-
SHA1
ba206887aa11de8e1b405e5a18bd04568e2b5693
-
SHA256
a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03
-
SHA512
7580b5dd5452afba147417685bf9d42816c7f32af9496e4f8dec519c0abbb9578206a5e432c1b884abaa0b9870c198b8d0c7d109b43590d95ea855bff6a59a13
-
SSDEEP
24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aLS2Sbly7TWEPje:ETvC/MTQYxsWR7aLS2dW
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2580 firefox.exe Token: SeDebugPrivilege 2580 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 2580 firefox.exe 2580 firefox.exe 2580 firefox.exe 2580 firefox.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 2580 firefox.exe 2580 firefox.exe 2580 firefox.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2548 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 30 PID 1944 wrote to memory of 2548 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 30 PID 1944 wrote to memory of 2548 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 30 PID 1944 wrote to memory of 2548 1944 a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe 30 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2548 wrote to memory of 2580 2548 firefox.exe 31 PID 2580 wrote to memory of 2848 2580 firefox.exe 32 PID 2580 wrote to memory of 2848 2580 firefox.exe 32 PID 2580 wrote to memory of 2848 2580 firefox.exe 32 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 600 2580 firefox.exe 33 PID 2580 wrote to memory of 1492 2580 firefox.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1\a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe"C:\Users\Admin\AppData\Local\Temp\1\a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.0.283364585\149256230" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1112 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9504475c-a9da-4ad3-8afb-b3ee97246d12} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 1312 85e5d58 gpu4⤵PID:2848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.1.179822482\114018045" -parentBuildID 20221007134813 -prefsHandle 1528 -prefMapHandle 1524 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bc0fcb4-2b8e-4f14-935d-bbd782fab411} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 1540 d6f858 socket4⤵PID:600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.2.51610419\1100274002" -childID 1 -isForBrowser -prefsHandle 2180 -prefMapHandle 2176 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffd881ee-f0c9-4366-bf20-54a5c9055f69} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 2192 19a80d58 tab4⤵PID:1492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.3.144404157\811775447" -childID 2 -isForBrowser -prefsHandle 2576 -prefMapHandle 2572 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d8f2663-39bc-452d-b258-41073ee6e918} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 2588 d61f58 tab4⤵PID:1752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.4.210157548\2093025261" -childID 3 -isForBrowser -prefsHandle 3880 -prefMapHandle 3604 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba399955-340d-492c-b647-ecdd470e65d6} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 3892 20bdc158 tab4⤵PID:2376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.5.2020134921\1153148497" -childID 4 -isForBrowser -prefsHandle 4020 -prefMapHandle 4024 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9efe6c3d-7083-4ac6-a841-4b6b023575ae} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 4008 20bdb558 tab4⤵PID:1656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2580.6.375453108\1464695439" -childID 5 -isForBrowser -prefsHandle 4140 -prefMapHandle 4144 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 636 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f688ed58-b61b-40d1-8685-573a191b276b} 2580 "\\.\pipe\gecko-crash-server-pipe.2580" 4128 20bdc758 tab4⤵PID:1708
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i7f18jmm.default-release\activity-stream.discovery_stream.json.tmp
Filesize22KB
MD538b8c7b3cc5d1fea48ed2e0a0633bc58
SHA1ed7ce76c4b38dd0f96086ad69ee9d15ff3a15863
SHA256f1f38e24ca26dbbe6411ceeefb4a8c5407407e2d5ab39626eba9e1ccc440d564
SHA51211ab791d98a6679af4878bb053cc7feea3bc8a44abf356b3cc19d1859ff3618260a05bff1dc085865341c807448301b4488c4c7212e072449c01e154befe8f55
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5d6c38af22f9b27264c6e2944b2a82799
SHA1a23e1ffdb9cbd0256d6d9ea79cdb2797b8ca5d0a
SHA256c3a848b8aab3db6905a01fad9c31e5616ac1583c39b1d672111988c323b57a0b
SHA512dbba5039c28e78199c545d08b49c1c0f617862302afe408d7e4cd7c2697efb436900e3739b5d6081074a015e257c761b32812cf2df2207e197b23788426c5c6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\pending_pings\4da35d57-aeba-4977-9c0b-66bac38c9c39
Filesize10KB
MD597c32e3e133b46299e95221b1cdfbd2e
SHA167657d1f0e19d27083a4c4e1d3590380b91e676c
SHA256da568bd99c542b0ecc04e50dabbab44553c0908a1ea9a957a184a2398272f6ed
SHA512297f267417efc117039235a9f30c55782e42f92a20fa0f4dbe4d2c939b1ce9a95049932fbb38dafdc71d3d65d505ff9d6571306263e128a39d9fa9362098fa3d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\pending_pings\dc4a0487-38df-4a70-b32f-bed3d4fa7449
Filesize745B
MD556a55aba849ca8e19b556b166f1cf08f
SHA17297875b89d1b98674d66ceb26a7de6d1de69c97
SHA256d51b3a82653cd1e9e2455166c6dd151651906f954a141187a89251882c2148ce
SHA512869c87f64f4280fbd9210dd3f8f36ea9c06ce36ff35effe27dd51faa219accefcc8c61572f319d294a8bea508d6b47acbb46d21f187a65732083869d8d646e5e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
Filesize
7KB
MD5aa5e4ef546c3631b7e2b3a980ae71cf8
SHA11054a37b5290b30a357a20677ba799bed98eeffe
SHA25623ee3242e6d390fb80f4cd39511703e8c82b4d7646121fd380b5cfe68027631e
SHA512a2dabdf09f187a96c1cf24d946307a0febc73352bfa3d1f4c2f920b9bc9d38395f75f7517596b5fa98c58de0c8f70fcbddd4927dceae2b469dc4ad5c2308d187
-
Filesize
7KB
MD50a864bc9b9867e1103c778c6cbab5389
SHA12b6379246d3abb904dae455009476ea408f8bed0
SHA25673a377303c48826ce7e3f392a811ced4e87774f2c048cbfddd06f7f0b4dc5732
SHA51203008fdd869f05a683a4ea56e1ba41d2915a299e0b86e3dbe51c91c06077e4993ea4a9f750f22b102448696b61fc0a0e028b76c0f3ebe0a4874cc1e8ba5152ac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD50232702d20cfdf52a789ef60c3d6943c
SHA19dd513cc0c34d100bc2b9a2d14d5e4388e317306
SHA256c25a56053de83ab929d7caa0fb092cc5f8f9c9561c6a23a88a3eac77ef0a714e
SHA5126d09b22d86ce7a780e36ada593c2cb5f0ab719727f7c47ec6616cd88856fec6505007207d46def557f66dde2c67dbdcb29769786451f2b7cd7dca5bff87015b2