hxxp://virtualbox[.]org

Analysis

max time kernel
124s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 07:33

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://virtualbox.org

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\VBoxUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETB0D8.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETB0D8.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETB79D.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETB79D.tmp	MsiExec.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CD7BE0F00F2A5EE102C3037E098AF3F457D3B1AB\Blob = 030000000100000014000000cd7be0f00f2a5ee102c3037e098af3f457d3b1ab1900000001000000100000005d348d256637dba6c37ab7c52a70fcfc14000000010000001400000051b8f644d5026aad4a82159c9c79ab3712e491e60400000001000000100000005f429788727974c52ef1b4cd93d03b8f0f000000010000002000000023533a4193388017e79a89286988374594b2466794256dca165999dca21c92f62000000001000000f3060000308206ef308204d7a0030201020210060e2f8f9e1b8be518d5fe2b69cfccb1300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3233303330393030303030305a170d3235303331313233353935395a3077310b3009060355040613025553311330110603550408130a43616c69666f726e6961311530130603550407130c526564776f6f642043697479311d301b060355040a13144f7261636c6520416d65726963612c20496e632e311d301b060355040313144f7261636c6520416d65726963612c20496e632e308201a2300d06092a864886f70d01010105000382018f003082018a0282018100a923894b895ffb4d12ec93f8c323ecd79af5c56138e730b3fa8b7d36c006b3ce21479f17092f4dad917723e78ddf17776a62cc51b22be9ac534649c6e09eca72fa19fcad338414632547c05877c7a4d93515790b4d414e8181abcfbaed92f78bab5cc7bfc73c400345ae1d6f4d0c87afb48f42fcda92d43a159ce5daa9a5a7c0072cb1538c6257abdbbac84d9bdedd4d1161a32b33b9710d1cb9b2464970a1f68b2ac9efc2bbf2b0e454d9dead2a09a4142a3b300e6fb3c21b3cca8098e00e74c5f30f46cb91b48077a083db650bbee7658c67396905dfdf9cc2e00d89a983be306ed31486f33025bfe2e8a66ec67dc19b724842a7947670a10ed953ab6e5bd4b68c21258ae1f84a65125d19f397b12fd485516bf318d0feb13bef6d065f29eee6211dbd761f5678360d5c839dbd995b75a3f7bc79da24c829422eeacc1aa9e55be80101904938f21eac4dda6a348cf9e6ecd36c2ec1d4fbd24b1442373bb6420194eb9708889d2e163a67213345b4f8b8435f90f9104cf6dab85e5b1d6c1be90203010001a3820203308201ff301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e0416041451b8f644d5026aad4a82159c9c79ab3712e491e6300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63727430090603551d1304023000300d06092a864886f70d01010b0500038202010030ff6c1186f9877d2be2e2701f0bc1c9b22b72fb594b549308349162455d45bab63a49a06fb47609f6b2d696c152a00ee2f3b00d513a8b994f68eb2137f1358cc1615046f9e94d4a05303e1caec31a22599219424fcdd87f5519fcf45411d6e88f743077e3668ed6de08d6d79353bb5bddbd4effa629314438a4be4ed5e1a6a45fcd6d0451281b370d2a2e7f85c33c8109baf511afd139a98b1de7314c4d554ed8f8d399f6ca3538e33ca23a7045dcf14c2a9b228937d7a7ad6c6197ad5b383b6f64b8f63c873ac0a0c6ead330405bfed617c65c025fae6672eb8ce482aa7a94eb7b37952d841a165fb39d9899b903948fe35678f03e578809e366ea9c616d3be15e7c98a73ff70179e9a501a9d852c17f7373587e051adf6e82e3022fc0244b0ba7ed40745ef9be8ddfd805510aa6be2d25bde2523955e772379e931c0d68eab5f17ceb5ebf966577ed637e386789830775bb791b13ba36e1659bc217345b08d4c2369de04f621dbabdee6aa0ea9e1560b99045da48a00218fc5a760cdb78a42ae8b8c72dafd281826b949c41a2fa4ae5712d4173dbea6b370f4134d651f0f81070a4b849d4147ede853685cff2a07fceba1afa8a9a346d48e079e8119ac12a9bfcb60d3dcd092447a2fd8af13463a9c083eeffb45d55968b19ddcaa8417f421bf00a110c04835245c455cd97b317d908a4f5b4ca9f3a0c6288c4ab63c21175	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2068	VirtualBox-7.1.4-165100-Win.exe

Loads dropped DLL 26 IoCs

pid	Process
2068	VirtualBox-7.1.4-165100-Win.exe
2068	VirtualBox-7.1.4-165100-Win.exe
2068	VirtualBox-7.1.4-165100-Win.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
3300	MsiExec.exe
3300	MsiExec.exe
3300	MsiExec.exe
3300	MsiExec.exe
3424	MsiExec.exe
3300	MsiExec.exe
3300	MsiExec.exe
3860	MsiExec.exe
3860	MsiExec.exe
3860	MsiExec.exe
3860	MsiExec.exe
3860	MsiExec.exe
1360	Process not Found
1360	Process not Found
1360	Process not Found
3860	MsiExec.exe
3860	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\I:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\M:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\H:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\O:	VirtualBox-7.1.4-165100-Win.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_75BF0359A5E04D5AD298846D82E974A9680AE4D2\VBoxUSBMon.cat	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\SETBC00.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\SETBC01.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\VBoxNetLwf.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_neutral_05244e62af87a9ac\VBoxUSB.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\VBoxNetLwf.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_neutral_f7173b8d2ae4b6e5\VBoxNetLwf.PNF	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_75BF0359A5E04D5AD298846D82E974A9680AE4D2\VBoxUSBMon.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\SETBC01.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_neutral_05244e62af87a9ac\vboxusb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD93.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_neutral_f7173b8d2ae4b6e5\vboxnetlwf.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxSup_EF032676C67720523A95FA697F91BE28089F5CE1\VBoxSup.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\VBoxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\VBoxUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_neutral_05244e62af87a9ac\vboxusb.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD82.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_neutral_f7173b8d2ae4b6e5\vboxnetlwf.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\SETBBFF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_75BF0359A5E04D5AD298846D82E974A9680AE4D2\VBoxUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\VBoxUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD93.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_EF032676C67720523A95FA697F91BE28089F5CE1\VBoxSup.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\SETBBFF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\SETBC00.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD82.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_EF032676C67720523A95FA697F91BE28089F5CE1\VBoxSup.inf	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_EF032676C67720523A95FA697F91BE28089F5CE1\VBoxSup.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\x86.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_es.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxRes.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VMMR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qminimalVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_util.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\setup.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\License_en_US.rtf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAudioTest.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxManage.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxCAPI-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapi\src\vboxapi\VirtualBox_constants.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxRT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_response_files.rsp	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBugReport.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qoffscreenVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qhc	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\installer\python\vboxapisetup.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qwindowsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox_150px.png	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ka.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\testcase\amd64\vbox-vm-struct-test.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7015.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI73EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f796819.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{B7EE9AB2-4188-4B5F-8499-43114E7AD7DA}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\f796816.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71DB.tmp	msiexec.exe
File created	C:\Windows\Installer\f796817.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7854.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB9DD.tmp	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f796816.msi	msiexec.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFC2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FEC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2AB.tmp	msiexec.exe
File created	C:\Windows\Installer\{B7EE9AB2-4188-4B5F-8499-43114E7AD7DA}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIAAEC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIFBEC.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI6E9D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9125.tmp	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\VirtualBox-7.1.4-165100-Win.exe:Zone.Identifier	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.1.4-165100-Win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 01000000000000008858eb3c3021db01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000484be83c3021db01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 01000000000000008858eb3c3021db01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32008 = "Allows you to securely connect to a private network using the Internet."	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@netcfgx.dll,-50002 = "Allows your computer to access resources on a Microsoft network."	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\drivers\pacer.sys,-100 = "Quality of Service Packet Scheduler. This component provides network traffic control, including rate-of-flow and prioritization services."	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rundll32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{CF11D345-0241-4EA9-AC4C-C69ED3D674E3}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB000A0E-2079-4F47-BBCC-C6B28A4E50DF}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{25360A74-55E5-4F14-AC2A-F5CF8E62E4AF}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF398A9A-6B76-4805-8FAB-00A9DCF4732B}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C19073DD-CC7B-431B-98B2-951FDA8EAB89}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\ = "IMediumChangedEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\NumMethods\ = "12"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5094F67A-8084-11E9-B185-DBE296E54799}\NumMethods\ = "9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\progId_VirtualBox.Shell.vbox-extpack\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0D93830-70A2-487E-895E-D3FC9679F7B3}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E8F79A21-1207-4179-94CF-CA250036308F}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D27C0B3D-6038-422C-B45E-6D4A0503D9F1}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4B301A9-5F86-4D65-AD1B-87CA284FB1C8}\NumMethods\ = "28"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4F529A14-ACE3-407C-9C49-066E8E8027F0}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{925084B0-625F-422F-A67D-0EDE1880A56C}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{92F21DC0-44DE-1653-B717-2EBF0CA9B664}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{67099191-32E7-4F6C-85EE-422304C71B90}\NumMethods\ = "8"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{F4D803B4-9B2D-4377-BFE6-9702E881516B}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\progId_VirtualBox.Shell.hdd\DefaultIcon\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxRes.dll\",-306"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DD6A1080-E1B7-4339-A549-F0878115596E}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{5ADA589F-09C9-4604-B700-9AB3A5572E3A}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{93BADC0C-61D9-4940-A084-E6BB29AF3D83}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DEDFB5D9-4C1B-EDF7-FDF3-C1BE6827DC28}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{C984D15F-E191-400B-840E-970F3DAD7296}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{50C97996-9CF8-417F-BD79-1E0471367CD3}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5BFD8965-B81B-469F-8649-F717CE97A5D5}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4680B2DE-8690-11E9-B83D-5719E53CF1DE}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3D2799E-D3AD-4F73-91EF-7D839689F6D6}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0D93830-70A2-487E-895E-D3FC9679F7B3}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{01ADB2D6-AEDF-461C-BE2C-99E91BDAD8A1}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4DA2DEC7-71B2-4817-9A64-4ED12C17388E}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DCF47A1D-ED70-4DB8-9A4B-2646BD166905}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9128800F-762E-4120-871C-A2014234A607}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DDCA7247-BF98-47FB-AB2F-B5177533F493}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BA9EE7B8814F5B448993411E4A77DAD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31AAB263-95EF-48A4-9CE7-EAF0D3AE150F}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4E774BBE-5285-4517-8D34-21260633C513}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F01F1066-F231-11EA-8EEE-33BB2AFB0B6E}\ = "ICloudProviderUninstallEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5748F794-48DF-438D-85EB-98FFD70D18C9}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BB335CC-1C58-440C-BB7B-3A1397284C7B}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B14290AD-CD54-400C-B858-797BCB82570E}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DFA7E4F5-B4A4-44CE-85A8-127AC5EB59DC}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F22DD3B4-E4D0-437A-BFDF-0372896BA162}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CB6F0F2C-8384-11E9-921D-8B984E28A686}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DFA7E4F5-B4A4-44CE-85A8-127AC5EB59DC}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{70401EEF-C8E9-466B-9660-45CB3E9979E4}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A670A023-E172-452C-B731-14EF855F4DA6}\NumMethods\ = "42"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\progId_VirtualBox.Shell.ovf\shell\open\ = "Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53FAC49A-B7F1-4A5A-A4EF-A11DD9C2A458}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{739160A6-53EA-465B-BB6B-5326C20A3C0C}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{179F8647-319C-4E7E-8150-C5837BD265F6}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6BB335CC-1C58-440C-BB7B-3A1397284C7B}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{6F302674-C927-11E7-B788-33C248E71FC7}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\progId_VirtualBox.Shell.vmdk\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B66349B5-3534-4239-B2DE-8E1535D94C0B}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{726EACA9-091E-41B4-BCA6-355EFE864107}\ = "IGuestFsInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAAF9016-1F04-4191-AA2F-1FAC9646AE4C}\NumMethods\ = "13"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2F98F8-9641-4397-854A-040439D0114B}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{78861431-D545-44AA-8013-181B8C288554}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{1E8D3F27-B45C-48AE-8B36-D35E83D207AA}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DD6A1080-E1B7-4339-A549-F0878115596E}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5587D0F6-A227-4F23-8278-2F675EEA1BB2}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{86A98347-7619-41AA-AECE-B21AC5C1A7E6}\ = "IAppliance"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\VirtualBox-7.1.4-165100-Win.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	msiexec.exe
2780	msiexec.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	firefox.exe
Token: SeDebugPrivilege	2792	firefox.exe
Token: SeShutdownPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeIncreaseQuotaPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeAssignPrimaryTokenPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeLockMemoryPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeIncreaseQuotaPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeMachineAccountPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeTcbPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSecurityPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeTakeOwnershipPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeLoadDriverPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSystemProfilePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSystemtimePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeProfSingleProcessPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeIncBasePriorityPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeCreatePagefilePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeCreatePermanentPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeBackupPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeRestorePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeShutdownPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeDebugPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeAuditPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSystemEnvironmentPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeChangeNotifyPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeRemoteShutdownPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeUndockPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSyncAgentPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeEnableDelegationPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeManageVolumePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeImpersonatePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeCreateGlobalPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeCreateTokenPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeAssignPrimaryTokenPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeLockMemoryPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeIncreaseQuotaPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeMachineAccountPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeTcbPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSecurityPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeTakeOwnershipPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeLoadDriverPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSystemProfilePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSystemtimePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeProfSingleProcessPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeIncBasePriorityPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeCreatePagefilePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeCreatePermanentPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeBackupPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeRestorePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeShutdownPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeDebugPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeAuditPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSystemEnvironmentPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeChangeNotifyPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeRemoteShutdownPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeUndockPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeSyncAgentPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeEnableDelegationPrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeManageVolumePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe
Token: SeImpersonatePrivilege	2068	VirtualBox-7.1.4-165100-Win.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2792	firefox.exe
2792	firefox.exe
2792	firefox.exe
2792	firefox.exe
2068	VirtualBox-7.1.4-165100-Win.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2792	firefox.exe
2792	firefox.exe
2792	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2792	firefox.exe
2792	firefox.exe
2792	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 840 wrote to memory of 2792	840	firefox.exe	29
PID 2792 wrote to memory of 2836	2792	firefox.exe	30
PID 2792 wrote to memory of 2836	2792	firefox.exe	30
PID 2792 wrote to memory of 2836	2792	firefox.exe	30
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2736	2792	firefox.exe	31
PID 2792 wrote to memory of 2508	2792	firefox.exe	32
PID 2792 wrote to memory of 2508	2792	firefox.exe	32
PID 2792 wrote to memory of 2508	2792	firefox.exe	32
PID 2792 wrote to memory of 2508	2792	firefox.exe	32
PID 2792 wrote to memory of 2508	2792	firefox.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://virtualbox.org"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://virtualbox.org
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.0.710799834\2078679304" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {075f3391-6a69-4a41-be6c-c05a049cd602} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 1276 103dde58 gpu
    3⤵
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.1.1087376875\534004926" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6b61d86-6973-4f80-ac87-d1a505cf84aa} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 1496 e70758 socket
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.2.1538947934\792830099" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80a9bc24-2ab6-45bb-921f-fbd2f621d782} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2108 19fa3558 tab
    3⤵
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.3.212073791\1251983600" -childID 2 -isForBrowser -prefsHandle 576 -prefMapHandle 696 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5c40e70-1f47-49b1-8fa2-fc45fc28ce03} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2740 e67b58 tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.4.1057055252\1199390166" -childID 3 -isForBrowser -prefsHandle 3536 -prefMapHandle 3528 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74ff3229-d325-4a64-bd8c-6f5aada07219} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 3552 1e55e458 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.5.1907123440\1959284000" -childID 4 -isForBrowser -prefsHandle 3568 -prefMapHandle 3664 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bd0a15b-dfbc-4691-ad41-71d0a261c80c} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 3580 1e55ff58 tab
    3⤵
    PID:1488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.6.1637225031\396342605" -childID 5 -isForBrowser -prefsHandle 3496 -prefMapHandle 3840 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {873a5993-7d35-46b0-b88c-f178a31a9ff1} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 3912 1ee86258 tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.7.1685404295\1465695088" -childID 6 -isForBrowser -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1d07da1-2cbe-4c14-add8-905b5c0ef645} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2108 1db94358 tab
    3⤵
    PID:2012
- - C:\Users\Admin\Downloads\VirtualBox-7.1.4-165100-Win.exe
    "C:\Users\Admin\Downloads\VirtualBox-7.1.4-165100-Win.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2068
  - - C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
      "C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"
      4⤵
      PID:432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.8.1104309062\543777788" -childID 7 -isForBrowser -prefsHandle 4904 -prefMapHandle 4900 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb00e0b6-d8cf-49ac-a680-3f853e0f1dca} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 4916 1d8ece58 tab
    3⤵
    PID:3632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.9.2078077947\1663292144" -childID 8 -isForBrowser -prefsHandle 3572 -prefMapHandle 3552 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f62c15f-929b-4890-805e-36e5edc7ef37} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 3800 1ee88058 tab
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.10.2087803984\1423782482" -childID 9 -isForBrowser -prefsHandle 3196 -prefMapHandle 2072 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8261b33-4caa-4b4e-9f71-7333b76e4f22} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 3800 e6b558 tab
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.11.1629264814\1367099894" -parentBuildID 20221007134813 -prefsHandle 5220 -prefMapHandle 5208 -prefsLen 26836 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48bca6e6-531e-4103-8c70-dc1187dfdbdd} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 5132 f4c6058 rdd
    3⤵
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.12.46709616\828989331" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5404 -prefMapHandle 5220 -prefsLen 26836 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92469552-2f38-47fe-8239-167e44d48cb3} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 5416 f2dfc58 utility
    3⤵
    PID:3528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.13.1813684657\525491020" -childID 10 -isForBrowser -prefsHandle 5804 -prefMapHandle 5784 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf42194b-5a21-4816-9053-8b65d7a6ace4} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 5824 250c2458 tab
    3⤵
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.14.877758507\736497583" -childID 11 -isForBrowser -prefsHandle 4008 -prefMapHandle 4020 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f644003-172e-48ec-bb87-a869b42b1682} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 4004 1a03b558 tab
    3⤵
    PID:1064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.15.2125026576\1661765410" -childID 12 -isForBrowser -prefsHandle 4072 -prefMapHandle 5984 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afb8814f-1739-4dec-8e25-407a251a43a0} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 4020 21241658 tab
    3⤵
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.16.444619598\1070957294" -childID 13 -isForBrowser -prefsHandle 6008 -prefMapHandle 5756 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb25d547-3833-4884-a321-1586ccdd0600} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 2608 1e55e458 tab
    3⤵
    PID:340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2792.17.1090980178\1969466817" -childID 14 -isForBrowser -prefsHandle 9492 -prefMapHandle 9524 -prefsLen 26836 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df238f65-28c9-47f7-8341-ca4c11e63913} 2792 "\\.\pipe\gecko-crash-server-pipe.2792" 9480 f406258 tab
    3⤵
    PID:3672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding D08C00F18627317DA405127FFCB15338 C
  2⤵
  - Loads dropped DLL
  PID:2328
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 9D20DF42BA4D5E914659E1A381243EFC
  2⤵
  - Loads dropped DLL
  PID:3300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15BBC732CF510E8F7EDB18E4710EB79D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3424
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 308922D77629893403A826ADCA575224 M Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:3860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E081F5A01EC0DFB6DEACD9C206D6B8AD M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2036

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E4" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1484

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{38cfe36e-a42e-7ee9-9fa6-21620f42ce36}\VBoxUSB.inf" "9" "66237d90b" "00000000000005E4" "WinSta0\Default" "000000000000039C" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3500
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{4895ab90-25b7-779c-9227-f64d7101f85c} Global\{704a341b-7740-6ac0-5629-07139f236f65} C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\VBoxUSB.inf C:\Windows\System32\DriverStore\Temp\{4249d30f-5504-1510-a60a-3379afb9330c}\VBoxUSB.cat
  2⤵
  - Modifies data under HKEY_USERS
  PID:952

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6b8463e2-27cc-7f42-33c6-e95521109075}\VBoxNetLwf.inf" "9" "631e52bcb" "000000000000039C" "WinSta0\Default" "00000000000003E0" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:696
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{05bf86be-54f2-49fa-b1ee-fc27612f8621} Global\{0bb6df0b-524f-13d1-716e-b84243c8b278} C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\VBoxNetLwf.inf C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\VBoxNetLwf.cat
  2⤵
  - Modifies data under HKEY_USERS
  PID:952

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6bf98963-eb38-6c65-74e3-2c40048da765}\VBoxNetAdp6.inf" "9" "673b17b7b" "00000000000005E8" "WinSta0\Default" "00000000000003E4" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"
1⤵
PID:2768
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{0d62cf98-e707-12f2-1332-d56117bfe62f} Global\{043a17a4-5d2f-4ae6-10f2-3435f4b9f461} C:\Windows\System32\DriverStore\Temp\{09df6b13-6907-7b6c-ff64-d351607a021f}\VBoxNetAdp6.inf C:\Windows\System32\DriverStore\Temp\{09df6b13-6907-7b6c-ff64-d351607a021f}\VBoxNetAdp6.cat
  2⤵
  PID:900

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1296

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f796818.rbs

Filesize
2.6MB

MD5
e0784e5a762b6affd74ac997919f59d4

SHA1
83dac4cb1ea587b848f2892969c4d15be57f4d0e

SHA256
811ac5577527648681c2ac8d1a5b83246b8cead892aef3e167bbc3d810c3f184

SHA512
3a8c4a8251270b9189d1f2743ed3d2d4a20046d2032a88dab596955fb4533743dfe11ca7780db54431189150398ae1f2e588f3562861168758af1184d782842e

Download Submit
C:\PROGRA~1\Oracle\VIRTUA~1\drivers\USB\device\VBoxUSB.sys

Filesize
176KB

MD5
696b58e28b09b0ebaf4f27901a52e0e1

SHA1
eb1b5166c42bb96983889c873f45a1ef7ee62295

SHA256
1ff96c3462cf14e27da3c82b3c890972d48b2b9ecc168608ef631b2ade2bb95d

SHA512
f57171a2b8236daca57d152d8c6b5cfd3e45f2037465c14410c44b510f07ae18bf777b7599c9f63293f9ac1e7322fd473db0f2a69172860d44046d43fb5bc39c

Download Submit
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe

Filesize
2.7MB

MD5
8c2f0cb4fe0669d72b6fbeace9e375a6

SHA1
3ed426c730b7eab2068ced89f6aa1d8bdc4ac75c

SHA256
8672723927495625c1dd5fe5eefefc00cdeb2905db982522758ae2c5734137bf

SHA512
ceed87c3c8d418b8db827a52f995449ed114396a2b445528ee7e25343c01085d17308aab46a29d45d254b38c6ff0cf85e6ab31db34eb9ce20be60a0f2bd52873

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.cat

Filesize
10KB

MD5
f5ddb61685b8332e99ffcb7bc5b263ca

SHA1
6e72897de308ae0494e63389340e83b1c607e8c8

SHA256
7bdffc91246193a7a6cafb0765fcae69f5bf91f84f6c483d8afa3868ccd71fc3

SHA512
69244fe33b9e35aa4c559cb8acc45ce7030762f26b2acc69198c9daa43a147cf3b8cf728b12ae95e9e37a4e60f13ab602a26c73b73b98cf2127ddd363b99da5b

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf

Filesize
2KB

MD5
81785d890d8115416554e545e3963651

SHA1
470cea23f5c8a0c64c84aceb35a0b8288d70400c

SHA256
c88c2da48932b247196ec915eb7e72403063376b4d8d35b582c236fdfd912bcb

SHA512
3a39f0d368eb15e73c69008b19f0b9561a56cc4ebdebe7d8cd2a57fa975d954a7660d2de2b74fe769dd0d78dd836d3033624109483f2e7784dbb470d38418ee1

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.cat

Filesize
10KB

MD5
883c874423fd84bda6f4f0941e61acd5

SHA1
75bf0359a5e04d5ad298846d82e974a9680ae4d2

SHA256
78d80aa1c51007853cbd0beabc5f90f20a588a2b22fb3886b693eb2720179d3a

SHA512
851173889ca6c0e859e98bc9a1dabfcecdc589a845ff036bdd70db2172ff47901aeb281eec83a9adf96a2a35bc1a638053d1b9750ced6ee2e1a7a81c8394bbb4

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.inf

Filesize
3KB

MD5
f07b83bffa21b5820da5f2b1b3878c6e

SHA1
b182ec163b2a13692c5d496ee0a442d3e23e4f00

SHA256
898e05b1935264736eb69f9b0be36f2815ee7ec7135cfc8db38c6490ec10b944

SHA512
d9477953f8a2c53a213a4b9b8d8c09b030c3a265869d676d06566dfe95072c51f77f8eb6aa01f86f88485d7e856ef1581c33930d7469095d29bb1a295855fdf6

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.sys

Filesize
190KB

MD5
bd852ea819ac44f17b4beebbd568f212

SHA1
e2f549d235e5d2c6824c7dc50bb09c6c083dd304

SHA256
1c317b5c535efe02446d8793c6a473e3ed51f06881b310906344e9e3bc5792b9

SHA512
e162dacdba163feebf91acd43792aa2669cd4e7f13f0fdaedc1554492e8135ae104aad06c651959f20581d9bb2b49f3d6a559bbabc43ea8ab6ed06d850931f01

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.cat

Filesize
10KB

MD5
e7d92b205a789aa958239fe31a69394d

SHA1
ef032676c67720523a95fa697f91be28089f5ce1

SHA256
1918cdc5d8614ae8e26074eb77f919caec917b9974819b4ee42884ddf1116ace

SHA512
2818e3f7019d95abe085e95544c620c0effeeee70091960caeb4aba03bed0a6fc79bae91a442b1d038e424fb292f3fb56f29344df58a179ad875016644bcf6fb

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf

Filesize
3KB

MD5
d76b6215058c8d581bc7ed476794ea05

SHA1
e9aac803d1ea08560064ea01d63214ef42e39931

SHA256
f657dd259d84dd60da119e8ffc0d0b70aae6655875af4d72674d072543ca259e

SHA512
eb25843f06078c1fc8a84a3312d22e2bea544f521a501b92f55df234068bcf309266b0ee18ad8c0858602de721d56073ad13a074d7343dd706dffb9e5a85c6d2

Download Submit
C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.sys

Filesize
1.0MB

MD5
0809df0b4b50b73e67b73ce9754fb482

SHA1
5bbf156438c6f53b426d451800ad31c18113d30e

SHA256
70c9a26893e09801ef872a8d93555454b520f60867a99df501607346a60f1352

SHA512
da9dec78d03ba2db5db957dd45e926e17fd4656c3e9823f1e0582968a2f9f4d97d4cc9d9e3587056c74e6384260476617310ce13259b72b1cc5c0a6c175501c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
d48adce86d77e4778a3630298aa6dbe4

SHA1
f7350981804ffbb7672bd9fc3e55d4ec844a022a

SHA256
9ba8e59e632de2aa13b57a5c7fafd578fce82ac321d4265d0687c1784182b3f5

SHA512
5a5650af5c7b394fa9e9f98fdc2cbfe3ef73d0bc2047ed237e67b93f7ec8bd6b76550afc31393319e26e5348d7b6caf042c5518cafa49c9cb8be647578be3965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD

Filesize
727B

MD5
44d43e99da0603f1fc526ca64ab66a55

SHA1
63dfb773ca1f96fb019f78ad214d76534fccf2b4

SHA256
8bb4f4da5ab40ce449ac0378d2dd38f9e26d07619543910f01da1a0b90952346

SHA512
de9389bdcc15e687dcdb1f0ab116964e2e9f6f97890ba2fa283ee5b0ac99cc478eff61634edcb686b97a9f743d752aa2738ec52f5ddeff0f7145bcde93074eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
ae52a5af3d7ea26f39da69173ebedcfd

SHA1
d3fe0eb47d20c24440183bb6335f3dcf09bc224d

SHA256
bf813fb80fff27b8ab96230795b002b0246251c6e678b41a6654ceaa8fe8c63f

SHA512
f717e41ae85d0bb6a6c08d8f9b74f62f9502030da56fdd8821723414495e09889b32ec755e0137749e2a8c61a0e5447b6d86b86c4ae1a19a0247403156c9bf0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
bc56c552c9d131da96e436530c7a98db

SHA1
ea71fcbabdb563b72ba474da44c657062ba879af

SHA256
a26bf88c808e9954e2d0a455ac8db8a849b724efcb9d9e19be0edfb07c801041

SHA512
444716de24f0875847cc3e2f958502cd23f85677ba8d14ab1d08536c026fa424d9ce6a0ac14c07296cb09783a1cb42745838f521e789232cd701fd1d9b51013b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD

Filesize
412B

MD5
571fb60e7ef5026ab352a683d5c47a94

SHA1
ffd0041b86cf85f49d6556b216d892b2615fa55a

SHA256
a1f8af8aca6fa5313a938817926e0c91f965cc170054a6edf0a4b0ecb9944de0

SHA512
5bac8da1039906b5d2a835fd26370fe6064f9e9f88968430aff24a99efca72045d80beda0655779c4e85e380cf767837d65973aba1906208f1d24edeee31a0ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96701b8be7e44e8634c0ad149773f752

SHA1
cf63777d0b247e3be5b61e692f60b60638aa789a

SHA256
b2cc6552a5adb8035e0dfd30fa4072f3e708ad4884ceb893d2d4c5066ddb231f

SHA512
fd52fda27c8e8384d8994919c508f400daf2aaef3790d217339eef51ee28d55ecb1ad06de6651fd6c95df53966a68696b12ed29a103a64f1edd72ff6ff662ea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
b44f8122d53446e430ec2f79b962b0a0

SHA1
75995a601e322eb8047e994a2eeef999c2b209c4

SHA256
f5929c14a20604b34277ea48e22ffa1df9ca60fbda9fe1fe8d4f1fb63746b853

SHA512
05b015f11202f42a06009d326308d424e9ce465937dcf6c5f12815958053f8c5695fbd8eddd74e9160251f458aa0ab49af816ea81cfd80d2f28c41a2522f2005

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
8541d954999dc14055933b933228c8c9

SHA1
95c9ef6b5edc1f4a6709702aad6cc94fbe74fcee

SHA256
b7cad62df8df76a166b8c319088cb194f50ec4b737fc29b0d16d8f7bd01e6b5b

SHA512
d47f53523fb905b97d9b9005e4f9f70123154ea0c0b7a9f984ae8b7f81130084963deaba030b5ae45b68d2fbbf4c9496abe5678df0b1ad677d02fe0073df511d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab893E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE4D4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
f32c25a5466aeaac23030862f04ff410

SHA1
43cf561f8219c889e757b041d7c06cfdb5f7ae70

SHA256
614913da9d0e0cb0f531fe1ac022fe5c93d22ff6949e7d33e1b95a6aeae41d76

SHA512
57b8e0dd0a554acc95dbd3e01db72934b104e0eefef002fb559e4c219b4d152ffe6cd047a3146c19e7f936f6893aca155d25aeab9d7eff4477baf4ca004f7963

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\665bb83c-d815-4755-a11a-2f0d71d14e53

Filesize
12KB

MD5
659374e9fcaa38cad0b64b9f8e78a998

SHA1
4d7437825c675302466b9a8ee574a1db2180ec9f

SHA256
059d6adf2ec294f3bf515a86afd24416b5594a54029929a2feb65a476637149f

SHA512
5c1caee2ead181404f2c7c29c2391f95c6b9e8cf852e4e71ce608b1f08a5e963e14ec60b60c5de1b78651ced25f361c9fe83f8af8aec94f5f390bc42fbb92895

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\7551efb9-9028-489a-9d61-b84ccdd0b1f2

Filesize
745B

MD5
8ed81aaed4d79768efb75e4250392626

SHA1
c44714a5e5e696d3f398153d31f7ca131c24644d

SHA256
c159e31f8a801d258cb9f477d852fe9f0ca3351168213aa38b4ed49eb70156b1

SHA512
1bf8728c722bc97968ef2fbb65e4900364d3e7a027c2494bde1aafac23a896a36e664b5d69678d372cd100c9ef9f1d5826f4fa2b0f625396737403c9ca4f504c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

Filesize
6KB

MD5
3ba131da5b867c49e7e8f9cba9507df9

SHA1
efda98d475023988f2674bb3972c7a7eeb755056

SHA256
6d74ba84dc68665e4fc178e99b06b32c12847d7441299388f434c928329401c1

SHA512
67d69c54740aa6f11671dca1873ead4b08f1939a5a89e93efdfe3e55a4d4b794d2f652b57c15a1dd887adf922ecb40a514767f392cf59c5d9f4a6f2a16d52667

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js

Filesize
6KB

MD5
ef5eca33a0f3537bedcf849a2026d972

SHA1
82335971ae40295e0e9c5202383e9127c5fde98e

SHA256
bd548907046b4216c4e8017cabf85caa30ad0efc13d0858dfb76deae94ef8a51

SHA512
e71a9e361c764fb50091f5d9b3ca442d48ab32c56c61b626bef4a8f2589c0d0ea8ebf9f3b5e2d14a7bc97598259a5eec441b7d3ed89304a4e4a3a1c3377b4bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js

Filesize
6KB

MD5
bf2b1eec816bfbde03f2577c5bfc284f

SHA1
933c2bae43beac96d49af5b97a2be27452e75dba

SHA256
a4ddd81131e6e33787867b94f0913edec1b612f80948a3f7bf86974b44551da3

SHA512
ac23c5a22489dc55882c13dbc7bc369f17900cada3cfe6c87d0fce5265d122d2f857ecc0247b4727f8745736ceea7cfe4701b783177744fe100d6da8b0b8f1ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
39c5841082f8573684ce37f460559425

SHA1
f71b858d5fbd7d00e2895df35096f960ed9aff6d

SHA256
920549250afe5db06308a0059bfe508665ffa885b39ad580ceba33e3841c24ae

SHA512
82824e172272ff30567c9404b38f83dcbcbcba48e041cc1ea0c9f445014dc681fd90c176fa4a7f5190c1667883dfbf2ecdcf0453b40d5cae7873fec2059fab28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
3ccd1e23728e9ac8a902dc9d1b5e0dd0

SHA1
242f6b1fe29097a1ddb6a69bb8104aa81f3741d0

SHA256
73d8e5dc3b59a97043b6011b10b4dbfd45e5edf3fadd664b1a8f1f75f50b3cb9

SHA512
ec98e9f1f8589884ad02b0cab177391b8ffd3ea4c39b6049cca10f862ad608b1ebe088eee0fe09f097aa500d8cb9c50bfedae84c5cdfad4d6281122070f54c3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
68d796dfcc528c7d37430f3a283d3ea3

SHA1
beb3c1d07be648a432c789f6ce2ebf5c6e30cce3

SHA256
b279c278e6c0864d88cad065c1ae0745becddd0bf7699dfd6d6ea430de78d158

SHA512
0f7af66205b6d7eb4dd9d638ddd673e1cdc0509ed3720ec1744a5e975b3b6dacec7e6bf34f6a6349aac7f395e943ae48be2b54abcb1e966ab9dd0bba407b77fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
67KB

MD5
844c068037f5a407dec02207ceaa09c6

SHA1
46a909114137b61df9ca7373e657761aa3e03ead

SHA256
e98272bceb534e8cff360ab1138107c40574ef8cf7a7cb2e9761b10776019219

SHA512
e1e3790b99073ceaf52fa743e1de6a3b552a929321a24ee14aab738d36101ef08f4c88066688198d4c47b67d8ecfeae4e9184e59564184bea77f076d206a11f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
201532dca52a93d5b09b363c1b1b86d7

SHA1
5d48f70931913d8bd225e9d524212d2918eee708

SHA256
27354436c2fc1e6c53de992ddf5828fe46f07574d7b007e1e75e70489d53e16b

SHA512
97ab0ff06bc0599f0d14bfa52f398b006d2de36e5503a6c9aa3571ba789f0ce69e1f2de5647dea5e096cf7dba430301760aec8430f82d672f61f5b2e878ff5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
77KB

MD5
626ede1d72582a10ac2d5abef5e2185d

SHA1
3cc37e19ab35d9b2036a8dcf6768b3e1257be99e

SHA256
6fa70a89872727bb844a0ca05e96a2a702929bbbef1a63aeea3c94ec0ff1bc3a

SHA512
fbe83df7810cefbcfcbeb029ffedf3b2215348528d77a8f3eea7b3ef659727684a17b587cf9162d5dee0496c2657f06148f217edfdc05e8e190e39dac6a0b2b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore.jsonlz4

Filesize
76KB

MD5
8de238b8ef30621886dc6b3f061e790e

SHA1
3fcaf566a5737b8bcfd474055a0b8b5c74462cac

SHA256
434ba572fd961500df5c1a32983f6493fe718cf2c0f43423d24d6fcabfeade15

SHA512
843743ab850aa5da630efbbbb63a66e38fad9fe2a497fd27cc155b142b97877b950aa01151013ac7f1d866893f0090a6c9d1e94dca73abe5a2fc114743ec63b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\storage\default\https+++www.youtube.com\cache\morgue\128\{33dc879b-c777-49c0-a64b-d305b9d45180}.final

Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\storage\default\https+++www.youtube.com\idb\3453848827yCt7-%iCt7-%ree4s8pdo.sqlite

Filesize
48KB

MD5
348fa6c4e6dab0a3b7ee38d44dc2b2a8

SHA1
9071eb97d66a75b934b9ffb5a7ee5730320c370e

SHA256
f443d4125c7b0289f77401ca55d04ac7db36a79e5f59f080cd21dd915a46291a

SHA512
4531728eafafd6af7d0ef3d1be4828e66d76112bb6b760cfca4333dd4dc11e2a901d70188d929b98fc61d98a55f97cb44e98b619559347aa9e86f16f32be55c2

Download Submit
C:\Windows\Installer\MSI72B6.tmp

Filesize
330KB

MD5
ac831c25bc16a05ee60aea5d79517434

SHA1
4946133e7fac34315a0ccaa30ca8ad383d5f0140

SHA256
947f8fd98efb1986df32a9c179eccf720376721798cc15d4cf9e31cdb8324869

SHA512
72f625386a7af35b58bdb70f35b8a29cd06c091f04e4cc2f9c7ec1c1ec194e4fb120b5528b55ed589c9daa890c1bdf8762dce1e17dd69a77ec7a002d2685ba5b

