92d52f19422a72074e143ba1c426e81e684d5530aec205086ebecb05f7f32e62

Analysis

max time kernel
277s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

message_v2.rpmsg
Size

46KB
MD5

c1f7780d02951474c76efecc0811abe1
SHA1

97dc6a29305ebf4361e14c4de0d067569d174325
SHA256

beba6d5315b1a4a21d9a58eac46ae5be402e6c10193313ac4c00366ffefe5a34
SHA512

d0a30813983cdecc8e9acf8142c6151e7882e329dccc9cf75c1ac729cb58a6f953e14da198ab35dd89296cf5f221c3612d8c62fd7fdd13946f73fffe8f6e9bb7
SSDEEP

768:HyfRvLOtFpmtqa9WEUwqfHKlxt759YkGgLEN8HLxeeIG21927iU521tNNTXhd:SZqtFpmtWw42X759BGWEyHLxeeZpiO2r

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5448	1984	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\䆟縀䆁	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\䆟縀䆁\ = "rpmsg_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\rpmsg_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\rpmsg_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\rpmsg_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\.rpmsg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\.rpmsg\ = "rpmsg_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\rpmsg_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\rpmsg_auto_file\shell\open\command	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3548	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeShutdownPrivilege	1984	wmplayer.exe
Token: SeCreatePagefilePrivilege	1984	wmplayer.exe
Token: SeShutdownPrivilege	5032	unregmp2.exe
Token: SeCreatePagefilePrivilege	5032	unregmp2.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1984	wmplayer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe

Suspicious use of SetWindowsHookEx 51 IoCs

pid	Process
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
3548	OpenWith.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3924	3548	OpenWith.exe	95
PID 3548 wrote to memory of 3924	3548	OpenWith.exe	95
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 3924 wrote to memory of 1556	3924	firefox.exe	97
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 3816	1556	firefox.exe	98
PID 1556 wrote to memory of 536	1556	firefox.exe	100
PID 1556 wrote to memory of 536	1556	firefox.exe	100
PID 1556 wrote to memory of 536	1556	firefox.exe	100
PID 1556 wrote to memory of 536	1556	firefox.exe	100
PID 1556 wrote to memory of 536	1556	firefox.exe	100
PID 1556 wrote to memory of 536	1556	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\message_v2.rpmsg
1⤵
- Modifies registry class
PID:2912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\message_v2.rpmsg"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\message_v2.rpmsg
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5ea41c2-5636-469e-8d11-3a872bb3c5bc} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" gpu
      4⤵
      PID:3816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b180dfc-2802-432c-9d80-ceb6dc292723} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" socket
      4⤵
      PID:536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3000 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 1672 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67aea40e-c53f-4fe3-bb81-950cef83cf76} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
      4⤵
      PID:2420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3868 -childID 2 -isForBrowser -prefsHandle 3940 -prefMapHandle 3936 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c962975-c88f-4da3-a3d3-2fa5d82877ce} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
      4⤵
      PID:1620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5040 -prefMapHandle 5056 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83287eed-cb98-41bd-9970-3ea212e8e986} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" utility
      4⤵
      Checks processor information in registry
      PID:4468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5236 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1372be76-918b-4bfe-a758-52fd93114222} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
      4⤵
      PID:5736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9314aeb-817f-44c5-bb04-56135b2f06d7} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
      4⤵
      PID:5768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5624 -childID 5 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {437c2785-f667-425c-b344-0f5ad40e1676} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
      4⤵
      PID:5792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\message_v2.rpmsg"
1⤵
PID:2828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\message_v2.rpmsg
  2⤵
  - Checks processor information in registry
  PID:5104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\message_v2.rpmsg"
1⤵
PID:5280
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\message_v2.rpmsg
  2⤵
  - Checks processor information in registry
  PID:5308

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" C:\Users\Admin\Downloads\message_v2.rpmsg
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1984
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4912
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 2248
  2⤵
  - Program crash
  PID:5448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1984 -ip 1984
1⤵
PID:5416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
640KB

MD5
8b3fde69799dc511c47f39096e73b8d1

SHA1
182628157be71900799bf340a381c9b06890906b

SHA256
62bb7bad7788a524e3de2a25152936703cc6bbc6c173201ef6e872376de30d50

SHA512
302c562e71dec507c9df318af29d8ee4e6bfc39e1c44c16e5c0d740e7de31620eec89e3176c001c0fe60948a44fe4133cbcf123fc2f88805389be6a270aa7c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
780c8526e96c0676c2679026d0c2a1bc

SHA1
60ce26f4788f468e07634fcc8e91f73295aba0ea

SHA256
1e156d88d3ef3f230314085f0e4685aecfce81a9675575a689fd37e1090371ab

SHA512
b701652edd44f3cc97937fd4efe627f7ea375d7ed2011a81fec07ce0cc8f13a7a9fa7b12d7ce08c3bfc19f2bbf2d9d89555a0956d3a1eb5ddb58dfd9c083f394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json

Filesize
20KB

MD5
62c2729ad906159c468d09bc6315ea05

SHA1
f650ddcd835b5415839261aa48b2fd7843705a2d

SHA256
baf3fdc49ed893b3a1d5259cbe35aa3aafb12ff8eca52c386c347fbd4ecbabf3

SHA512
60ef3378bfd5adc93cac43b1fce7ce584c19fca110c86c692dac7e54655ddceda9c0d0abf1110bf0cfc24184d95e31a4858af155e485f64ac327f0744e0f7463

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
9c17b771162452ccdc924ca14ca399ab

SHA1
0ff53ec16c9180fe813649779c50e16265cd7fbd

SHA256
53b27e4827fa6b524cf470141784944d64374fcb15886e00674fdd072dbf41b5

SHA512
4d1bab6e2aa057962c7b32ccba1d983ac9b1b772096e0072bc205019c96373ab3d38513f397ca7b4114925b99534c2d682bae998b1e671c567bf4efa5051c97f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QPQFVZSG31JCIK9UQWFL.temp

Filesize
7KB

MD5
c8e71314c1a6e8ea1ec95b9ace3f3aad

SHA1
72c248abf2cd8ca3fbd168a41775c5c027a9ba12

SHA256
0838d6cc2a03b763afb00e8317ef7d3a3bb7654ffea892d6f1e10dffe2f33223

SHA512
58674bf72b808275688e9d48c214ea7d6551b5b165c59f0e33df6c9bb2d4ada145c06f46d17f5eef3c7d9f376ac59d7ea25ac6694c47724c368f791368cd81ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

Filesize
6KB

MD5
dad5040d52c3d7aa52533aa8a566cc18

SHA1
0cd5788239b81b0faacd867892585e73587932f5

SHA256
3dea42d7a52fb005c2158b8b5ecf124cfbb2d8c518e944128d65a9daccf0b80b

SHA512
3a6a00b6032e5a613f8238fa8cd6943c6768c8a39da8906998f6a807c8b45bed2003ec33247839024bc1018053bd59750db5d99020dc519be54b9bc1cebeb9dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

Filesize
8KB

MD5
fb45ae2dd1f0d2064e4c54b0d528ae36

SHA1
383410bacd8c77824cdc0d0a22019d06b4b579b0

SHA256
45feeeef70c2f3f8dac221167fea535eaeaa4b8699c99df34dec08c0c60987d9

SHA512
10c037937aa7414e449730b43b42b6b448c410e7ef54501615347ee2e15564ff5bc67c8491ef892985d3462c1edf31e780602b60d5e7fe4382354c0e9808ced8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

Filesize
6KB

MD5
cdacf2ff0cd9fad3d6ef591d1d374bab

SHA1
dcaeaf77bf8fb2e70cfa6a3d4b09eca5786526f7

SHA256
9dbda357796ccf10230fd21f01d768a89d7f7a738ccac0610e33ea60b236d007

SHA512
25b37b5a3b1f5a7109ecb9d9febd35d2d42bfe01a002452ee6cb823431e7f766569a0c7779691668fa8ea6b2d9cc808c1086859fcf74810491204165947a6a48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
5aaf55af5c91e6d7a0032847c3115b8a

SHA1
59d8eab93c7838178d1cd0f47757b7b15fd356c7

SHA256
d5bce263050a0b05d06947080c4c6a33f015fd32fdf4f47e8bc6a729299431a7

SHA512
804daf0a7aff9c694bab087d4c6274204c83ecc2a410ede7b24142c827eb6328867254abb28b8e05228b1c8b1e2c07f31e92990b9672aeb9ab382b8f62108030

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
19e9174ce85cdd4cd3032c3f90f82d45

SHA1
a3bc833f3d3f6291d062a49fe5b06552a4d3e0ed

SHA256
ff3842ed163263c2e3fe5860d0431e0865714a0924ab3b08fb6fd7166f28b06b

SHA512
6fe0595e7efb10562fd7b0ffe42c5887e06e29db608c5ffff832ef6d1bcbcd936f9acef6e083c5d2bc00917929ad07e763672c44b1cc46e7fc276db2350cc976

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
2140c1675d41acbc850bfe440200836f

SHA1
d8e46a1241324cbbb26dd117c59b0878603c4210

SHA256
43bf093dd523d743733854f6aefa3a7f590e105e7dd27d374005bfee1fd1c7ea

SHA512
70a0be73183a78b5e25bdddf5864e59afa3eceb814d00120da8cff36df46becb962b77157fb1ff5c681be80780038ed26d3a252d13b42165a7047d66737821ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\81e21897-fd95-4bcd-9e92-ad4ec2b0a0ea

Filesize
671B

MD5
65442f1fdedb362654371aa7a075879c

SHA1
a614e86f186886869327186d827278e76379002f

SHA256
6b915d1dee800075586826fbeac91ba80deb3d0865289449f98e486cea902072

SHA512
b3d1db06505a2fa7d01b2855adfb62a8540802c8d53792a92326dad8d345ba4e35811134b511123210a9087735b02a1f05c7584f43321c18dd25ba0701b79230

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\96747984-3d28-4fa5-aabb-1075c6c49188

Filesize
26KB

MD5
0f35b4ca9358ff2e9fd01ae74fcbf3d4

SHA1
53ea9d22b296c5cee3ab25bc645a7af750cd7e3b

SHA256
19b9b54447e2d8de653f5ba7a97acf7f539a2bc5a4c2a0c71146fd8f877860d8

SHA512
73fe6cb368b4b9aa2a57d9f2e493602dd6cf1da79439941f6f3b4e9a8a9d10286194985a884429e3e1f1884ee97a9329e65d4161f9409af5ee11348fe5d619eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\b0eced65-d93a-4296-8f81-404832d31533

Filesize
982B

MD5
58878e5ecca5b8928abc186592c8c207

SHA1
cb30471e56168dbf1708dc270dd139c19971c88e

SHA256
ba6d3f160319c4390741bbc3c7f718319021873010fe0c27f92784c72a164800

SHA512
4a876e21659db35d2e98d6f99540b6c0d40e9d69b249882d65a3ae65c7c2dddc6e25653afb048b80f3d4bd73da305ae1b2e3aa9b891c2b1c201170e1700a807a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

Filesize
12KB

MD5
0dd07ec875d518da7a2f5b4dbbdeff74

SHA1
0615100094dbf561b176f1bd446b7058a6c01f57

SHA256
02cd834d287a6103ec6939d5d28efc2f0403967bf74f10a63c1c6b57b30b615b

SHA512
e52871c92e3bdbf3a20830b8736c62bfb517eaef046e54e4d275d5f844f58bb625e0881801f24fea6af912a89abf04882e3b066485b0ec5bca2e85e952978661

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

Filesize
11KB

MD5
055e97e05225f148cd065cfe5604e40d

SHA1
aa0e712b5d261778a82f9cccd8729dba9475acc0

SHA256
a2a882dcb841806add42121eb98ced5e58ae821f0f2cd3f3dff364f624404bb7

SHA512
992ddef6a871b1baac6c7ffc73039a257200af9d601ac064d229b2ab050a4291a82dc9756e2c4cab05eb93de3f34d7f293a7fe57eced18e44a79cd0fab50e3c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

Filesize
11KB

MD5
700ca0e6abe4eabe5a772f20f66ac6a4

SHA1
9d4652407cf7ac38921faf119f7fd42feba028fd

SHA256
13d758738fe6a6d5496c52e4dbad4c1369e7473cfc1815ba8bd948ea79f6aee1

SHA512
b5255d7f1d8785d8167e919dc9c28a2a24b1c915ccc4f5eb469ef20251e16dfd2242e290592facaa108dda8bfeb0f0ef573f48536800d435eaed194bb21de6c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

Filesize
10KB

MD5
68b65e31bf34d53245b59600a10be9f0

SHA1
1143d00ba8f064047b4c83dcb8f11efecf7592ab

SHA256
4a4b995bd4ffe90f8450dcb9710c5a71a5f5833015ab95fb3552ac397edcf3a9

SHA512
b153ed802767c59ee2b0e2da0cd21c098db9f6ff35d27b203f8b99cde921ae77e1299b7508143664b979c36783f2dfa6baa3d4cf55c1aa10b2dbfc6205de3def

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
1c369955c0a4991824024bd40214fc83

SHA1
26eba67148a0982c05e6f94d337622535547e0d7

SHA256
72d6a147ff9dbba905a4aee2bc3233b9e876d2c5a317f9ffbf32dcb57acd96cb

SHA512
b6b9667ecf9cf1e17de0a82505a9b0b4ea5f81b41f6566c3dc09c33a2318100cf9a20ec4319d9790df0789f3f5cda892e6c828a517ebd2c13dc908a9a8471ad1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
2583027401e3211c509b41f53217e80f

SHA1
475cc0f2b323ff94f48163970db6dbb27033e16a

SHA256
5c992dd134944fd0f4b3695344edb6ac633125303ce4bacf24566b69123f7b5a

SHA512
638e2c9f43f27f38f3ca29e60174806689dbaa2cc5f1883da30453d71fb53d9fd09dc086d2679a1021757e555e8d71af82d135c998dddd23affc654ac0ada1e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
838287a72db153fcd0822cb14aea9ef8

SHA1
17f8cca9e5cebb6fce66be1dd4f5fabb72ca3406

SHA256
8016fc1f13d115c4d8bead3cda7b763117f00e3a1c43085d960274ac85d6624b

SHA512
eaba0ea35f6ccf3e51c0c5d5efad958ab7019129b1b922f2be7b8dbca93adb5d041b523a918cc484262d3934a5a39ad936ab03f474bfba1a096ca546d2cffb5b

Download Submit
C:\Users\Admin\Downloads\bJONpqw7.rpmsg.part

Filesize
46KB

MD5
c1f7780d02951474c76efecc0811abe1

SHA1
97dc6a29305ebf4361e14c4de0d067569d174325

SHA256
beba6d5315b1a4a21d9a58eac46ae5be402e6c10193313ac4c00366ffefe5a34

SHA512
d0a30813983cdecc8e9acf8142c6151e7882e329dccc9cf75c1ac729cb58a6f953e14da198ab35dd89296cf5f221c3612d8c62fd7fdd13946f73fffe8f6e9bb7

Download Submit
memory/1984-497-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-496-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-495-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-500-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-499-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-498-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-492-0x0000000007F40000-0x0000000007F50000-memory.dmp

Filesize
64KB

Download
memory/1984-494-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download
memory/1984-493-0x000000000A140000-0x000000000A150000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads