cef5b60321f17991400a19072052535638c0a5c02d338234686552deadeea82e

Analysis

max time kernel
147s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28/08/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x6z.exe
Size

18.4MB
MD5

a2223005e6d186689577e5a2b785a16b
SHA1

1075e177247880d3e1ec940623500bf2e9b275e3
SHA256

cef5b60321f17991400a19072052535638c0a5c02d338234686552deadeea82e
SHA512

073f8e682d2468bfe7d55b82cf0ff5dafd2754da2813de2116551e2811809debba7f06c5d8ed5901a59703bfb306fd5fd05d9d1e797bf9e7887826709c6993c6
SSDEEP

393216:cKRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:/ANWKRrpYrNvou7NK3uU6E29dPL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe
2236	x6z.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1804	OpenWith.exe
4648	OpenWith.exe
2348	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	firefox.exe
Token: SeDebugPrivilege	3996	firefox.exe
Token: SeDebugPrivilege	3996	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3996	firefox.exe
3996	firefox.exe
3996	firefox.exe
3996	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3996	firefox.exe
3996	firefox.exe
3996	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
1804	OpenWith.exe
3272	AcroRd32.exe
3272	AcroRd32.exe
3272	AcroRd32.exe
3272	AcroRd32.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3272	1804	OpenWith.exe	80
PID 1804 wrote to memory of 3272	1804	OpenWith.exe	80
PID 1804 wrote to memory of 3272	1804	OpenWith.exe	80
PID 3272 wrote to memory of 2304	3272	AcroRd32.exe	82
PID 3272 wrote to memory of 2304	3272	AcroRd32.exe	82
PID 3272 wrote to memory of 2304	3272	AcroRd32.exe	82
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 3784	2304	RdrCEF.exe	83
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84
PID 2304 wrote to memory of 2440	2304	RdrCEF.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\x6z.exe
"C:\Users\Admin\AppData\Local\Temp\x6z.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\slinky_library.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2541821C95EEFB58618D52783B1A97FC --mojo-platform-channel-handle=1600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=562233AA1E6285598B96FC309D3D66B2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=562233AA1E6285598B96FC309D3D66B2 --renderer-client-id=2 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A51801184B1FEF028E017CAABA295467 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1788
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=26950F4C5EEDC18CB40378A7F399C895 --mojo-platform-channel-handle=1604 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F795B504FE269D9876969E10A190C621 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2348
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\slinky_library.dll"
  2⤵
  PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\slinky_library.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.0.875248263\1684651111" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb128f96-01a2-42be-a5d2-f809f3b513f6} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 1780 1e0553d4b58 gpu
      4⤵
      PID:3060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.1.208125509\2126853424" -parentBuildID 20221007134813 -prefsHandle 2128 -prefMapHandle 2124 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9419db4-7446-417b-9571-78326cfa982c} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 2156 1e04a273b58 socket
      4⤵
      Checks processor information in registry
      PID:3620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.2.2062811681\691764063" -childID 1 -isForBrowser -prefsHandle 3124 -prefMapHandle 2752 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ba52fc1-d745-4cfa-9d74-5cda34a438e3} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 2732 1e05535ab58 tab
      4⤵
      PID:4484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.3.1449337507\1358769044" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3500 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99f20f88-618c-4a95-8bc3-d72f6553f598} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 3516 1e05a419958 tab
      4⤵
      PID:792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.4.324697139\1487321288" -childID 3 -isForBrowser -prefsHandle 4932 -prefMapHandle 4804 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c00c61da-2762-4602-a045-a2409fe60f59} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 4944 1e04a26d758 tab
      4⤵
      PID:4516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.5.1806064916\1351485107" -childID 4 -isForBrowser -prefsHandle 5100 -prefMapHandle 5104 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3d3a388-83c1-4f51-b88e-df635dde21fa} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 5088 1e05bddff58 tab
      4⤵
      PID:428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.6.1340063900\835623775" -childID 5 -isForBrowser -prefsHandle 5280 -prefMapHandle 5284 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1028d68f-c538-4f07-96bc-f763b37c6f7f} 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 5268 1e05bddfc58 tab
      4⤵
      PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\slinky_library.dll

Filesize
18.1MB

MD5
44b5e89a9f7bab889a4df60042872f17

SHA1
cfc40cd4fdbda75d3ed52952c500d8ccc12f4a36

SHA256
16745ae6670eba8a452a5e75fa6142564d31bd3b7d14766e04f1acb214f65703

SHA512
7f18545da3e4fa726ec33345f7dc137eedf4961a1bd0582b51ee2258a6d5a115187a4e72ec3c7b6d29e33b0a4aa2560adec1833b4bda3f00a7b194ea71d95188

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
248f5989b1ae4e351b9a6f723620f407

SHA1
0503b05e22a039b36a0de05e21fb0430401416ab

SHA256
34307cd4a2024cd0c18e184981f855d4e025070f4ec83c252e693d3a0279c9e9

SHA512
062a3c032630c8acfa338ba8ed87b09879f2e052f72fa396018170f3e0fb1d010e97488f0213ac5cb6fa9aac281560225696c8b5095791356de1c7ff58b1b3b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\3df97ffb-38ec-451c-ae88-6ce9438af7e7

Filesize
11KB

MD5
9fdb05967154eae3bad2af297b2486e8

SHA1
f30fe7e3048d9adc3275d5146817bb8fa1303807

SHA256
71a729d41848297aa3b3d00b4c96853b4d913483eb2f829e16359f529aaf424c

SHA512
882836dd96d0ae0cec6f355be99a488dbc227a287755f88191747a5499d4c6518c274c83838037e62911c3205f52a053bb181456d71c85c99a44c786028b9843

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\61131df3-cb31-4350-9414-422f0ac9bc2d

Filesize
746B

MD5
916d69c0a9fb23f40f27ba0e2eed993b

SHA1
5549c655fa8629bc99153d3b665cf38700271b5f

SHA256
0787897c6004e907fab23f070df063f9f38b0609ed591911ee1e0dad7f4fc67d

SHA512
b11c1a8730ad007ea52fda3c4bd8cdd112ac3263a7d803b0be4cecb16ef7dca741378bdbc8584d2f54654f7632cf205df1ebfaa98ccc29db97f03801ed57046f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
01be1ce2751c3a19732830fce2a7c08e

SHA1
642c396c19ed8a7af01e08651156599aa3742106

SHA256
7d8381bd91e54cb405072925c14d69cea248b43b5a332c437b654f576ae0b6ae

SHA512
38be0b3aec00e9004c616b0059e5fb21a845a7c104b4018ae0de8ca049a8bc44576d2ef6915168ebda24277e77a868ab38da0f82b7b864d2a008f8ebce5ba10f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
d0d025ddde52d9f0b15b4e81655d3f2d

SHA1
bfa9bb8290caed29f853a84a17932cd19b0362ba

SHA256
1cd9328e27385d00dd111fc3d65a21901bc40fef1b79bd4a0808557a4038c0a6

SHA512
75415af9d6c9314bca07a8d94ff5a6c37d96ce75bc3fb691e754b51ee3d2c696808804ce77a9110499fd10bc9b49b0b8ceba544abb53f7109458ea109c640d08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4

Filesize
629B

MD5
6b44adc7b4c6971272fe94c48e134418

SHA1
720397945ceed3833723b14e166ee4d252957c5b

SHA256
9c4cce4480c5bd65901f92dad530190f890bd626d3e0efabd3086a33a13e3a82

SHA512
12a858ededc140809e4d141c7a04a1b7d8fc59c18c729161789b3cdf611269b8bea9563fbdebfbf90ec2b77525e0d8098c44fe04d9f98554efd5b65ef628e1d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
3018d1aad8385b734068dbad441e344e

SHA1
2a3925bc92ec843db64b6db2cd6fe18ccf084a86

SHA256
f33415b0b1fc8c7e52356318d44aef1ae6bd9c64a89afa012d43a01a79954f88

SHA512
7ab1a1115a4f7ac61ba41bfe5875792cfa84d81f14f71239e43848de5940bfa07e2e34ea4be85a61c091d0b4b7742f3f55961fd26734b528cdb2c0b4d169c5e0

Download Submit