Download Submit
C:\Windows\Installer\MSIAAEC.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\System32\DriverStore\Temp\{09df6b13-6907-7b6c-ff64-d351607a021f}\SET17A6.tmp

Filesize
240KB

MD5
83e6380b648c6fa9659094bce716d9ba

SHA1
a8a97d3dcba0792644c29f04b832ddd4ffb0e35a

SHA256
7786fa5fde0234b77fd4fbc131857fac471b1dafd42ccf6f38b3012da3b8098d

SHA512
251613f93fb624da3c6daa30ca3b1ff80351c421639b3ee034898bcfa8dfc32c04af1370d0e470aa11c20dc64eaa8ea142bc31e544fbb358272efd2316ff73f6

Download Submit
C:\Windows\System32\DriverStore\Temp\{09df6b13-6907-7b6c-ff64-d351607a021f}\SET17A7.tmp

Filesize
10KB

MD5
0e63a63298ed8b9f12491f2f7519f6d6

SHA1
a859d3b90ce90c4dffa8587dd7e90484e4d49f6d

SHA256
7911b7015fbece690efe1641dabbb606d355a70ea4440fded55d40c10930702a

SHA512
584ef414f897cfae77cad14ce62fd2684760a7e52d52ec664695d1f6c94217c160d536c458c71b40e56dc59915893a8e0fe716150941c4b2dc3d51ec91d0b675

Download Submit
C:\Windows\System32\DriverStore\Temp\{09df6b13-6907-7b6c-ff64-d351607a021f}\SET17B7.tmp

Filesize
3KB

MD5
39d54baf75931606454607628b8cfd56

SHA1
0c0af5bcb13fa4f9303adcaa5e1bd863850d696b

SHA256
c96d4504e9fa5a7cbafbe01b3a436848b7ea8c95690a533ac7d4453b5ebd17db

SHA512
3dac9f6f911e2a1daf1b04ff6ea2f1e23cc78fa53e67d4fdd26e641e290921f5da9bf9c4f6442eaf418bdcd4d3a9f1dc5fe558c4b3d34db7773ae451ece3b66b

Download Submit
C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD72.tmp

Filesize
10KB

MD5
e28556a9743e61c50de94ce0007b6b51

SHA1
dc9f54ccd72e216a0d20659879c67681e7d8115c

SHA256
8e2ad2a3f8ae999a5f2adcb635bb71442d1fd7285ee6ac1b719b682120380537

SHA512
69567c6e1b505bb1e8b54cc50fc94e42bf5385ccccde6154ed4c98da9e62e6e67e23a44b70687d499769f35edbd465b4aed677dca483064fef6aff45e347d5f1

Download Submit
C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD82.tmp

Filesize
4KB

MD5
351856254220eb250d62f4547e9aeb96

SHA1
c7a72d9f7b783ba54b5d8839279dfcba689a7c11

SHA256
c62c8264b3add792c706a4e76b643fe969b69ec902651b5d31974c42a026e619

SHA512
4e6bc35063cb16c602dc4c6080c8ca8b48dedce63d01db7efe7576e24a82127ddfd4ae00f052a81e4779d517045e8477ec61a7cf71c378fbe491aec54504c2e6

Download Submit
C:\Windows\System32\DriverStore\Temp\{4f083bc8-ca62-0049-0428-645db5fa157e}\SETFD93.tmp

Filesize
250KB

MD5
68c5f8884313e9c5ad1d54fd7181f140

SHA1
40e747ce98f899fb8beb31dacc2cb261092ad6cc

SHA256
de4a67670417fe97e0207d40f38317104548d4ee77bbbf50f269dfc8ef655a9c

SHA512
6433586185dd5d07ab9cf7141d64a55a33fea3872e6b2616ae0dd8e75820fd0eac7593cff39fd6262dc0b1c779c8c3a8a7bdbdde2b95e9e1aa74d3613419ee7b

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
194KB

MD5
85d3f2ebff6b50fd609bb91d7c9edb7c

SHA1
2a80df398e0a44ec05c38dd445a1015c2968a1e1

SHA256
ef5e08f52567e7468007f06607aaafe12e6798c20aca04c62e57123c8d7db9ab

SHA512
cb8b83b1353932a5f281dfe2b680c0651a6dec4f3053cdde54039f18c0c88c5788a741303f22abdb9052950514dd3442cc85805f2f71e05c1468ac417830d87c

Download Submit
C:\Windows\inf\oem3.PNF

Filesize
9KB

MD5
9066e0feff26dffb25072a977cb0a2e3

SHA1
3f3819a7d6d6dc216ab013c36f16fb7f80c73be7

SHA256
47cde8ee95ba53af5cea1c5ab9dd772c9d1d862cc14bfd82a8d3d0c349f50984

SHA512
2043af51a0ed4484b3f4526b26b4b445a160e8f3a23648970600e01e8f8e2e4828436ed2af98f5e7d2f78b53924af3449a31bd862aeb793a1d7a1bc9326f8701

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE6D8.tmp

Filesize
330KB

MD5
170b0049505e4312e410dcf1e683f0a7

SHA1
be2c41ff3c49a2ad7027df74d1107327b145e8d4

SHA256
67a1517109bbbdd924511a7896bdc1c245a939ec6fbe926e9077837b93848450

SHA512
dc5493b399e6781dd7bb28981e8835c4c004be9479b47b92cdc7300c1228bde4ee172f14be40155d5da7b71782b5f1a940a80d7aced8b610571c062873da3994

Download Submit
\Windows\Installer\MSI7854.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
memory/3860-1420-0x0000000001DF0000-0x0000000001E16000-memory.dmp

Filesize
152KB

Download
memory/3860-1543-0x0000000001DF0000-0x0000000001E16000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads