hxxps://github[.]com/JackDoesMalwares/Gocullinator

max time kernel
569s
max time network
567s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/JackDoesMalwares/Gocullinator
Sample241002-tr655awaml

Score

8^/10

bootkit defense_evasion discovery evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2564	Hexachlorocyclohexane.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
89	raw.githubusercontent.com
90	raw.githubusercontent.com
91	raw.githubusercontent.com
92	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Hexachlorocyclohexane.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Hexachlorocyclohexane.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2016	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
2220	reg.exe
1320	reg.exe
1604	reg.exe
1064	reg.exe
2100	reg.exe
1708	reg.exe
2276	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Hexachlorocyclohexane.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2044	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 17 IoCs

pid	Process
2564	Hexachlorocyclohexane.exe
1140	mmc.exe
3528	mmc.exe
3808	mmc.exe
2124	dxdiag.exe
2156	taskmgr.exe
3892	mmc.exe
2100	charmap.exe
3040	winver.exe
2056	control.exe
3348	dxdiag.exe
3440	taskmgr.exe
3420	charmap.exe
3500	control.exe
3452	winver.exe
3600	dxdiag.exe
3684	taskmgr.exe

Suspicious behavior: SetClipboardViewer 6 IoCs

pid	Process
3528	mmc.exe
3808	mmc.exe
3512	mmc.exe
3892	mmc.exe
4176	mmc.exe
4568	mmc.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: 33	1016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1016	AUDIODG.EXE
Token: 33	1016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1016	AUDIODG.EXE
Token: 33	1140	mmc.exe
Token: SeIncBasePriorityPrivilege	1140	mmc.exe
Token: 33	1140	mmc.exe
Token: SeIncBasePriorityPrivilege	1140	mmc.exe
Token: 33	1140	mmc.exe
Token: SeIncBasePriorityPrivilege	1140	mmc.exe
Token: 33	3528	mmc.exe
Token: SeIncBasePriorityPrivilege	3528	mmc.exe
Token: 33	3528	mmc.exe
Token: SeIncBasePriorityPrivilege	3528	mmc.exe
Token: 33	3528	mmc.exe
Token: SeIncBasePriorityPrivilege	3528	mmc.exe
Token: 33	3808	mmc.exe
Token: SeIncBasePriorityPrivilege	3808	mmc.exe
Token: 33	3808	mmc.exe
Token: SeIncBasePriorityPrivilege	3808	mmc.exe
Token: 33	3808	mmc.exe
Token: SeIncBasePriorityPrivilege	3808	mmc.exe
Token: 33	3512	mmc.exe
Token: SeIncBasePriorityPrivilege	3512	mmc.exe
Token: 33	3512	mmc.exe
Token: SeIncBasePriorityPrivilege	3512	mmc.exe
Token: 33	3512	mmc.exe
Token: SeIncBasePriorityPrivilege	3512	mmc.exe
Token: 33	3892	mmc.exe
Token: SeIncBasePriorityPrivilege	3892	mmc.exe
Token: 33	3892	mmc.exe
Token: SeIncBasePriorityPrivilege	3892	mmc.exe
Token: 33	3892	mmc.exe
Token: SeIncBasePriorityPrivilege	3892	mmc.exe
Token: SeShutdownPrivilege	2564	Hexachlorocyclohexane.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2044	notepad.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2088	wordpad.exe
2088	wordpad.exe
2088	wordpad.exe
2088	wordpad.exe
2088	wordpad.exe
2664	mspaint.exe
2664	mspaint.exe
2664	mspaint.exe
2664	mspaint.exe
2448	mmc.exe
1140	mmc.exe
1140	mmc.exe
3380	wordpad.exe
3380	wordpad.exe
3380	wordpad.exe
3380	wordpad.exe
3380	wordpad.exe
3464	mspaint.exe
3464	mspaint.exe
3464	mspaint.exe
3464	mspaint.exe
3516	mmc.exe
3528	mmc.exe
3528	mmc.exe
3624	wordpad.exe
3624	wordpad.exe
3624	wordpad.exe
3624	wordpad.exe
3624	wordpad.exe
3736	mspaint.exe
3736	mspaint.exe
3736	mspaint.exe
3736	mspaint.exe
3796	mmc.exe
3808	mmc.exe
3808	mmc.exe
3948	wordpad.exe
3948	wordpad.exe
3948	wordpad.exe
3948	wordpad.exe
3948	wordpad.exe
3296	mspaint.exe
3296	mspaint.exe
3448	mmc.exe
3512	mmc.exe
3296	mspaint.exe
3296	mspaint.exe
3512	mmc.exe
1276	wordpad.exe
1276	wordpad.exe
1276	wordpad.exe
1276	wordpad.exe
1276	wordpad.exe
3692	mspaint.exe
3692	mspaint.exe
3692	mspaint.exe
3692	mspaint.exe
3592	mmc.exe
3892	mmc.exe
3892	mmc.exe
3672	wordpad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 1648 wrote to memory of 2024	1648	firefox.exe	31
PID 2024 wrote to memory of 2744	2024	firefox.exe	32
PID 2024 wrote to memory of 2744	2024	firefox.exe	32
PID 2024 wrote to memory of 2744	2024	firefox.exe	32
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 2404	2024	firefox.exe	33
PID 2024 wrote to memory of 576	2024	firefox.exe	34
PID 2024 wrote to memory of 576	2024	firefox.exe	34
PID 2024 wrote to memory of 576	2024	firefox.exe	34
PID 2024 wrote to memory of 576	2024	firefox.exe	34
PID 2024 wrote to memory of 576	2024	firefox.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/JackDoesMalwares/Gocullinator"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/JackDoesMalwares/Gocullinator
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.0.510989324\1283792515" -parentBuildID 20221007134813 -prefsHandle 1256 -prefMapHandle 1248 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0443af34-5e37-4c84-8f0d-483264e9d01e} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 1356 106d9258 gpu
    3⤵
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.1.940290908\934748767" -parentBuildID 20221007134813 -prefsHandle 1544 -prefMapHandle 1540 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0c5562-4ed8-4e60-8992-ab14f3f483c9} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 1556 e73b58 socket
    3⤵
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.2.1688055132\928519994" -childID 1 -isForBrowser -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10ff2d60-183b-4c85-be62-edc177064759} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 2352 19ff1558 tab
    3⤵
    PID:576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.3.1835066674\799033899" -childID 2 -isForBrowser -prefsHandle 2884 -prefMapHandle 2880 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d7cb638-6ee2-4208-88fa-5d726190df1e} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 2896 1d5b1258 tab
    3⤵
    PID:1352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.4.1582317139\29109625" -childID 3 -isForBrowser -prefsHandle 3760 -prefMapHandle 3688 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9389215f-78ee-4d87-b8b6-f56a1105e1e2} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 3772 205da258 tab
    3⤵
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.5.820987263\595805134" -childID 4 -isForBrowser -prefsHandle 3900 -prefMapHandle 3904 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e07ac6b5-0c45-4a8b-9dce-8e95eda00e3f} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 3824 205dc358 tab
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.6.891560516\1721632793" -childID 5 -isForBrowser -prefsHandle 4048 -prefMapHandle 4052 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {199550ae-001d-42fe-8ed0-bf14349f2bb4} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 4036 205da858 tab
    3⤵
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.7.1264682632\102695176" -childID 6 -isForBrowser -prefsHandle 3452 -prefMapHandle 3460 -prefsLen 27487 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ea7b027-3503-4718-aa06-723f7ce202f8} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 3500 19f96258 tab
    3⤵
    PID:1940
- - C:\Users\Admin\Downloads\Hexachlorocyclohexane.exe
    "C:\Users\Admin\Downloads\Hexachlorocyclohexane.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      PID:2164
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:928
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoControlPanel /t reg_dword /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoControlPanel /t reg_dword /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
      4⤵
      PID:444
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
      4⤵
      PID:1016
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1764
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bcdedit /delete {current}
      4⤵
      System Location Discovery: System Language Discovery
      PID:840
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" C:\Hexachlorocyclohexane\note.txt
      4⤵
      System Location Discovery: System Language Discovery
      Opens file in notepad (likely ransom note)
      Suspicious use of FindShellTrayWindow
      PID:2044
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:264
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:2124
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 8192
        5⤵
        
        PID:2876
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:2100
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:2156
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:3040
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2664
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:2056
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1140
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:3316
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:3348
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3380
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:3420
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:3440
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:3452
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3464
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:3500
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3516
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3528
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3584
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:3600
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3624
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3652
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      PID:3684
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3720
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3736
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:3772
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3796
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3808
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3840
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:3860
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3948
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3992
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      PID:4040
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3296
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:596
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3448
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3512
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3556
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:3732
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2260
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1276
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3916
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3692
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1092
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3592
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3892
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4016
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1632
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3672
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3552
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      PID:2916
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:4176
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4168
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      PID:4464
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4532
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      PID:4552
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:4568
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4604
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\winver.exe
      "C:\Windows\System32\winver.exe"
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4804
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        
        PID:4880
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

note.txt

Path C:\Hexachlorocyclohexane\note.txt
Size 135B
SHA256 7e29cc704a0dd5e22cb9f09310dbc255dd3b432c9f7b57255647be8692e122e6
MD5 ea548ab9c32ef92afc59651fd2a5ee90
SHA1 ca2460f051f27aef42d117897dfb92eeb5571165
SHA512 c642853aad342e8f466fa413ae64d7231efa090381163abe80921dbd21a22c329b2112a5015ae217758be1ddc4559dcdd621196c7dcc7cf28e51bea28c297f9d
MD5 SHA1 SHA512

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 fc69fbbb6c9bcdf6b746e2f01bb79037037eaae3cfcd711673f8dc3f4df4f87e
MD5 6e936ddca069b14ebc0804d6ac87de86
SHA1 1b4197a81d23badb4574b73f03f95baf468d378d
SHA512 aa1f8cc61cabde2c9a4788023d8f42a64162ceda3e7bc265d1a7132f5431196b5e5469dbb7fb06d7bc4845db269e3390245ab73ca2486d614aee032da379be31
SSDEEP 384:zkXXyb2jop88iwfa+zq6xf7sWWvMBRwRzaHiKGAACmMwvx1kTKfyaW:zkSb51fFq6xDKMzwR9vfyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

OCHUT41R93T41YIX9BG5.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OCHUT41R93T41YIX9BG5.temp
Size 9KB
SHA256 1585e1cbdb7a1850d5350dfa670afd82ac3800ff82a23926911fa9869d233315
MD5 f9e0051b47e91dc92d249f7add2cc951
SHA1 adc99f6b5031c9e1994a3fbeaafb7a8a8eebf202
SHA512 3390364a7741ce6538150a4c03f17d739ebfb50f5baa8cc85f3646acb7c718e48f196e13207d906811c67e02b98df6974d7cb2c0423636e099731c076d18c4e3
SSDEEP 96:69vj9v/FS9v/e9vlPRVza3aZ9vZBUHK4bq9:OvRv8v/av1dvF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 d9ab64611f3ee6e9aa9f9385d64906c464dd3255ddaebf7d1222bd8f60a93aa0
MD5 299293efabad2917899972a73dc8f28b
SHA1 b8429a7306e180038983c913ced34d06a83616aa
SHA512 cd2c78c4a97558e6b74095eb62a2e7a5448ecf0598144919cfe2c8b6315c5f51a8f7ada5e530ead290802007f7834c49b9bca88fe02b3df182fe6f5cb09c7071
MD5 SHA1 SHA512

Submit Download

34175717-c368-4351-8e5e-0895bebf4689

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\34175717-c368-4351-8e5e-0895bebf4689
Size 11KB
SHA256 e221cf30a6d16f0b9a6dd8f5a4cbb3c07567ee10ed472a9fdacafbd753ea59e3
MD5 218877d147762c927ee532fa81d1aa06
SHA1 7ce3eb20078a7d89f0354de54251b74e36577d3f
SHA512 b91e31a942c98db29b5690bf0a7781355fbc8fa9e06fdd9e1cb4b1bd828b04de951cce3235fc21e492f0abbf006cf44db021cb562e2bbcccd828b4dcd47a31f0
SSDEEP 192:7Wjd4dnT6WqWiR5CFOc6K4fuJ7/yluElDlVLXgunMfpwjtffvRDFoCdPy:Cjy+dH4Iy
MD5 SHA1 SHA512 SSDEEP

Submit Download

cb53eee4-25f6-4ff3-ac38-e7954498dc69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\cb53eee4-25f6-4ff3-ac38-e7954498dc69
Size 745B
SHA256 0d9619a7fe18f42c24cfc4c45353dc76f8b259eeca107f9c525e0172d752a07f
MD5 c9c2281dcc2f4350f0bf9598f4460874
SHA1 b48a969a243f0ecf03760c04db6254bda62952bc
SHA512 f344a71c785ba8b106cc3c2880f834f0ada8468e3e74e25a05fe478c6370cc1c5d0bedbd13a36c02ad70e7d60ccba05226505981aaca6bb1d8b453dfe26b2e94
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 6KB
SHA256 0ecfd0dc357bc8088e7cd9a6670a967f7538dadde5c939dffacbd901110e26e0
MD5 35b13124e2ef0b0ee06dee3ca2d83931
SHA1 2a5d3aad30add618c98560bedf5493cb816dd147
SHA512 c64affb7ecdbf1979198c9c65971cfd44de2795e77eece078f67d67edf0a82d72674aa78c4193c5c83efe22e6455b9fad9bf05cb603daa245ca737e877f5515d
SSDEEP 96:xHT5nUTeqGqhdaqoeOTzSWPXAnpj/Hhz2ZmiBw8H5D:V5nIRhdaqoe0PXml8RBw8HJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 6KB
SHA256 93823f2c845fb2ca21d345b8d82543c4d77cbb0c2090a30fa86fcc5c8f6ba3a5
MD5 add81488d768637bded7c14d907112da
SHA1 7b1cbd56bce46f6490bdea5f437bb790b2a066f0
SHA512 798006100a55dd954eff66671cbc03117fe3fa1a30eba9f91a73a933b1024cc2dfa93d01d4e75d6e4066b0710ad94758422d580912d723d1f196a86ea528f0f9
SSDEEP 96:xHT5nUTeqGqhda5WeOTzSWPXAnpjgHhz2ZmqBw8H5D:V5nIRhda5We0PXrl8FBw8HJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 7KB
SHA256 029b5bcd98131a676b543a0c27d956e67e54e2060ba11c25f938e53ccaf5db04
MD5 b80669a1b8c86b42b0d68928f43a470d
SHA1 2ee284364d6a2899c99b318ea627c9828fc21b9d
SHA512 0e65e0de60e571f225dccb438f44a9068a123a689a9ab6475d58e6d9b20cc1cd8ba93e0bf5f9f0ccb733fc406ae12faf766c21580ab1a83de2fe805e0a2f20cb
SSDEEP 96:xHZ5nUTeqGqhda5WeOTzSWPXAnpjgHhz2ZmWBw8H5D:35nIRhda5We0PXrl89Bw8HJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 7KB
SHA256 25b15d08ab6b07e75c673404ea4a4f2c6f02cc0eb78128651096b6e3f8cd4aea
MD5 70dc83aed334c4ef261f41f8b8b189c1
SHA1 f1d9a96ad451514e74d730707ee8fbeff3cd62d7
SHA512 7d0f9bb6c5ff19f3dd04e16e98937aacc2e9ed80c427d379d072a1e07a5b54c71967083b3ae521ece197b09373126aee6bd1881478f92b0dcce57b597b1f2cd2
SSDEEP 96:xHZa5nUTeqGqhda5WeOTzSWPXAnpjgHhz2ZmLRBw8H57v:3a5nIRhda5We0PXrl8cRBw8HZv
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 6f886a561856dc861499eb44846e77d0e65267b81db63b0fafaf12463e3be1bc
MD5 6ff931e0663317abd1417cf87b18efb7
SHA1 d043add45c78d04c3197622dd5d9566b145b76fc
SHA512 57f00ef0f42b1a1e96eb48ce5aac15bb0a677de3900dccfb6b45e529cf26de2f40684cd9b931d3dee8e7185301b460b431286d76e713a66fbe87ab970bc041f4
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 3d4bac70d612088ba0f3845edd1ca0e613e65cfa10b8350879f9265671d44807
MD5 7fba9be0ec356a6ef8188da4278b6f81
SHA1 63d2ff641a185bbfbdc4121c65ed6137a57c9c4f
SHA512 823c74a5c437ba736af938d1161cf78dede5146fc423d6b8c1fab6359aa573fcd31c3fcd45d5052f010054f09794de44b7d85ce0a4755ec552fea79b04e58ac6
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 8e5fdbdd4bf75b01fbacf2f4d532e7facdc92aa35e3b31d1509af8e7b9bf7e16
MD5 f4b1ff4f65215dfb03154df9c771de89
SHA1 a6b89c965fe968fd68de6dd45b78aca5ef4f1b1f
SHA512 a8f29fbd1dbd4d5fda0822306abe06086c873691f6ab7b723e962e678baa362297c37560a21cd82dcea725b342f9b38155799cbdabd60c88079b8060896fd7fd
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 5cb531f6a08ec8c33ec2c22a1cfb3a2b462d63bc709d2e4de06d2882d99db3b0
MD5 923440319382dbf49255fc4a842df6b7
SHA1 8a9997d8988389d9fe7f2fef8a2d3ef147dc0036
SHA512 1d5cc9eaa4b766aae6fc56dde7a98e722957bad614210eaecdc8b77c858d679d45fc119029254da77a4050138e16e895d47b1d9649baaade1e6b47da55886e22
SSDEEP 96:51Sx2OiIm7v7z94DLzT+KX/y/qg/BcrIjtsHaBghRWb3d:7X6m3z94DLzC9iRIjiHZR2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 192KB
SHA256 6baea1a117732fd171f40b341b8e8fb6a0e4d6966995d32624d45f6e8eedac4d
MD5 afb593bf56580c89b59db0f6687fff1f
SHA1 bc42dc7314bf196149acb1e5a304c14801b75cc8
SHA512 a8c2c3184183abbeaeb9ba2a778c41a56c4cf3d78e1d2ae23755e334f7b5c302018505deb345b997d90a15fbd2b4578bd296890c26fee4933f66831dd77578d6
SSDEEP 3072:RVcHDEQRuFPn3y3Hn9vAE6uaH3aeHqPKjSY:RVcHDrR0P3y3H56uaH3aeHVjSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hexachlorocyclohexane.exe

Path C:\Users\Admin\Downloads\Hexachlorocyclohexane.exe
Size 134KB
SHA256 13a76f0d261e6d8b4a2887557bbbbe8a1e8a5ea97b8d827ab3774abeb3ca58f4
MD5 0a3c93f6a1501f3d857894ae4022b69b
SHA1 ec2fa5d07ab4d39f4f36c5ae0699be5f79c57165
SHA512 446ba51f9e9263d8d983e2b7c2d63be88ec4a6e93ac23f2b4290984ecb3405521f5f4487545636b8b475a46a927a0485638128c48abe8f6622485b1ed841d780
SSDEEP 3072:VH8KrXDX3jP+Reyv1Yb9dGCfGfK83TBZ:VH8Gb3jmw0KCBZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads