49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178

max time kernel
99s
max time network
100s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-08-2024 19:59

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Screenshot 2024-08-28 at 14.57.55.png
Size

419KB
MD5

00345903f4db4bb2c44099a766cbadb0
SHA1

9fba40eb3a9ffb65b24c98e47d36d99b56fe588c
SHA256

49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178
SHA512

efb23c5a838b2407d9b5544dd864734dbb8c892c445cca6f3e41ad8a77ce73e9f85fc6be960981de840aed20b4190f322742d40dbc4ddaa1de8e2b4d6876984f
SSDEEP

12288:m0EHCJmoNmRxMquJhItGXNBd/GyUtlsUVhVg:mviJ3OM3nH4yUt19g

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5264	[email protected]

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001ab74-1156.dat	upx
behavioral1/memory/5264-1157-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/5264-1237-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\2503326475_del = "cmd /c del \"C:\\Users\\Admin\\Downloads\\Virus\\[email protected]\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\2503326475 = "C:\\Users\\Admin\\2503326475\\2503326475.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
191	raw.githubusercontent.com
192	raw.githubusercontent.com
193	raw.githubusercontent.com
194	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\HMBlocker.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeDebugPrivilege	4720	firefox.exe
Token: SeRestorePrivilege	5212	7zG.exe
Token: 35	5212	7zG.exe
Token: SeSecurityPrivilege	5212	7zG.exe
Token: SeSecurityPrivilege	5212	7zG.exe
Token: SeShutdownPrivilege	5344	shutdown.exe
Token: SeRemoteShutdownPrivilege	5344	shutdown.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
5212	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
4720	firefox.exe
5588	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 520 wrote to memory of 4720	520	firefox.exe	77
PID 4720 wrote to memory of 4620	4720	firefox.exe	78
PID 4720 wrote to memory of 4620	4720	firefox.exe	78
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 1776	4720	firefox.exe	79
PID 4720 wrote to memory of 2556	4720	firefox.exe	80
PID 4720 wrote to memory of 2556	4720	firefox.exe	80
PID 4720 wrote to memory of 2556	4720	firefox.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-08-28 at 14.57.55.png"
1⤵
PID:5068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.0.1790599894\1303476281" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db846c68-d551-4325-a58d-21d389f85b19} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 1840 2a841cdbd58 gpu
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.1.1687956983\696944695" -parentBuildID 20221007134813 -prefsHandle 2184 -prefMapHandle 2180 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417fc6f9-5665-43b6-bf54-4bba0bbe9503} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 2196 2a82f5e5158 socket
    3⤵
    PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.2.1379098704\497014208" -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 2712 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d1fbffe-477f-447f-a111-0b0839fc18b0} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 2704 2a845a9c458 tab
    3⤵
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.3.1693085217\1588551367" -childID 2 -isForBrowser -prefsHandle 3392 -prefMapHandle 3388 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cc12573-67fc-4854-a06e-ae558ac527be} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 3404 2a82f562558 tab
    3⤵
    PID:2552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.4.1198080903\87985143" -childID 3 -isForBrowser -prefsHandle 4072 -prefMapHandle 4088 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92208a4a-50c9-4468-9534-f4cbb3591d96} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4024 2a8469eb458 tab
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.5.1713289522\394247317" -childID 4 -isForBrowser -prefsHandle 4908 -prefMapHandle 4892 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d2ada9d-2345-409c-9ad8-903de884df53} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4932 2a8469eb158 tab
    3⤵
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.6.758965841\1713140370" -childID 5 -isForBrowser -prefsHandle 5052 -prefMapHandle 5056 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b4773b6-8911-473d-a5c1-9a3f0931e84e} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5044 2a847fd3258 tab
    3⤵
    PID:820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.7.1045524043\1375177631" -childID 6 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4d1df0e-b5d3-4dd7-8f39-85ccf018a0d1} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5224 2a8485dcf58 tab
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.8.1536271250\1849089307" -childID 7 -isForBrowser -prefsHandle 5284 -prefMapHandle 5080 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e1692ab-6a31-44ce-a8d0-3dca60a12ad5} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 4908 2a8492ac758 tab
    3⤵
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.9.1157372306\1646446194" -childID 8 -isForBrowser -prefsHandle 5172 -prefMapHandle 5188 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e82627a5-fdf4-4eba-9d5d-e6417bea6901} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5160 2a8485f9858 tab
    3⤵
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.10.837243074\1385419379" -childID 9 -isForBrowser -prefsHandle 5404 -prefMapHandle 5408 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ec22380-929f-43a6-8a32-198b5f417452} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 5248 2a8485f9b58 tab
    3⤵
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.11.888491867\252664305" -childID 10 -isForBrowser -prefsHandle 9576 -prefMapHandle 9572 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a652a086-bf7e-40c4-8389-5df9385d77c2} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 9728 2a84a692c58 tab
    3⤵
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4720.12.27891792\1614624410" -childID 11 -isForBrowser -prefsHandle 9684 -prefMapHandle 9836 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2bd3a01-1ed3-43c6-bb05-85d16cceab75} 4720 "\\.\pipe\gecko-crash-server-pipe.4720" 9700 2a84a51a758 tab
    3⤵
    PID:5304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5116

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap18533:92:7zEvent18366
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5212

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5264
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 6 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5368
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\Virus\[email protected]\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5412
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\Virus\[email protected]\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5380

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aef855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\1982

Filesize
58KB

MD5
795cc807d1eff434472ec4dd8607733a

SHA1
e4e697505abbc761538d72ed74eaa50d9b972d6e

SHA256
db32f82bd8e86dc074e37477c5f3a75c1009368fa82132bdf8288d568d9ca993

SHA512
b550038232a443be5b196a2d72df179c4f6bcba52c601adbdf884c5356a854760f55bacc47ca3607744b5a758dd441f296cee4c27185dca835b590bba528ae06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\0A73C6E23F02820E5C7F05AD9890531BF91D87DB

Filesize
111KB

MD5
569086b5749aa5f515a6961a52364e7d

SHA1
183c7cd2a9f5a2cb06d3038ac82e743a25b72316

SHA256
9de07e1dd4c1d8bd83298820a5a61cd23d1d0e16d44e388771a78d4efae25a58

SHA512
43b20064bfc1531342eeacee115a839f334ce48b18d19d6891ac80b8c462357930de7a609be7becc6bf31dd083d717946b79a2cb64115e066c89462c77f0462c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4

Filesize
1.1MB

MD5
06c6b86830d76f06f30a1ae6b339a5d8

SHA1
62ca9cac70b549bb9af9423d5460ba06d772d11d

SHA256
7fa11a59dfbca4261c3097b1b87988d178f87ec946991906e497c7a613f6c4af

SHA512
2cf5fe482b05299c6473d89e6cea79bf5e7f3ae937d009f6d277f33e47e1989e5e58bf433c6629ddee6c79218435ab354bb7d8aa2006ab328f5a8bc95c388cf3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\4BCF7D608B2663D7D1515223C0F13E5D72484770

Filesize
14KB

MD5
a062bee16406a597a41764776488320d

SHA1
84007afbee8918f8d989a4dc85c1dd14838c63fd

SHA256
c197dbcd0cf2b2c956936f39b16f5c064a9f8794c6485cf2d8413d9467b82fa6

SHA512
d93b4189109d7d8456570cc475edb69d539da7a44df5d9993cdd2e0ff2a9a5688364049179915945a478e1ddb13f0cdc9274b3653509637f9957ec6dd56c24ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\53C8C46F04350B64D691DB4860BD34DEDDBDBB16

Filesize
97KB

MD5
e55f27834844e34f670e49a95719a396

SHA1
16a1d0690e1d159944f360b6574aee57e81a6b83

SHA256
a407aecbb2bcfbd3c07f38d3ae8e9bd74a8b27eae516081ae5ef3a189756ffde

SHA512
4727f781395cdc2abc91eb8a124264ea29f5e3e2874c965f679ae1239828a5bd985fa1ba9ec51cb80006a43ae21f402c7819522d80fa4c52fa31f3f5a8e54910

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\7F30F53457983F11F2D61636C9FB5706ED9AB60D

Filesize
16KB

MD5
afc571141c8a94e499616136d5631a08

SHA1
e393e6b3c2fa1fa08603879f1e432c23005a92bf

SHA256
0198612b553b9fe0da0270c86062c989ba191c95db7ed81bae6aff2c0f51c3a1

SHA512
2368e3ecfb80f9ae750450035ca2ebafaf9440fd13c10b9d51986cc7c4a002fb79b1e12784f3662cd1ccf815a803018e63f036a976ed0f790657d8503dc55bd5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6

Filesize
2.0MB

MD5
619c7557facc1947e8755b46a9d06626

SHA1
480bec269f33a745e2d105c17b5571ce4d0d04ca

SHA256
c011c663b12f20ac9b7051f716723e39e7e80176c4d1a4e2dc3011153ac4c5a8

SHA512
416249221c84dd04413647ffa796b1922360ac1beb59fe5ada9d892a9b32a4606c1926795c2afde9842da7ae1bd472c018e1fe43975686ec8fa0e7fd36813e9d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\98AF737DD946CA3B37F8CD63EC1E1756F57F2E19

Filesize
68KB

MD5
f1c9924c86104454a063bef200b6ba19

SHA1
f44e612823c1e491216033d7cb29962442ddc114

SHA256
f1adcce6cab54fd81f894e6178db45823bb0f08aac9a3128cef5bfa217b4c5f0

SHA512
d538529874587c0c989cc5758e5ff225cbbf4d499e18a57e54536b4fa95ab8cc92ce218730dad9136fc53545c4dba1af3a94b01440e48283a4e4b88c07073239

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Filesize
14KB

MD5
6f585bdc61c17cb3940277c414e5af4a

SHA1
eb3efbdda7869a6026be48f7d423e69aca29f122

SHA256
d431143cb8db8bbf65fff4dd6b548154fbe746e9ddd0ae6a1c853ee868a02daf

SHA512
53e4848be0424bd21ced35c6dc30cd2fff0c9d920de8866942f329456478ef0723b9990990034c445ef3b5fe30d0d8a352574ba52719fdf1187a54a781dda6b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\F5A1FBDEF4E6F115791D6C8EF1598942067B8080

Filesize
14KB

MD5
4655d8eb202215a52f79ede026199cab

SHA1
e7478fe8e8ef6369c841d33c7a14f1220a0e76af

SHA256
d755dded63910e360c547f4c8d2790a551b8747bce7fa1212b7dc3e3cea22154

SHA512
93bd5c5481d6ab7b116913bdd99a17a969e9373eeba78db2e53caee82ce3f588c31701dd345cf756cea13ec089dd3333d60cf2e58fcd814111b8f87c7206ac9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\FF405EA908A0CDBF948198368567C7EC073C7A02

Filesize
18KB

MD5
74aee06c8da37f87246eadbe165bd13d

SHA1
75b3eeea10f54756183ac67d377aafdac03a018f

SHA256
a742a14044c72171a60ede9075548ef85ae0d8a9c7fe2753de00546bb408510b

SHA512
d79f0bbd41201cab285b324b99adb07620d3aaee52c3cec1253ba8bcc6a422215f54764c15e96d27e35d79a276ce1cc56b1d36bec877fd84af40cc551892c434

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
5fadc17acf0209d0f89e116fbf0c759b

SHA1
7eed068402d15e76d258f6dc4024bc52017ec582

SHA256
386394cfc54d837b86381a045b8534444b6256b64620c6bb608df989fd5808df

SHA512
20ec7dad59aa07d647a417db0b3194eb329bdaff95617c056edd672f3f6015f04c9093c70e4eae1635cd0778a0f461aeefeb46e78eaaf2963a2788cff5da3f7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\209ad863-629d-4e10-8c20-e73fc4f64389

Filesize
746B

MD5
f18f4e04ac687bf2f6d7bd71d2db9337

SHA1
198e3fe47b7c0e855faf5ab40c3150c52cc40f69

SHA256
2c1bb9310c7095433d3097e7d5d3b1164f3e899312ba783ecc058470bf41c3f2

SHA512
97d4892b1942829257bfefa5cb776684e640a9362f059c93bef167c0b10bbb54d95e0627bdfa94154536ca19c150d1dde2c6be3db0f2853a074a8ab575d718c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\cc0cf69b-1391-47f2-b778-56d995e78f5f

Filesize
10KB

MD5
1f20e53eb7837040001c46a157cb6221

SHA1
bd02b04c6368fbc3536754b3164aea44a94fe765

SHA256
a61851455853780e849f86074e11530c591f3ec8701a6194844f19343ecaf784

SHA512
c526c0807dfdc7ad15e7988d9b90708c79d3feeba84aeaf0c3a4dbff7b44f2fae7529d07f3d14300b75851e75eda211a421c36b34d79322feb83d80a611dee39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
20bcdc720cff9e939d0485719e5a6ea1

SHA1
ccb8c3b030763523387c3867410534aa68ff6be4

SHA256
2c2eebe8530474ae1b8bf4c3fd59956013a0820efcfbc85fd01760351e100a99

SHA512
b34ce1ebbfc2eef5c5310cdd05bd01fd6220842f47be791a5cdd36c1a9986ea2824269f2c72ba5a182dd4f02b8bcb478913cd93008afe7d6c248670ea97ea474

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js

Filesize
6KB

MD5
b163148e7810712ba01ab06fdbff1e36

SHA1
9dc384d99e53c17897c2e564b11e0e5f64acddfb

SHA256
0092948e23b25390449431005377f36a38c6aa4162cdfb398e93e96eec67e9a8

SHA512
cce1a9a6fd4c019545c3cc9835fe5606dfb2220a5f7bbb3baab14e37fe3290d35020b3c814b87ec064fe45a64237ad652c3c9a0a6b0aa6088d8683c1336fe5b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
db2c5062ca331e9e46749f18884e7722

SHA1
164201565c561bb10ba55fc8cd769f1464666264

SHA256
9690678bbd0f7d9f6302ab75f87c09f5b087d38023347cb581ecc54dc3044090

SHA512
a86b0db443407110961572385d6042a9643bef36895f618194abf743b1f4e60341c616e1a0c743a12040f318034e79584954d0224bd866a39bcb32041f53cbbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
2d1070900c444caeb787198100160eeb

SHA1
a51a17736f66d00982bd4a2df16641285dfda16a

SHA256
8beb49a77d5f867a115cbcdd47a20f8c75081d04870e17df4ffde295cf773c5c

SHA512
a75bcb2ecadb86a529a11c81668b4fb3a47aa85efb331ac18c276d5baf536000ddb94d032a7d4bd94aed0bcc6cbfb124ff10eb7ff96e10ffb52c2def58829415

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
caf396f9a0efc0301d4c70b9a40aae2b

SHA1
bc69cb98820774d3796bffc7c6e506bea63e8f16

SHA256
d8749b9ff9c4c883d8102c2f2dc53ff537f55de0f2a07ebf58e9cb0a2207d367

SHA512
35144312103d04e7046891bc786dc2e2fe19ca4c0b8eb955fc165f9af7132d2b74543978adc4d34039ad73cf1a1e004b63ef0ca3f1b974ade089cd83c10dc443

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
30ef076f2dc96decad25ecf6fe7acabd

SHA1
c938425edd27ed87d4a58ace11f680b01dae0dda

SHA256
b062acd8f8bded31cf0ec6e57dac4a8b216e46518ad71d5674d5de9ff4d54c1f

SHA512
3aebde51ce490883f08ee6fe52fb1d9c3d218d67ce233c24c5b6d0ae851b7d490b7c48edc21286bf28954211a1b651f2550c32f09ff2cfc3a1a534ccb954167a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore.jsonlz4

Filesize
9KB

MD5
4dddd799bb4408f497b1dc631863e1da

SHA1
9dbe2d545fc7fa92a53a94aed92b9e1212e3dda0

SHA256
77ca750d702b2a55230bdaf833aab6f8c865b9b0cb0ee0aed94768f78be992ef

SHA512
2b57906a9a71cc676e7b2ae99b34aed7a9d6f91322f75fa3e6e557d409e99b50a28a31b4602e57dfb827f9045798a5835dc8a90db8758e1f0891f77b6fec646d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0d0013d9708d9fef539adc917f5b87f6

SHA1
5e071e6b4d8abf007c8bb78ee948caf5bb0439e1

SHA256
f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b

SHA512
851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388

Download Submit
C:\Users\Admin\Downloads\Virus\[email protected]

Filesize
48KB

MD5
21943d72b0f4c2b42f242ac2d3de784c

SHA1
c887b9d92c026a69217ca550568909609eec1c39

SHA256
2d047b0a46be4da59d375f71cfbd578ce1fbf77955d0bb149f6be5b9e4552180

SHA512
04c9fa8358944d01b5fd0b6d5da2669df4c54fe79c58e7987c16bea56c114394173b6e8a6ac54cd4acd081fcbc66103ea6514c616363ba8d212db13b301034d8

Download Submit
C:\Users\Admin\Downloads\yfDV0JQ0.zip.part

Filesize
38KB

MD5
5968e8a8caa61b46ba347f8c521c1f2e

SHA1
88f9a7ce6e77d191c9a57ecf238ef5e9e9ba6c7c

SHA256
a181f8925c8c66614be38de89e6dc38cf85715379a10de8d9f9d70b04891ca35

SHA512
6b0659ff7a5548cd1b752a72a70b147d1c9676dce14148430961a7b5204d4e3a42de5530d423ebb879f8e5c72785a45e5b20bd40cbf93cfaefe981534e96cbe3

Download Submit
memory/5264-1157-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5264-1161-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/5264-1160-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/5264-1159-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/5264-1237-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads