ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

Resubmissions

21/08/2024, 14:28

240821-rtf1lsxalk 9

21/08/2024, 14:28

240821-rs9ljatcqb 1

21/08/2024, 14:24

240821-rqq2eatbnc 4

Analysis

max time kernel
193s
max time network
195s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21/08/2024, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

1KB
MD5

84238dfc8092e5d9c0dac8ef93371a07
SHA1

4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
SHA256

ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
SHA512

d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
71	discord.com
72	discord.com
73	discord.com
74	discord.com
125	discord.com
135	discord.com
141	discord.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{AEFD0603-4BB8-4B03-8D93-CDC52CB68434} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 22d0c981d6f3da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 1959d381d6f3da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000053d085edcb39e4337d9931b194a67fe503fba22baf8900b9b839c1969c15633cfbbd81ddd01009184334f9529f076aac5fda8fae5f5ae7a112d9	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4512	MicrosoftEdgeCP.exe
4512	MicrosoftEdgeCP.exe
4512	MicrosoftEdgeCP.exe
4512	MicrosoftEdgeCP.exe
4512	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4860	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4860	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4860	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4364	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4528	MicrosoftEdge.exe
Token: SeDebugPrivilege	4528	MicrosoftEdge.exe
Token: SeDebugPrivilege	3776	firefox.exe
Token: SeDebugPrivilege	3776	firefox.exe
Token: 33	5448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5448	AUDIODG.EXE
Token: SeDebugPrivilege	3776	firefox.exe
Token: SeDebugPrivilege	3776	firefox.exe
Token: SeDebugPrivilege	3776	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3776	firefox.exe
3776	firefox.exe
3776	firefox.exe
3776	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3776	firefox.exe
3776	firefox.exe
3776	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4528	MicrosoftEdge.exe
4512	MicrosoftEdgeCP.exe
4860	MicrosoftEdgeCP.exe
4512	MicrosoftEdgeCP.exe
2884	MicrosoftEdgeCP.exe
3776	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4512 wrote to memory of 4364	4512	MicrosoftEdgeCP.exe	76
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 4644 wrote to memory of 3776	4644	firefox.exe	87
PID 3776 wrote to memory of 4480	3776	firefox.exe	88
PID 3776 wrote to memory of 4480	3776	firefox.exe	88
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89
PID 3776 wrote to memory of 1672	3776	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\.html"
1⤵
PID:752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3600

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4860

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.0.620391833\2015279353" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1744 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0204a75b-1bfa-46cd-8932-8561ec1ec762} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 1828 1b7260d8458 gpu
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.1.594786314\1019746433" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5a15945-ec2e-4ac6-84f7-78b3068241e0} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 2180 1b71a1e5158 socket
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.2.458626988\819589368" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2664 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {243993c3-db8e-44b2-b65e-a37c36a1d5aa} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 3416 1b72aee8558 tab
    3⤵
    PID:4132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.3.1371398897\262930485" -childID 2 -isForBrowser -prefsHandle 2884 -prefMapHandle 2656 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12ec4241-148a-4826-9bed-176d01d510c4} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 2788 1b729512058 tab
    3⤵
    PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.4.2074029765\1704173248" -childID 3 -isForBrowser -prefsHandle 4508 -prefMapHandle 4504 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5b5512f-6eb5-439a-a85f-cd254edc1c27} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 4520 1b72d0b2858 tab
    3⤵
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.5.896970801\1263621423" -childID 4 -isForBrowser -prefsHandle 5012 -prefMapHandle 4832 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {964af8b3-c073-4d4c-ba62-9b00bfd62dbc} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5000 1b71a12f058 tab
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.6.1694578899\671270078" -childID 5 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d24d3e86-fa04-44be-8a7b-bf8c8a2b4a16} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5124 1b7295e7e58 tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.7.907537295\1704826926" -childID 6 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {866bcad7-6157-465f-ae48-1c134bafebd5} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5320 1b72b3a5858 tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.8.488162712\122700534" -childID 7 -isForBrowser -prefsHandle 5700 -prefMapHandle 5676 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57341f00-8545-440c-acf8-0eeef59f3bd7} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5692 1b72ed0f858 tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.9.1663311621\2032308300" -parentBuildID 20221007134813 -prefsHandle 4228 -prefMapHandle 4180 -prefsLen 26503 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2df8a517-7695-4591-87e6-b7cba0c36fda} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 1636 1b72d0b4358 rdd
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.10.1394815664\1691442464" -childID 8 -isForBrowser -prefsHandle 5512 -prefMapHandle 2528 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f8f2965-4ec6-4705-80c6-4fc348e5220c} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 4628 1b72fcfd258 tab
    3⤵
    PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.11.585265184\1090773144" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 1504 -prefMapHandle 2744 -prefsLen 26503 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8ce59e2-3da5-4094-afea-1d06ddba0538} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 2660 1b72dbecf58 utility
    3⤵
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.12.64384161\797171364" -childID 9 -isForBrowser -prefsHandle 5188 -prefMapHandle 5184 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66b7ddbf-e9fe-44c4-aa89-62ae340d79ec} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5648 1b72ede8b58 tab
    3⤵
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.13.695586864\1572134003" -childID 10 -isForBrowser -prefsHandle 6348 -prefMapHandle 6344 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78ddb9bd-a107-4207-8a33-998c81a74109} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 6356 1b72e41c558 tab
    3⤵
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.14.292407333\562292720" -childID 11 -isForBrowser -prefsHandle 6500 -prefMapHandle 6504 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0405e63b-bf7a-4111-be0e-8a9d98e5f68a} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 6488 1b7300cc458 tab
    3⤵
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.15.145766229\496887754" -childID 12 -isForBrowser -prefsHandle 5112 -prefMapHandle 5048 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08230900-bf5e-486a-86d0-69842810ed0e} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 4668 1b730c8ed58 tab
    3⤵
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.16.1503305400\1777528698" -childID 13 -isForBrowser -prefsHandle 5752 -prefMapHandle 5768 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f23956a0-4a78-41a4-b12b-9864398b1b03} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5740 1b728d0ca58 tab
    3⤵
    PID:700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.17.986445659\1360760075" -childID 14 -isForBrowser -prefsHandle 4624 -prefMapHandle 4660 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0ab7c9e-d143-4872-9124-ef5dd4e438da} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 2684 1b728d0d058 tab
    3⤵
    PID:1340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22885

Filesize
18KB

MD5
6ba31e80c5138039c434046ebd29b6a1

SHA1
88f174e2999db0c2668041447c40ff933cea338c

SHA256
caa968ad779e3556b501b7c1776b45078ed4bc649a93b1d55bcb154609f9954b

SHA512
25d47519e3539461bfae1bb071c22fdfebd547f2fc623566b0588abeade33f9b5f659908c73c044370850618ca897add38e8146c6a9663cf3843795d46f04d72

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\3C037406957C6A3957979D98A58F5D96FF6B1489

Filesize
40KB

MD5
8eb3cfc27990ef5a9176d9b41dd6a32b

SHA1
8de4a1172a46110e14fe7918a30fefa4f1a01280

SHA256
8dd8ea9e4c65a4a983807847dc5920dc3e79cc71a14e72106a5d084b1a2e0e10

SHA512
95e4c0677f3392ce0e7713756c702f916a143fd87938cc14d4caa8777a45245e9f342f66c6540be83f8ffe7255a057b32e55df0481df0e8fca4a2fa49c549268

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9357B92D7A82DC731CBB46EBC4F197AB314C7C11

Filesize
218KB

MD5
e986a0ef0200ec4e24bcf14aef5f7a62

SHA1
49da1e0a188edc6977434e17cc46385f9917e6d4

SHA256
5e3ec902ab2fa0d44b5b22cd03eae70a0feeebd85a138e01ba2102f677a0ec9a

SHA512
2bbc575c3119ade9a15d3c12e94ed996b45c8dbe241174e36929664d1bc935cabf43cbb0dbde1bab48cdec116bb744b6831aacd16288a359a9bec6c6590462b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\jumpListCache\26UbzFJ7qT9_4DhodHKA1Q==.ico

Filesize
832B

MD5
067a8ad372e732915d925b4bcaf7d3c9

SHA1
943f76f5099e4abd9d3a1ca5929c6a5507804acb

SHA256
98e7ca2a6dca462bbb55338362943fca21a79c21cad7c1c5bee47ad5150ff4f5

SHA512
8a803302acc8b85527d139db414aca66adfa3573825f4f2c28390c3f0db3df59fc674c9d7e69e7d40364f7622e09692f1749456b23a5ce395f4caa1a156d564b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF81C49BD343CD4777.TMP

Filesize
28KB

MD5
f3474f72f3f5c43036f21a57a30326a9

SHA1
89471a61abf2fe13376691522993656beec05950

SHA256
043e2a37e4f846268b3d47a0526edeaef615bf7b67c165bbbfdd5870f44f31c4

SHA512
25231dfd2d80a6a6f549f6c050db3980a923c4cf139afc177dc6c50e3c81a27c4f2125d2770186e84be8eeef0248493eb488721ad3f01866309245ab9ab22725

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
cd4f1503bfbae9c61e2ea89bd082e3a9

SHA1
3edbd694f8f8fb598e587ffb83e595ea81135701

SHA256
9a37a0fe37cb696350f6e4ea5b761ee60d1906f3a572b700effcc3e235365e4e

SHA512
794a197ab1a0250a91dd60df63b43633ef242886fa29a25e871479f4a301a65bdb0be20e2732697fa936f6232557b4317106f4bd725d96d00c7627e5f863a404

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\06987ab2-a44e-49cb-96e1-b470d0928200

Filesize
746B

MD5
d73c10ad48553ebdfdead682c427835d

SHA1
aa30b40622297b48d8b275e2410c8b86d78f7e72

SHA256
797f95b93ebf479651775a823c9c9a5a3e2ac87530b89bb8bd3d7a75ab76f24f

SHA512
86d216c73aa5ae91d4ac4663ce9508687e62654200cd185394ac397cb350189f34da92b07622fdf27cc61123e3bcf9f4e61d955ccfe18945abc79cd6ab600bce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\c8d1907a-ddd8-4a92-aa44-cff5d756de8c

Filesize
10KB

MD5
3eb0acb9ef2d80e338cb4fc1d5cc2229

SHA1
ccad8ccdaea0c7df81eca593badbc77a41aa1262

SHA256
225e3d8fcd5e321c0974e73fd0d35bfeebe8dd4df5fa6754283b3b1caf4eee14

SHA512
b6bc768d25f2f84e149c7abf12eda1213d8829aefa4583d7945cd2f69c432b6f745cab904ddd042a1d00408bda77c1d66802060e6f54f64ce38476a1e68f5fa0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
ac39e64dd59f11965cd3c5a117f3b24f

SHA1
2db3cb0c072075077110c092605d8821aacb2b78

SHA256
8e571cb85ab4817f51d2ca1dfb68986ceac9715da8508443b67701fa190b6abf

SHA512
0006dbbc36ea7427bacdaf12226951b045fae3e218af9ccabf28517b33fca12c5ac9f6204adff7cc6318e038fd73549686415ff368029bbe0a291ccbb89a7ff5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
069280de54da16d3cee1a4f4b1ab1416

SHA1
69a276d7f69578e4295292484b0138d98a6bf895

SHA256
60cd01b325ceb2b8afa77c4950132cd866976d010a196685dc0d5c011e7466b0

SHA512
d716b43ca1d2517ed050ea5d08d18153f2f57782105899cd439e02b79b4b079b1a26cf75c279360c80f5a0e2cddc3c7dd2ffd2a1c53d396d238f5aa6cb661608

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
6cf34ebba769901d5f6a8f80b677a454

SHA1
b881b8ef4e312a07df5823560b32242cbd1a7d2f

SHA256
3e99d6dc7cd280c408badca5f775051970170b4fb005ab409950f78f9eb2f71a

SHA512
4d3abb4ce7cdf4ece0b93e9cdf8972872571c6cb8a4c32e8216dc2cd73544b9e4cceb936012bb499df9d92be3e6a9bb8f67be8471be5982ffb962232091db7da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
1dfa5a1e73f7880e8ae77f76ab96f03f

SHA1
eabcc2d90f246cb9da1db7ec15d236f925be6ed9

SHA256
844d0d1b9ef5fa5ff824a30cdefa4ca2d92c981a9d980a91d7e11d9a2dc9c573

SHA512
352990b40533dbd3b54395ba31d4444aebd7c9a99b633737ec51cf86ea5513e4b00e677a1a9bf952fc8fb2a73880da4398856981d70c9c42fc094d67e3f76bba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
2cd8726a0864f0a1ba93eaeae44a10b8

SHA1
c014a884a56b1c6b91c701897b5413553802f81e

SHA256
2cae2867f9eb3f2e95354e87430e7fece066529abfcd8f0f8e1e7606f9c0e72e

SHA512
b797b46c23c0edfaea40719b95b90f8dd26595e0b96edef3de1b1f686b151b5593300768ad4dbe622f50568592b927ab3acc9e332139404a37c5721cb93efa9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
02bdfffc3ed542719df1dc1c046287fb

SHA1
9cc42fd4ca3cdcc66a2176029525ca5bf80fa594

SHA256
5acfc2385f1691c5a05fe305b198996d8761df8b6ca8a0038a432af679f60d25

SHA512
9859af38e68ed70c443e33ffe42012c9320b77d9648af5966ae963318b289215807b696e81bc0bd8320b4c558933715708c1ee3a1b1b3dd130e87b0f204913f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
24KB

MD5
ac549f0e7fff345381d2235b38d79785

SHA1
c94b7cfea4b24ecce8dee555b1e3c383fce25c23

SHA256
529e6fe63e9714b55dbb33680042be3bf989cb316cf44adc8ce802ba22d9fba4

SHA512
05f831785556315bbe80c77cfed9a0cd9f8d8df1c1688a32c1865b09e784c1fbae306a1e2db9b0e87dba4c7219cbf794dd76b312cf143e11fdb9f0f47caf581f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
b7febcd2a130d08ed6854a7c1495975c

SHA1
b553a3abac5c31ac396b5627ebbd8de43faab857

SHA256
b57ed85e6270aa4a6f5da791b2655f17b3cf6ee6f11bbc11bb686732cceafd00

SHA512
395721b8b50e0446e374057d135dcc9040d9a2630016f103f85d8d30c075b3bb9cb70f63716def5bfc139d3a4be2de7ac492db9c8ac73d70caead85be537e8f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
048a363a586e3fd7bf2fe3710d6b7515

SHA1
6d692e9494e8e86afdd3449fcde8827d7459e3d2

SHA256
2742b50f5edc2f08c338f223a5c5fac238bedacdcd410e51eac68232e7d4f4af

SHA512
8013ed117f41e7992a71911001a0f78e6c17cb5b65065b372b4fe644871d49c0ae64ad770ae07f2f1d48adb9a096b011d2e12a3621feaaab9195d35c06945559

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
18KB

MD5
8259c616b8612a6a89926a689611ce4e

SHA1
4abb03f8a32361f5c2e88bf63dfb643f5824c478

SHA256
42d9340ed7b9a02e0b6268fa6951160d980b5d33705ff9d73db310944f2e28d4

SHA512
5edf7c8fa9a40ac0039f4ec1eeb8df16aaae813e742f536fd842a15cea5a48d11bdad26c6860d2f086249f6fd8e1d729db256c9b0297dc0865c505e0b8993640

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
2e18c0dbb0836cf45080270e4201b262

SHA1
04a1f90ffc08c761a12207659dbe1e065fa671f8

SHA256
c56aeb3992f4210827fbbd2468b02a06e5bec4938d6338c868871725dbdfddbd

SHA512
93700906813dc60cefefb7d32c3debb8af1bbb4ec85c549a72647852778e3a4965a6c8efae9fd62e522aa34414cb0fc019713c9b6ca7891e286b28430badc7c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
20KB

MD5
67408d43f86cf9461dfdb5348c2aa3dc

SHA1
937d2620b0d7043ec004f9bc0fafdbabd5b24ee4

SHA256
fa4361ef365b34def66386da8efaaafc1613faba5775d2edf6ddef06eb8f86ca

SHA512
74b1f8261b30745c360e50d13b97753db40d1ac6c574df3adf74a07432f59976ae850a86b9bc6acf70e7ccca2748dab1ddf805436217ba8637d955b3ace29d0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.youtube.com\cache\morgue\27\{06a89164-e23a-412a-a392-7be0e78e0e1b}.final

Filesize
74KB

MD5
a78d3e3275df3250631f4bea67fc7ec9

SHA1
6b7b529ab2496257c2c4b7f61e6dbdb164b44e15

SHA256
3b27023ad7b7ec32cbec97571e8ef41e9ec8be4ee81098bf9bf601438f7a03d5

SHA512
0cfc750312189a7ab0fc383574e06218af7e885ec6bd21b04669314ee9893c40669a8fcda5e6645f9eff15b6c8c72e886ec936e662f693189bcad0cb948150be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.youtube.com\cache\morgue\33\{9e46ed9f-76d0-4ea5-be7a-6731e40fd021}.final

Filesize
4KB

MD5
dac71fd165ecaac8b459c6d82b79c375

SHA1
22dd9f5604f7b182c15af7a6ea1c14499ec61412

SHA256
8ff064e18f63a93e48dfa9aacd5d3a5f121f76a4b3a8560e9dc12c227ea14970

SHA512
cd912b06b142a13431e11d3a0b4bb0537f23cbf37e5c39419f8f2412ad36766eb5cbeb2511609caf2c35dff1e8753f246006438805335bd1c74cffc734c22adb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
40KB

MD5
42d0da72a5a8bd4068134a36e82e2785

SHA1
776025d21e477435db806f3681c9857335b402eb

SHA256
1329184fbbe465f1c1a52d70ec71e45c838c24acc0d738901aae2e485306009f

SHA512
2d52705264e8ef2ac33eb67ffd73775008d0cec0f114d2f8fc57b481ae1659008fc5417a0440fe02e5abc1401e41b72122565f73d6fba8c68e419c3ef235fbec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.youtube.com\idb\448166522yCt7-%iCt7-%reeesbpco.sqlite

Filesize
48KB

MD5
16e4c6e0e1a24210cdcbebd7380bf6ec

SHA1
c69b256c43dc17a82058f637448c064f16a626d1

SHA256
4b59758303a000a25c71630b8dc9dca84fdc6a7f2bf15d1ad4f44479b6563458

SHA512
cd9d5c6b270eb3618093d48d446effbf029e0a038eb89ed52f8effe318f57b5356d77d1fd495329b6ed1ef7ef1157021a4922e37cbcc6767435500629f2efa08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
memory/4364-64-0x00000280929D0000-0x00000280929D2000-memory.dmp

Filesize
8KB

Download
memory/4364-53-0x00000280928C0000-0x00000280928C2000-memory.dmp

Filesize
8KB

Download
memory/4364-68-0x0000028092AB0000-0x0000028092AB2000-memory.dmp

Filesize
8KB

Download
memory/4364-56-0x00000280928F0000-0x00000280928F2000-memory.dmp

Filesize
8KB

Download
memory/4364-70-0x0000028092AD0000-0x0000028092AD2000-memory.dmp

Filesize
8KB

Download
memory/4364-75-0x0000028092BC0000-0x0000028092BC2000-memory.dmp

Filesize
8KB

Download
memory/4364-73-0x0000028092BB0000-0x0000028092BB2000-memory.dmp

Filesize
8KB

Download
memory/4364-60-0x0000028092990000-0x0000028092992000-memory.dmp

Filesize
8KB

Download
memory/4364-66-0x00000280929F0000-0x00000280929F2000-memory.dmp

Filesize
8KB

Download
memory/4364-58-0x0000028092980000-0x0000028092982000-memory.dmp

Filesize
8KB

Download
memory/4364-62-0x00000280929B0000-0x00000280929B2000-memory.dmp

Filesize
8KB

Download
memory/4528-134-0x00000248084B0000-0x00000248084B2000-memory.dmp

Filesize
8KB

Download
memory/4528-35-0x0000024808300000-0x0000024808302000-memory.dmp

Filesize
8KB

Download
memory/4528-141-0x0000024808260000-0x0000024808261000-memory.dmp

Filesize
4KB

Download
memory/4528-137-0x0000024808330000-0x0000024808331000-memory.dmp

Filesize
4KB

Download
memory/4528-16-0x0000024804120000-0x0000024804130000-memory.dmp

Filesize
64KB

Download
memory/4528-1-0x0000024804030000-0x0000024804040000-memory.dmp

Filesize
64KB

Download
memory/4860-45-0x00000184DFF40000-0x00000184E0040000-memory.dmp

Filesize
1024KB

Download
memory/4860-47-0x00000184DFF40000-0x00000184E0040000-memory.dmp

Filesize
1024KB

Download