hxxps://github[.]com/pankoza2-pl/salinewin[.]exe-Malware

Analysis

max time kernel
85s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
28-09-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/salinewin.exe-Malware

Score

8^/10

bootkit discovery evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
79	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5968	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\salinewin.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
2044	msedge.exe
2044	msedge.exe
1912	msedge.exe
1912	msedge.exe
1884	identity_helper.exe
1884	identity_helper.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	firefox.exe
Token: SeDebugPrivilege	1656	firefox.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe
1656	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1656	firefox.exe
3516	salinewin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1892	2044	msedge.exe	78
PID 2044 wrote to memory of 1892	2044	msedge.exe	78
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 3524	2044	msedge.exe	79
PID 2044 wrote to memory of 4784	2044	msedge.exe	80
PID 2044 wrote to memory of 4784	2044	msedge.exe	80
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81
PID 2044 wrote to memory of 3784	2044	msedge.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/salinewin.exe-Malware
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe57c13cb8,0x7ffe57c13cc8,0x7ffe57c13cd8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18424971355201598210,13573799821748813514,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddb7f047-a9de-4191-af8d-15b056d635ef} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" gpu
    3⤵
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2344 -parentBuildID 20240401114208 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a68fc12-e5bf-4ab2-a908-2304a8e3fb96} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" socket
    3⤵
    - Checks processor information in registry
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3220 -childID 1 -isForBrowser -prefsHandle 3212 -prefMapHandle 3208 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e49d2c0-1360-49b2-913e-9e74d4df5f59} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" tab
    3⤵
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3460 -childID 2 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30234491-fb2d-4c40-baf0-c5ee45f98f6d} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" tab
    3⤵
    PID:844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4808 -prefMapHandle 4840 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e089b397-15ad-4275-9eeb-3e5dde4b9021} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" utility
    3⤵
    - Checks processor information in registry
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 3 -isForBrowser -prefsHandle 5540 -prefMapHandle 5536 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0537858f-92b1-4984-9560-82572cfc52bb} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" tab
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5484 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df7d6328-e54f-4319-a104-f8ccc5c66ca1} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" tab
    3⤵
    PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5804 -prefMapHandle 5748 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c1dbfa-4155-4d87-87b4-2ef06a719fe4} 1656 "\\.\pipe\gecko-crash-server-pipe.1656" tab
    3⤵
    PID:2472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5700

C:\Users\Admin\Downloads\salinewin\salinewin.exe
"C:\Users\Admin\Downloads\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D4
1⤵
PID:5988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
115b82222231afbb7b047589572cde7f

SHA1
f1e07310aa7c511ee107f81c948ff0fc7f0d31dd

SHA256
e8afcfe0069745a18e4c2ab93b0fcefd5afd07a25104a5ecbcfbc238ccfc122a

SHA512
3c6936b374ac32edb05f8b507c53116760ecd4653f354d6118f420ee912e9c4d850ddb28997bf91e6cce334d427b3f7fdaf05cd59e9317b335ade148c2c4c8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2ab2813323b9fc053c71112b140a0d8b

SHA1
064a2262d8e06aa495d31f12289a88fee00bc223

SHA256
98d4c8451370963cfe0b164e99f37ca4094db16c48101fafe6385c5246f3dc4c

SHA512
860f0c6d0463f0b9cefd5d51da9e207f970dfa1fe6f9ab21cdb41afa28459fcea75904d90d3eaa35e039a7836565d45b6da7c5d76c329faf35601181de379da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
be85a012866f82533b134a3e7c03581c

SHA1
8f361377763dc0f643a3c2746149ca5850c5d8c0

SHA256
7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

SHA512
38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce7e4fd9e4589a56bc8dee8c5589e190

SHA1
0bb40088fe65dcc095e8622e6d0984e1ed7fea25

SHA256
24d14df5a7bb58628840a716e999fc0552bb66d87ae480f8855b9d9f81ea0622

SHA512
5105a45be7a522636bd645bb43c69c07cab00e242ca2b39f88014f097ee8b19598353e887ad7be71f96aca00023fe5423b3b06b73ebfc272bb058196a9d29384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64fade7660d6ab9ae081749a0b321cd5

SHA1
28896ac4657d97c9fb7de4969dd98d4d13605ad7

SHA256
b84152b1adad68bc6cee5ee511416405c96537bbb38d3d741ba45e402ee7907b

SHA512
45508a41c37de3969aeeebebb6f700bac9475153dbf9f00d32c3611c57b7e91c7cf7c931c4f5d9785564e0c4f70d8773c330392ca4cd147a02189598800cb7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
452fc97fdca849844f5dc0e7d1efc283

SHA1
073510f03d29f37833611c7ad456fb50d3a65808

SHA256
e0d99134b0ecb4b56631645b6ef00c5270d9f956d8c130e1dad5c2623eeb6eae

SHA512
5efde451c69fc26473284e3b5155b9c14ec19e7e413f95ec189702043162b6d4fb2581ece5048895bf56d5c1c22fdb4ad1f5b5b353cf8c998b1ed0f63f0ccf94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fce062bab811182be00641888dc76cdd

SHA1
373f020a5e82ec91d1273827316c46c5e5202ed8

SHA256
91975524d748bc2f28a730aeee128e339d528e31c073bc4a195203889398b7ff

SHA512
ec3bf2d5a815ea4ec7da02241eeab82512470d35a87fd409d6b76e15917b1a3c124b11930bed4c16f27ff42fe9f1f3e55c698093f7929b475eedcaddc1e40061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ad722676bb26437b40807f55d1edd71

SHA1
bde0eb8d8564d828df62b29fa9832e26ccfadd46

SHA256
16180bfb772a40df78e9cb45ce4792016a31619d5dcd63129cb7f5718ef776a2

SHA512
d5a6afe69d91cfbde0423963c0ff41a40a1d3eb78eef2a59498ec54c9295032cf637a94a042df77bff80e5ac7e3b26e9c3b259df86dacffd5085bb42b01e3297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583ed9.TMP

Filesize
864B

MD5
f9f3fa888f486bc038462e59e5d0b3d9

SHA1
89ca3eddf43db07a2a88414401d670131a8e0c83

SHA256
edd5857a42dc03f74d1f58b401b3216fff1ca944bfce343376f506965a828dce

SHA512
52ea59a63710cb527ef2774f3fc1752fb55e171381522056f9464c585d98a273a9ddeb1981148bccbfe0d32141bd3ee2a0442b955aba6aeb3253573dc7266120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6bd8f3c453ee7516ba73b03f731979ee

SHA1
309c91bdac04db6f99483629502d6daec35a5155

SHA256
e34f2277e42e976f72a56d4ee9440916b299afcdd8a284b0345cfd256765c976

SHA512
a7f194fb8a2c72ed2d5d04e15a487b3333cbbc310464352cd113ce58cec55ccac0ed51c819cbc07c1a4a6e7b2e63bc20853b40c2a3f91b8f36170c1e6da4ca2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c629b28fa8acc00d743bd746812d3a85

SHA1
a886b4dd9fba76899db463260a033a04c0e19865

SHA256
50b72889a568e83a14326a196209fd6d264d365f07c5e08400835fb1807ca16b

SHA512
6c35655b988fbd2d2ddfdfa9daba814c0c82081d4965759ee29110f8433b688dbe7d541541628190b79275c9c5b30403dcd45f4a92b311c3f1c3b32abdeeacb2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json

Filesize
30KB

MD5
9fc167e5cd0bb4b0dbacae1ce8d2b158

SHA1
2d8e0a7492cae248070e2da3e8f6c17509d6429a

SHA256
c601eccc79d43a8cbda16b4f76851a9730512b7412fc2948a38845ea37ad5d35

SHA512
e8cdead5696a6480901ddc0504458869c4cd9596108af1ba3cbf347d23fe9e3b0b8a9a99d1fa7c7573fdf2c2a7c85f0c098bd69ded2b7807efb76255290cc33b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin

Filesize
6KB

MD5
b022ac30c5aa29ef3ff2cd8ac1900bf6

SHA1
bbf246580585541035c95f4937b3fa80096b3ed9

SHA256
000d0b2dfeec53cec827c7b75357e91b706d8ee6488e678263a6ee8d59774b17

SHA512
bf4626faecf78aa58dc73f89e58dc1fb277d578f462ffccdc24ad90875232bd6d125a7bb5ce7d3a82aa20cf3b8222711c6fbbf066197e57d108d0d2c992cb71b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e7a783431e603a5100869a5c716b14a3

SHA1
4220a27bc30f22138ae10c694c9923c9ed2f0861

SHA256
3e8ad463238393fae14d4c9bce7976436fbddbb17968908c217eff8c3352ad65

SHA512
983d84531aa2fb034ced2a4d2ec5489d084ecddc59135101b3b9d864fde0148db8bbccc6f5707e942823cd07348c32ec5e58cff9d6b6ba86dad50c7557ab6e44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\40fda960-e1d5-4bf4-984f-a067d636c991

Filesize
982B

MD5
673fcc4b6ee44a30d2f092bf8d060ff5

SHA1
d1827b17945c97cf3a183c892fc556c56b10bd32

SHA256
5490a43fd5e955da724bc5c7101084a77f64e2b2cd1b426a5a553d42ecb98b48

SHA512
0f7ab8440f49291422a7dbfa90d85594ee7b4f0c36e608d8b6b024db8c521dc8c7dbfdfba612fa944373f5d1c6e5bbdcfc838c4ea2485c0715fbfd3b295300f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\445b41f1-1b08-4088-a5bb-60d4ef54d07e

Filesize
671B

MD5
d42ecffcf5dc2f444f90b12dc504ce52

SHA1
989624ff1b3fb720b2be9f4c0eb3c42804cb868d

SHA256
2dc2945b1aaab22d4657e24ee53f4c41392a0ea5178f3d0f49f35b353b9fb9dd

SHA512
8d46b4e58c9eff85dc29d32aabd5b1a9fb1cbfadc86685d2ff264ab85f0fb256e010740dae89cdd047ca2c09e48f4fe117254532db9daa7b9b01a2915ad91994

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\96492932-22bd-43b4-bda6-af40b861b29c

Filesize
25KB

MD5
88580d55d8e8c4975b7d2a8d3325fd23

SHA1
bda32c27a88c293fdf3ad4b64e0053be90ff06d3

SHA256
d6ef74a3b35b7aa76fed06600399c268802fe90f3e44a6bce821174fdf3b4e80

SHA512
d0b3923a015c80e4807c9c95de404f2db2245c52fc442ae0a0e221216da28e170455c68e46738c243175d0a7cffce0a728e44b95773d5d08cf76587f35924819

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs-1.js

Filesize
11KB

MD5
005673a42fcbaae77fc327f00a75a3e0

SHA1
fd6f816b424cd0dc6462de27bd3198635a894463

SHA256
4ff2dc391e90f47bb86d6c9747f413c21d549731dafc42c17e3f447736d86c4f

SHA512
b5263855030935c7911321a97c1a0f9aab53b9afaa27624c7fc4cb232188905010d4b2b0b5fd8005a67edbdecce63e2c1673ad8f5b253034dc2ab9cd53e6e601

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs.js

Filesize
10KB

MD5
2f1c9e8ba7e6e395b00b26a3c9e3028c

SHA1
bb2d0b179da78a6f54136682696bfe48a648e372

SHA256
e090f69fb442a5b82a446d6a95db0ca2936701f72b6093f5e5a83879eab57828

SHA512
8cb277f4995f4b230a45c77f16ec8c9cea70b207ed1c244b186a5fb634ebd1fbfc4669ad036b2d9c44d510c92ed0602d2059e673c07d13f8ea066b91c919840a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\Downloads\salinewin.zip

Filesize
203KB

MD5
19a966f0b86c67659b15364e89f3748b

SHA1
94075399f5f8c6f73258024bf442c0bf8600d52b

SHA256
b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d

SHA512
60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427

Download Submit
C:\Users\Admin\Downloads\salinewin.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit