purplefox | hxxp://207[.]148[.]35[.]106[:]20154/C558B828[.]Png

Analysis

max time kernel
121s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://207.148.35.106:20154/C558B828.Png

Score

10^/10

purplefox discovery rootkit trojan

Malware Config

Signatures

Detect PurpleFox MSI 1 IoCs

Detect PurpleFox MSI.

rootkit

resource	yara_rule
behavioral1/files/0x00080000000226e7-42.dat	purplefox_msi

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1880	msedge.exe
1880	msedge.exe
1848	identity_helper.exe
1848	identity_helper.exe
4104	msedge.exe
4104	msedge.exe
5696	mspaint.exe
5696	mspaint.exe
5792	mspaint.exe
5792	mspaint.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5888	OpenWith.exe
4068	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTcbPrivilege	5300	svchost.exe
Token: SeRestorePrivilege	5300	svchost.exe
Token: SeDebugPrivilege	1644	firefox.exe
Token: SeDebugPrivilege	1644	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe
1644	firefox.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
5696	mspaint.exe
5888	OpenWith.exe
5792	mspaint.exe
1820	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
4068	OpenWith.exe
1644	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3752	1880	msedge.exe	84
PID 1880 wrote to memory of 3752	1880	msedge.exe	84
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 2264	1880	msedge.exe	85
PID 1880 wrote to memory of 1904	1880	msedge.exe	86
PID 1880 wrote to memory of 1904	1880	msedge.exe	86
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87
PID 1880 wrote to memory of 4880	1880	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://207.148.35.106:20154/C558B828.Png
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927b146f8,0x7ff927b14708,0x7ff927b14718
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10472586712238810829,6794741385765056238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5604

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\C558B828.Png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:5748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5300
- C:\Windows\system32\dashost.exe
  dashost.exe {57a0d806-bcde-4a1d-bd36ffd1101ab144}
  2⤵
  PID:3068

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\C558B828.Png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4068
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\C558B828.Png"
  2⤵
  PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\C558B828.Png
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f91eb06-542f-48d9-ba8c-a1391cd98e4a} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" gpu
      4⤵
      PID:2568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {248d0c33-81d4-43a1-b392-63b0e8ad1d6e} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" socket
      4⤵
      Checks processor information in registry
      PID:5248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3000 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4cf1d3c-9958-427f-a300-deabec7db71b} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:4536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3600 -childID 2 -isForBrowser -prefsHandle 3508 -prefMapHandle 2760 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e503f1d-304e-4683-8d2a-088cd3949f52} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:4452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4416 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4572 -prefMapHandle 4568 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba4a9f9f-3bfc-4e88-b69d-dbe752625ad8} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" utility
      4⤵
      Checks processor information in registry
      PID:3012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 3 -isForBrowser -prefsHandle 5412 -prefMapHandle 4316 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ded990c-ba19-4865-a017-7d2ba4df9941} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:5732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 4 -isForBrowser -prefsHandle 5612 -prefMapHandle 5556 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73339921-ec6b-48af-927c-16648328d38b} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5780 -prefMapHandle 5776 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1316 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {227cd428-c183-4b85-ab78-c9381a6a8e5e} 1644 "\\.\pipe\gecko-crash-server-pipe.1644" tab
      4⤵
      PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
1.4MB

MD5
c12241be2c41ae69187ca9faf83494ff

SHA1
5b1de649f2bc4eb08f1d83f7ea052de5b8fe141f

SHA256
43eef76fa966395bde56b4e3812831ca75ad010e3b8216103358deb09bdc14d1

SHA512
0b2dbf2278fef86a122952683668a795e76cb5e30c1d98b52f5fa5dbc9f1bc152c64aeeab69c9c4befd27ded3f879a3ebd9bc135c66e164d14ae5e8189c1b527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4df1fdf025cd84c846b3c6de2d6b416

SHA1
55bcb9ec3bd3c7db9d0a339cf8353aea49c3eb73

SHA256
b93adebb34cc81f53b73d9c782da2c002c6d7556c665ad7e8e93171227703292

SHA512
4b3581a3963bd9de9d07042b7e802a070c57a4a554e25a31ec152adf2c28187973121624284894d324093e8fee44e1aa257efb3aecfd8cf678576273c07c5276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17b12d77ec31bcec8c12673f767d9dbe

SHA1
7b65ad32e29995d00e98e7fd37350ff29c3fc650

SHA256
edf412a8806847a01f755fa5adf7832e5228f0f50f50eb048dfca20ef1cef2c5

SHA512
f9183e8f96b6b052c1ac26e11add071f7b06c659c588cffbfd25146b0f537218519bcd71b1e5f66787d1e32c85dcad26c2a22dca5700919e65e2e1b34b27fdc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f1f18d37e866e99b49ef28ee11de220

SHA1
0472203f05fed328dcf93590e1f1ae61564a1ddb

SHA256
3e1cc9e79b8dd24affc897c485410e4de82fabed24c99b2abd1ff7df396b9e24

SHA512
85b0fe4341ae2106110d6a6aa703894f6734ab554a832f7f13807551c5e23abdfe5082d4df84ad1a8bc6fdba494ec56683b307a5d739729cc53a86b7d4b0d31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6bb9d47443520ba7ae4178064016fed

SHA1
c45a8ce2f93197db92a551cd20859e9e974da7a5

SHA256
bd095e11bfd146802ed56be47cfc9891145b51f05e9b943a50ffe75bc4415ee0

SHA512
916124ee7977a72c009bd4770da752ab5ee29461a3ac43150e678ab250c0091c86b7d5c1801c5ba833b698a589bfe07b80ce28b52e9a7dc8d3bd8636f3d25c51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
9aebf2b474140c912b4cf735cc4b154e

SHA1
c5ceb5ace373eaac6ff96e71df6cde24f0841de6

SHA256
5867abcddbdd9c2231d0a435b0c4dc74f5202475e2fed562ba45f78711e07b31

SHA512
545b073123d443636e93d574394386d84d44349dc78ca239efa66de8ff2582fa4c666dc8a877a80e316c67f1dbe0aeb3e30e43fcf3cb3a65d90c35f3baacadad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
439e5447bc6e026d4141da23da24de7a

SHA1
0e7ee40e06e097f9d59dbbbc5c7a9eb57ea84f82

SHA256
a5c826ce9fda602786dc41f1b576ca513a76e9d3b7bbd7dfc0e52ea590a3e287

SHA512
304fa466a1a6cb53025517383a16a195a5d9f41f15090e9112f7d8dc718d8a03cacf1a8d7c19360826289223edbe8d515eb3fef090c9072b6e40da1c22164087

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
8f35c4bfc635ebc4a7ab28ebd39412bf

SHA1
cd350ebc367987d3832dcc0c4b5f297834c707f7

SHA256
974a4b0bb64d37a945c3bab8c4e18d53e5c9102fc0046240cab5a34a7e39a972

SHA512
e5e95cdb3b10e7fe0fe18677b85ab96412e0e43253a354ffe5fdeaad38bf48c7d9f6d541ade2952b8c823c5258d51d045f84180b956dbbae539468206288f08a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\08838c57-4235-4255-ba98-36432921d3a4

Filesize
982B

MD5
f43ec94ee768ec815a916f5341a746cc

SHA1
bc8e6faca89e646c578c38607c15e293922a92cb

SHA256
0685f5ed46fabd500286e7bae29f3564ef35195808cf660d03cb07c5cad7f03a

SHA512
5551e60af25be835b0c5e48923ec1988391824858593771da7a5f7995d6a0d0df2e5cdc508df35a270e3d5730d1e1b4de4a0e566c05ff2268429bec91c804f4c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\5985e7ca-539d-4eba-8f5e-ecad8cae35f4

Filesize
659B

MD5
b551e64affc3faf544c5b302fca9c164

SHA1
4f5a75f564e107cb267ecd14d2a81fea1611145f

SHA256
a17d1a76eb53d45f6e06e19c7cb85fe869d0ca8e20e46d39df7337e5814585f3

SHA512
3c69c5e4efc2d908cdac10502c95f1f5f78c9b8edb865b6cfa274c863a994c032e7ba541b2bb6d6f6a81566687932cfaa8c65608958adcc5d58fffc38625955b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js

Filesize
10KB

MD5
b1234ddf1ff896878e75874e9af98e2c

SHA1
29ff08922821f63e4346a8dffbf7d2c1760d1f02

SHA256
a0daf0dc4b5d1e44880442688ca17a73438c0314f0dce0c2565a73fdb4cbb7a9

SHA512
c63dda6384ee0ac19d8993976cc8be60ccaa384b840a5ec738938c4c378ae4b8b155df600eea2a18f07db7dfe1eb32afe43897ec33550ad8f446c6b2d0688ff1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js

Filesize
10KB

MD5
7316597151925d46238514daed6d44ae

SHA1
6aed2a81119433d195ca88d58c7c3b6e00ff0b1a

SHA256
ab0200ce35418cb40f9914cd73832b297fec778930ba869ff3a4b9eefa80b582

SHA512
3c2d4e60c4692c0d487a4459b419f8bbdc2af5b2f41b3b8e2498e4b6c2d32aebf4c8961804bc9517bc6c334a474cbde1dcd1afc5c2096db706135b836427acd7

Download Submit
memory/5748-76-0x000001A8FCB50000-0x000001A8FCB51000-memory.dmp

Filesize
4KB

Download
memory/5748-77-0x000001A8FCB50000-0x000001A8FCB51000-memory.dmp

Filesize
4KB

Download
memory/5748-78-0x000001A8FCB60000-0x000001A8FCB61000-memory.dmp

Filesize
4KB

Download
memory/5748-79-0x000001A8FCB60000-0x000001A8FCB61000-memory.dmp

Filesize
4KB

Download
memory/5748-75-0x000001A8FCAC0000-0x000001A8FCAC1000-memory.dmp

Filesize
4KB

Download
memory/5748-73-0x000001A8FCAC0000-0x000001A8FCAC1000-memory.dmp

Filesize
4KB

Download
memory/5748-71-0x000001A8FCA40000-0x000001A8FCA41000-memory.dmp

Filesize
4KB

Download
memory/5748-64-0x000001A8F4760000-0x000001A8F4770000-memory.dmp

Filesize
64KB

Download
memory/5748-60-0x000001A8F3DB0000-0x000001A8F3DC0000-memory.dmp

Filesize
64KB

Download