6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
Size

1.2MB
MD5

8ee8ff6125b9ba9e15904693a8ababdf
SHA1

1fa32fa06402d7c4b02e5ced6689bfa2a9b7f8dc
SHA256

6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1
SHA512

57c052043b073eebc9a6f529f2da19a7dea3a8e8c1a23a60467c152e0dd271492cecac15be153700c93bd13927bfd87c2c7fbaec9f66b244ddb3e67040489c37
SSDEEP

24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8auH9y/ChQcW:tTvC/MTQYxsWR7auHWChQc

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe
Token: SeDebugPrivilege	3016	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
3016	firefox.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1832	2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe	90
PID 2508 wrote to memory of 1832	2508	6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe	90
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 1832 wrote to memory of 3016	1832	firefox.exe	92
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 2608	3016	firefox.exe	93
PID 3016 wrote to memory of 1000	3016	firefox.exe	94
PID 3016 wrote to memory of 1000	3016	firefox.exe	94
PID 3016 wrote to memory of 1000	3016	firefox.exe	94
PID 3016 wrote to memory of 1000	3016	firefox.exe	94
PID 3016 wrote to memory of 1000	3016	firefox.exe	94
PID 3016 wrote to memory of 1000	3016	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe
"C:\Users\Admin\AppData\Local\Temp\6208aad8a023d9030a30596cbf5f7209078723ab5f800384750e352c0b05d9d1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {faf3f0d0-342b-4775-9c42-53a92931a0f6} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" gpu
      4⤵
      PID:2608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {045b766b-6237-4075-aa4a-59392b1f89b8} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" socket
      4⤵
      PID:1000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1452 -childID 1 -isForBrowser -prefsHandle 2780 -prefMapHandle 3088 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c8e795d-efb9-4879-9c86-59c969d9b32a} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" tab
      4⤵
      PID:800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3828 -childID 2 -isForBrowser -prefsHandle 3820 -prefMapHandle 2788 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b9ed37a-a3bc-426c-be9f-26af6ca30c2b} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" tab
      4⤵
      PID:4032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4804 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4772 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2723e9a8-d34f-40c2-a923-89ba6e4e0574} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" utility
      4⤵
      Checks processor information in registry
      PID:5176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 3 -isForBrowser -prefsHandle 5652 -prefMapHandle 5648 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3088f29d-53ad-4525-b7b7-20ae8c03d16e} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" tab
      4⤵
      PID:6052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 4 -isForBrowser -prefsHandle 5776 -prefMapHandle 5760 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a22a47c3-c179-499f-b34d-646c23f3bdf6} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" tab
      4⤵
      PID:6092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 5 -isForBrowser -prefsHandle 6104 -prefMapHandle 6096 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6717d63-793a-4577-acee-0e20b2fe51f9} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" tab
      4⤵
      PID:1860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6076 -childID 6 -isForBrowser -prefsHandle 6080 -prefMapHandle 5776 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb0d8937-0671-4431-80ff-1fa42d2d5015} 3016 "\\.\pipe\gecko-crash-server-pipe.3016" tab
      4⤵
      PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\activity-stream.discovery_stream.json

Filesize
36KB

MD5
c76398300f2c57e502ce0b5bb24fbf33

SHA1
b5cc5168323e127c8a7f299c0c2aa738270b6368

SHA256
99b2823e512cc5eb2a83c5be5dcdf6dfc22aea1604829f29b47e10e4d02d5264

SHA512
da33b8c77784d1d16594c62da8fe531807d2a12e4bb8b95bf9e237b85b1a8788d3ab746c186b865363d55c7eefe2330699b6a0ff95c4e3e9b5edce52012b1696

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

Filesize
13KB

MD5
e8375a4021bad7f59abcf368d1abda26

SHA1
f9f6c6edd9a105f24957ec962992c14cabf46729

SHA256
390fe6282b4c7db372bb7dcf3a741cdf9c4431fa693696365c90acfb4bb98da5

SHA512
ec9a8186838152e8c394881115ba951ad965d8409c2d70ba817e82ad6ba4bb9afd3905b73539cd41528e7f7021089991964f127e847d6c77597e77a08ba05172

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin

Filesize
10KB

MD5
05c37c48a3ae59422ccca07cfb309b7c

SHA1
3033e5ccb6ab446cfcff15ea15a0ba3d82219453

SHA256
133a749c9860a85214494d476f3102a3e1b9a9dd9b3748e8bab44bc7e54e3c87

SHA512
855c8e8aed8e7a348ec66362a8514da9b940ca10d6c23d568c1279b361f4fcac602aa4fa3fbf977ec672bc199721b2777ba2348a3a8ad57d7b6c863512b47823

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f22ce4da19c2e135a1bbbfc2f9a37449

SHA1
1ce1c09e6e4005e366b811a413257227270763a6

SHA256
73a7e27c6e0bb8d09452d5c15d2aac4d609cdbb52013ab9e3ab13e60a06a8de9

SHA512
ceedf8bd831014893494733bce335b78382a9090911a6f61ee1b620af77f609969f1150b8f1569a1c0440b1827ad3fa2fbd0cd3ecc6d9c96ba3c1ff4fc904a93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ec7219faba45f41622355494661af9b7

SHA1
0359c0e7da7a0361d55ad67913feb46b43923896

SHA256
cab7c02d8d176a9c90a0e2d40fc3090e129a8a4c82433efa807f941c2d1e3424

SHA512
fce7e33e0d34d67ab3084abc0f461cda46cdce46ad0e263ebbcb0f5024596531d141fbac84f927aeb528f2caab899d622275c1facbe27fe1f29e4c5b6a7a05c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
6a6a42fb872f1ba1124c4ac81f24f0a3

SHA1
9eaa7c4dca37bcb45e70b5b8b94145e3d82323ea

SHA256
da52dd5a7e81ba35009736ff17d794d0c553f6aaeb99bb03c8a0b1434396c71e

SHA512
02b4684ef9572d30c7f4e39350706b670ecee04c63d01a433a7ed94a08a7c1ee27e19ab0a8d89232d4bd094a8615eefee086a7af450afc702957b5d1129e7e3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\06cab80b-8de5-4fab-85d1-e6b9ec3ae677

Filesize
671B

MD5
623a8f27fb0aa9f44352fe03c82a1bba

SHA1
59e3e5520ef14e1ac0367ae45feafd79f9c1cc7a

SHA256
c09dfa8679838ab0ff938a8da4a55674ff175693c1156298da460fcae14939bc

SHA512
70ac76f4eea8cdd4aa6cdf36c2e2d415831761c28b39c829c0afacda583a3ccadd2576b70273e2351116fdf1354b47c0a84adc9683e412e5e05c59356f19fd2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\34f59d33-f696-4c1f-92f5-998e2e5d06a9

Filesize
982B

MD5
daa411fdc78dc932e5dc52ee19ccfd15

SHA1
833f87be25cdad9d232bf52c7d16ff3a279b9745

SHA256
689cb0f79c5b2f76234bfa41e5a1ff39df3d03f6c13024dec0ba23592964b535

SHA512
accef360e493ca1d38fb916325cd880d434152007d71b92fd0222c9029abca7752ec2a3cf263f32cce93bd2efd6b5e7d89924cdb5d6c5c753b97eab681b21c93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\46ce1df3-f31a-49c0-afb8-0e8744fc2804

Filesize
27KB

MD5
b0434dc57cd6fe08129365c8f56915f9

SHA1
97a8ac701ac3eae6c5ace3e6e562c0f0fb663885

SHA256
38abda465cc6fe587520a59c6fb9c041a8b872120a62dcff85e546fe36053b72

SHA512
512834c22b5c94018133d2b70afa77a5e36642ed40efd78b22bc03054c66a7914843ac0364efd47f289e40e88da14d00fc3cd522a37849a381846e73288d6f2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js

Filesize
12KB

MD5
ea0dc7491908b0de46e86124a4ca27fe

SHA1
a0bec1b8da175c7c346b7d3a58c0e0001dac121e

SHA256
934e7c494a38fbbb3e803e3eb6f9ba3550ea12193dda964e48ce7037131574b6

SHA512
2f8e9d3bf3ea292818c17aa86c61c67ad165770b394237506869c7c2d9c617e9b992130a85fed9c759138742d127c39559c782aa7acd17a6291634f68e005994

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js

Filesize
11KB

MD5
824e87314a58333003bcad4c16f83d0e

SHA1
5944a2ee8c1b9ff5038a33d2e8f09211b0c70809

SHA256
25d86932970070b1c2b15e434eb529c073aff1b2731cd0ac9cebd02125e38f6d

SHA512
6ae2ee2b1b293eb6aced8d4744b364cb1d40c755f06a876b3e446b09246ee89c0e05487ddd66044a045e7cc56532fc28d473b830b0a12241344579ef13a2ed31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js

Filesize
11KB

MD5
3335c67580eca298405087e468327ae5

SHA1
7c2f38dd035cb368f75e7fc6b642d7d8cebafa49

SHA256
5de9ae3e96994ba1d18b889897d715d8b3054b16b9e13d747ec2795b04524048

SHA512
6af967d6532e2f261be9fa31e3db076ce210f3a5f8f3164cf4048955e8e2466e6340975be12ff9d74d1dd34b6c3ee3b59d6fe43c86f6389164253e98a48eea08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.5MB

MD5
d71ff9cfdae74d574be599847f939186

SHA1
fe1115d0534a6c86a689fff5c166d38807276c62

SHA256
2c71cea0e74db87f44bb50110ab1f7d6d4604376077f8707e86486e23c773b20

SHA512
ccdd9c42d100f242e1dfdba5399aea08b3402f7be22e2a5ec0dbb7e1d31082c87cc283a79e353a094a8a429532b893be568515327df035729dc0f8eadd697c6a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads