6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
Size

896KB
MD5

139774364e144d5dd749464d5ca7b793
SHA1

a1625e8b41d10c2613f4915fbdec79c882715a2b
SHA256

6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741
SHA512

043b31a7513e625c26237049548dfcfe95eae6fe499edd4c1dcc46e2142392da794c1a1a553f6c9b4d72720247df50852a280c3daf8e9c1e7e91b82655fb2dd4
SSDEEP

12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTT:9qDEvCTbMWu7rQYlBQcBiT6rprG8avT

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{216491C0-D72C-4854-936E-3900A9D848E8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	firefox.exe
Token: SeDebugPrivilege	3372	firefox.exe
Token: SeDebugPrivilege	3372	firefox.exe
Token: SeDebugPrivilege	3372	firefox.exe
Token: SeDebugPrivilege	3372	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe
3372	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4704	2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe	91
PID 2080 wrote to memory of 4704	2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe	91
PID 2080 wrote to memory of 3092	2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe	93
PID 2080 wrote to memory of 3092	2080	6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe	93
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3092 wrote to memory of 3372	3092	firefox.exe	94
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 2492	3372	firefox.exe	100
PID 3372 wrote to memory of 3924	3372	firefox.exe	101
PID 3372 wrote to memory of 3924	3372	firefox.exe	101
PID 3372 wrote to memory of 3924	3372	firefox.exe	101
PID 3372 wrote to memory of 3924	3372	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe
"C:\Users\Admin\AppData\Local\Temp\6132a1db15215012276962d1ff4686a374ea79601f43669a2a371b405cc79741.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  PID:4704
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {507df1fd-c928-450c-b243-ece86d8a3a9d} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" gpu
      4⤵
      PID:2492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab11500-c83b-42e8-9a1c-995d4119365c} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" socket
      4⤵
      PID:3924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 3044 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f6bb9ee-acc5-472b-8305-308b75649891} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" tab
      4⤵
      PID:4404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3920 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {283ea5bd-1e90-498f-8942-1132a5606d73} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" tab
      4⤵
      PID:2708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4444 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4436 -prefMapHandle 4432 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d90ab450-7174-48a2-b6d6-32250f944b04} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" utility
      4⤵
      Checks processor information in registry
      PID:5556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 4560 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fffc2d0e-5370-4af1-a537-26bb62239273} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" tab
      4⤵
      PID:224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 4 -isForBrowser -prefsHandle 5568 -prefMapHandle 5572 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c8165ec-50a2-4950-b032-9edf1bf5998c} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" tab
      4⤵
      PID:3856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5728 -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5656 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70ede67a-419c-46ff-a1c3-4f2563e4a20c} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" tab
      4⤵
      PID:1336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6188 -childID 6 -isForBrowser -prefsHandle 6172 -prefMapHandle 6148 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db07a713-545c-4c5e-9263-dd323ecbadb0} 3372 "\\.\pipe\gecko-crash-server-pipe.3372" tab
      4⤵
      PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4376,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4088,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
1⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5372,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
1⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5564,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
1⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5444,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
1⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6340,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
1⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5736,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
1⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6084,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
1⤵
- Modifies registry class
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5876,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
1⤵
PID:6248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=6872,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Filesize
13KB

MD5
c5c09205fad06ec13ab0c92d68897000

SHA1
2c5594b23ca2c6ba79d9f743d8a4fba0275da64c

SHA256
b313fb9f7a63e98db3a90092d818027174693edfe9fc4cbb44560659888126b9

SHA512
8c4dd297a80883099002e93945ffcf0a24cf8fde1386922af43d56184949633b11a6a01e7034c98699b577e689d43788a5bd6c90180f39b9f622a2da344971ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
7KB

MD5
d05244bfd57f83ffb8c7e3d7fb98df46

SHA1
a8ac8442519c772edb41c1429b6f79bb97dc04bc

SHA256
6a30f8e1d9e9470dc4279eadd59bc1d1c9cd0048de0d407896bec8db15a5fa82

SHA512
f4f39280e4a91dea31a8302858ceaf21ecb4883dab15022ad84cb9ace7fe5d3fe23de5e4104b33c455de46b1a0c8729d6aa4d5a572054e094ae9bacd44967979

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
10KB

MD5
d870197fb93c2c3e8004202e75972f6f

SHA1
0496729e34d864eee6473dead2a9e920bdad3e92

SHA256
96ee9b4d66df4aed1522be58141c2bf62630b3fc627e23557a8fe6489f13b138

SHA512
acfdba0387ffe2ec056ccd1bd1a6759e23107b8a2647e62d7d9273474f611cbf34224ef7a38943efaec21ec42153f11be2ed0990cc5ae6d58dac3385b9174200

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
65c5b681063f51c6a8566a2b438e0234

SHA1
cdb81f69f599eb3171677f5f29169526728556b6

SHA256
73e19946cdec6caa63d7c5457ca1bba01bea4bebba9e7f14dbdd9f709e5225d1

SHA512
d23e2195e5d7d57f6414861e7105454619a67e7a69265acc88cceb1e9ec8f0c9177d32989958c9502aa31876d07a61e42100b558d54d2e1868b253ff324c4bde

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
4efa3d16a94360d2741a972a6f4d65ca

SHA1
9c38498c457cea998da1fa358d21f4ebbe151469

SHA256
a053dfc9665c5d2bc7d9976aaedbf398a8fbe20fb489567b2a4531e2df06d594

SHA512
8fea2d2e359ad430d024f1ef8a8bda025d98ab72eca1b6fb8a606e2013420fe97d964878bc9689888b1fee5e76518c3f41ad3ad9c0f8bc976a69fe92f36fd085

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\447b1521-4669-44cc-917c-1be669e8addc

Filesize
26KB

MD5
7614de29ca5dd8794562fbf697b212c2

SHA1
efd23a5f95ef03bf31fe9a91761bd1282be4572c

SHA256
d41f2eea87c6f9717b15886ba916fc55df96f00466ef5ec94e8df95b6e690d72

SHA512
61a4c4ee0db71a2f7441cb57ea81bda01e25af0373f95edf82bb6477ca38a90452cf6a7e8081e78525f2302b70df14981ae0fb4ad3cb5020ee6bcea57feb54a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\8a8449df-58eb-4b24-a09d-b4c695dae8a3

Filesize
671B

MD5
d21d53113bd70409cbf53d562bf28197

SHA1
0c90f2d4543cb827bcffbe254443221dc3002946

SHA256
668020659c71519e1dc8f69eb7fb710b8761f09885cb0877df34535bb76ac90e

SHA512
35681254e796f245ae7cd99cb05a7b943a1f8fda75e9fa806004d96cafb7147c912e7284396b96bfc19ab8d7641d0ed43b50b537774b2e9a2adaca44713705f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\ed927da9-a0c1-46ad-a045-e47ad7b99e72

Filesize
982B

MD5
773c9227d05363abe7297355e8ff8d52

SHA1
6151ec212fea0612b8bfa880ba5e11747d4674f5

SHA256
3ddd57ee83a2abbf52d56c5fc515e117de15f39611fe51b07b0d367881052cd3

SHA512
3d2e32c5d8d116cd0d1f20020b45916944fbc5b518aad29567320b75d917093471ef928c98773a7613efd243f4987fbf1216f68f676aef3f93beeb4ea5279da1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
12KB

MD5
84dce04c89ed6eb751ada77d506fa7f7

SHA1
7ab5a111eea4eb16e38be7f8f6fa0580d19d7cc2

SHA256
abb2e4e260da3896f61197f657ba4f9036acb1ed33dc3965522b62abc227c2b5

SHA512
6e8c19dbc139ea0df9df1fcd890d162bba8a4e1cb094e6918d614375f21aedc799d9142eecddbe51cc527de4481737102bfa5e5a997a70984f0116a1cb3f8d34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
16KB

MD5
eeb999480265743a67ef6ed8c78dc4be

SHA1
af080ba4cffe3405dfcd660be15f3350d2d34ece

SHA256
ba60fb3567ea0af82e95fd0474b0d63725338484464486576c339ab05df29450

SHA512
9559889bbff9656f68afdab8e84cbdb3a7e77a6843ffeb4a57c84cf1747e0e0842b7cabdeb44affd5b7dbeba5c49c0d114c132496968f61e6e0f658b947f9688

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
11KB

MD5
98b6c832020d31ffe891be8837a2822c

SHA1
59eb0e36a45dfb3eb8ce6507ab129bb8cc809cb8

SHA256
bdedb389eedb6f33a465733e7c41c05da4af6586f116301394f9af8eb9ae261f

SHA512
680884ab007ab21710a1757abd591dd8bf466dac22b68ea13f7386130610979483dbc3892b080e0ce442fd46e853b43899aa1d525b958e0b678c7b8855dd12e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
774c79e40bb735653595f89e66b6878d

SHA1
36c5da139e23a519e17c91a92e61df72fbdea2e5

SHA256
8e6fd167529b378b09371ccdf4bb3dc2a7b1aab87a1b77f5a5da3c5098f7e48e

SHA512
91fe0e333c6a3145dffaafde7b163d45585eb666bd7506258bc2ac3aafe8290c3ac06fd8f9f246db074cb8c66046f533ade0ff5b4ae6a2ad6391feb99e952f3d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
0dc4860d9b404b4e4d298267878dad25

SHA1
f758cfbb9ca8c4ffa87296e9ef7cb9a6d22937fc

SHA256
4a750fbbe9e88d73b95bcf486859fa3ddd6d0375f8343254a934109199ca1d8e

SHA512
6d28d59e20a1d88010cd8553f0ba00229952aa9f958f340a7dba9d0e334821d2a95c1226032abdb03a006b0810e953a715df52ea24e46aabaa99083c735dbd76

Download Submit