bdf0e02d72c8ecec7c4dc5574c635a764082d730400cd533ae7ce032ee16ae86

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDM.v6.42.Build.25.Crack/Fix/IDMan.exe
Size

5.7MB
MD5

652b4e646e14a651e6c936c3909c5404
SHA1

3fa88a992cfc0126cecddf850398b3d056fa7c7a
SHA256

13a29b81ce68591cbc09b8d587641e596133bb0ca9752a2bdab3fbbb34bbe0fa
SHA512

0e8f13b6d385e2276c1034401dd30c443c544778a2330982bd196ffc564575e5b7cf5cfabe22174334534630a90de30f4b3b39cfb715681e054c7568604c5aae
SSDEEP

98304:8kpMLhPQYA/QORwl6vKjq6P4Yqc18frP3wbzWFimaI7dlo8:87LhPQYsQmwlsQ2gbzWFimaI7dl

Score

7^/10

adware discovery persistence phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

IDMan.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation IDMan.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	IDMan.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

IDMan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM.v6.42.Build.25.Crack\\Fix\\IDMan.exe /onboot"	IDMan.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

IDMan.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regsvr32.exeIDMan.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDMan.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

Processes:

IDMan.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM.v6.42.Build.25.Crack\\Fix"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM.v6.42.Build.25.Crack\\Fix\\IEExt.htm"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM.v6.42.Build.25.Crack\\Fix"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM.v6.42.Build.25.Crack\\Fix"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	IDMan.exe

Modifies registry class 16 IoCs

Processes:

IDMan.exefirefox.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "322"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDM.v6.42.Build.25.Crack\\Fix\\IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	IDMan.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

IDMan.exe

pid process

320 IDMan.exe
320 IDMan.exe

pid	process
320	IDMan.exe
320	IDMan.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

IDMan.exefirefox.exe

description	pid	process
Token: SeRestorePrivilege	320	IDMan.exe
Token: SeDebugPrivilege	544	firefox.exe
Token: SeDebugPrivilege	544	firefox.exe
Token: SeDebugPrivilege	544	firefox.exe
Token: SeDebugPrivilege	544	firefox.exe
Token: SeDebugPrivilege	544	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

Processes:

firefox.exeIDMan.exe

pid	process
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
320	IDMan.exe

Suspicious use of SendNotifyMessage 21 IoCs

Processes:

firefox.exeIDMan.exe

pid	process
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
544	firefox.exe
320	IDMan.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IDMan.exefirefox.exe

pid process

320 IDMan.exe
320 IDMan.exe
320 IDMan.exe
544 firefox.exe
320 IDMan.exe
320 IDMan.exe

pid	process
320	IDMan.exe
320	IDMan.exe
320	IDMan.exe
544	firefox.exe
320	IDMan.exe
320	IDMan.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

IDMan.exefirefox.exefirefox.exe

description	pid	process	target process
PID 320 wrote to memory of 1000	320	IDMan.exe	regsvr32.exe
PID 320 wrote to memory of 1000	320	IDMan.exe	regsvr32.exe
PID 320 wrote to memory of 1000	320	IDMan.exe	regsvr32.exe
PID 320 wrote to memory of 2468	320	IDMan.exe	firefox.exe
PID 320 wrote to memory of 2468	320	IDMan.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 2468 wrote to memory of 544	2468	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2572	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2064	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2064	544	firefox.exe	firefox.exe
PID 544 wrote to memory of 2064	544	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\IDM.v6.42.Build.25.Crack\Fix\IDMan.exe
"C:\Users\Admin\AppData\Local\Temp\IDM.v6.42.Build.25.Crack\Fix\IDMan.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDM.v6.42.Build.25.Crack\Fix\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1000
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f01f300d-9211-4df9-9776-25b91e40bac0} 544 "\\.\pipe\gecko-crash-server-pipe.544" gpu
      4⤵
      PID:2572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb805517-d527-417c-be93-847d2b2449b9} 544 "\\.\pipe\gecko-crash-server-pipe.544" socket
      4⤵
      PID:2064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1332 -childID 1 -isForBrowser -prefsHandle 1408 -prefMapHandle 3088 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8205b256-2697-4cf8-8b7a-bbf0c2c391ea} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
      4⤵
      PID:1868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3564 -childID 2 -isForBrowser -prefsHandle 3580 -prefMapHandle 3576 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {872655c9-2156-4858-ad96-fd156caf034e} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
      4⤵
      PID:5040
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4432 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4392 -prefMapHandle 4400 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e55e331-a270-460a-aff0-1de8d52d8bdd} 544 "\\.\pipe\gecko-crash-server-pipe.544" utility
      4⤵
      Checks processor information in registry
      PID:5132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5384 -prefMapHandle 5380 -prefsLen 29197 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9f976e2-7b7c-4896-81fe-50b025cd72aa} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
      4⤵
      PID:5880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e00a0934-7902-4f86-b7f4-a69d21495f47} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
      4⤵
      PID:5020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 5 -isForBrowser -prefsHandle 3136 -prefMapHandle 5004 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a199974e-a964-4dac-87b9-b88d9392d76b} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
      4⤵
      PID:4700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5940 -childID 6 -isForBrowser -prefsHandle 5844 -prefMapHandle 5836 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbdf8b3d-ceb5-443e-9a10-ba4883dc0aab} 544 "\\.\pipe\gecko-crash-server-pipe.544" tab
      4⤵
      PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json

Filesize
25KB

MD5
0f8fdc9fd8ce0fb3b8112ad1be5fa67c

SHA1
550bdd6d303c89ba0bbe7b2ad23ea7de0c1f2541

SHA256
fe124d9328cb6fc7fc86bf60133fd5e460b4a8860a60a5dd0cfae7a501639794

SHA512
b3095787b40e8f48f1691b8000884e204a09c762a09e45e5b6ce39b4fe718be1e6cc993d7b547fa0044cb91b294c98549c10d0b453fc08871188979c96f5a0ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Filesize
13KB

MD5
6118ed3dbadf30808f495b29bd62993c

SHA1
47ba595a11a3dd9d495b0d7bdbc952853aad8618

SHA256
875c822c515c9c7000bd8cca832358bff49b94941be44fda675f9fb2f4cbe3fe

SHA512
50e849dd872eae41cfbfaa5c4a6b3c322d837841e17ccbc2feac73b04efaa399670e9097d297880222272b5ceec0f698d37af8a4aefd37f134a309633f1d3872

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
6KB

MD5
8b33eddcf0c70281f9930d853e6c5890

SHA1
978593468d49915fbd2f1c971943ce98ba6f7cac

SHA256
40e41bb87ae5b520c645b71a060a606914db96a0485d47c2c2781acac9d8c6d7

SHA512
c277a632b261ca310c51d7b9111fa090a88140514623bcc6052e9adaeae697a78c3cc61349d1d3cb96bce0bb7aeb2b7662054a6c86d247882032babc0a453393

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
8KB

MD5
4a1d21c432a98c2d4032f284bb4e007c

SHA1
961b37515aa8cc8da5259bf0de86c2c6d094450f

SHA256
877957e21360193ecb67f6555d73c18ca0e2f20e0071129fdc97cb696442f5b5

SHA512
176f503817fda4a1d2a4c5f6ab24c47c2a2402c1e4e93344f1cfd77d3efb55b0303f01067c644ef01c509ed2f145b459bfee938e6279f3ab4ead7e030bd8908e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
12KB

MD5
b1179e28f757c4b87bbc54381810640a

SHA1
6d4a77294ef1bd88efb72cdeb2da0e40224498fb

SHA256
75e442732487ae3fe6b7395c16311ed6706eade57a8b3a7f6ca4d1557a91861a

SHA512
45382009f6a8ae61bc79b309cb25687b5e7954d89f96355b2ed922e6b05b22318af3a29300cadbd118a155dab0b951bf651e4a3c0088fa64eb820d2672f0995e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
30KB

MD5
021a3b45ddd6f016f2aaf184bb228ff4

SHA1
f5e1a96b769a048f5a6b782cced424976417a624

SHA256
9e2e7d1a7b241200cdd40852a3fbffa94f074069a7b5fe9e198337ab79c1a07c

SHA512
44018b21469b6f68b3adbbfd2545d674024e212128fac3b238a058f628aa1e76f6e1a919e636760ea2c94f8b7e5bc97ba7c5f8f94560a1c53b9dd83b70f57257

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
30KB

MD5
c187102c5b3b129ee96939f5b87c824e

SHA1
df387bf7366045c23b92a2a3e0c3a6537c6a191f

SHA256
0af3452f0c69b7113d20c5b719b7ff21df0a04e3a806d31d09ad25fddd362638

SHA512
f3d4f1c25f05d15226a97c023af2c70ad53c0aa8a5adf2621ecb2ac5c40d55d78bc3cc8bb1ba7efc8520dd8cc8c25b2c437c30857afed9a89f54c0f5bf2dcdd1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
70a688eb8ee384cf67e16b7d84518ff1

SHA1
e73980fc5b4cbc8b057e24623a6b77769a4d6567

SHA256
af2f51bafa0749ec28a635b108b610fe002ad33ba28888ac34236db813ce47a3

SHA512
a266c870f404a2a141cf9cc128ce679945e64c8908468f9b37735d5d831b3fb0e3b7ad394eb637fd20b74cdb50b581d501a37271649b8e887a44aad24df1517b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\1689ae69-e2e6-4c86-8e5e-95d12a198220

Filesize
25KB

MD5
8aa7e03eb63559c5e78cb7897cc2cb1b

SHA1
53c91d88b8066d09946459f9370aa5023580d03f

SHA256
15308cfccb79ef01cc82dd15ce085c0d8c6f77cdebb9041ac615c3bfc31ea519

SHA512
90fb3af4e91d78a3e1dc7a61da2a646f0eaf9999da8b640493819488ade78c6efce7f9e91740724412b46702166bd2e612ecd9eec4241f6f2864d7dbb1f2f03c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\3b5485aa-63bf-4eac-aa54-8088164a46d2

Filesize
671B

MD5
302a6e41f601c8312f00a3f16717ef42

SHA1
0474eb42df4b1a9701ac592178e0cde9c182eb9f

SHA256
24df7be636b5862e8d009c15e18f1583374c0a175c2731f7bb9581dbecaa77ee

SHA512
dabd9b5ba5a573418e66ff91e072b17fbfe1ee23092eb2dbfc0a28e6dbd00fa387c97f6f58177516f9fddd4be27797a30aaa2a8cc23b44c0a3aa23e335fe12cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\ee9a9bdc-bf67-4e95-99cb-e3c906743732

Filesize
982B

MD5
98b9ada41f9a154cc7e076f9baaa65e3

SHA1
148e50f12695910a345a4d05a6739b0d42dc6586

SHA256
65998d47eb861e071ddc77173d2a6860867e4e32efc962de27fa875f57070683

SHA512
88491856003e10680bacfba5f12f340c61a29cdddffd8dc3473a11f7d1730325929ef68a03659937c235b155f73c9b869f32f6f49d5f2af73fc141a55c086f9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js

Filesize
12KB

MD5
e90aef69150601ad2b7fd6608bdb4184

SHA1
ae8db1892683b62e2d376a4fc7d06fca0a11ed2b

SHA256
c056f1ff3b010d9c53820a1cf33d82a2b1ff6060e7885d3ec11fbc4e4f356673

SHA512
b01b1b38ed65a46aa242777aa0f064264714249bb09750203e5eda2bd98f426f2ad6f900f866202734e23b498b9ef813589a2215d3cfffd096b9fbce38048e17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

Filesize
10KB

MD5
29b12d6bf691fe2e5cbdd172039b12f6

SHA1
e4dd8699dc9dd5399f02475875f536885ca9ab7b

SHA256
8feebf1f8f29472fe236f0cdb62ba26522a4cc51b1cd5b25f40017660fafeaf3

SHA512
c707c3b2e5cf41642e7fe63cced545f81f0e4e8777e5ed3fa51b423840be80725edc3c71aa0e114a5be5427b27a64f3ac1ee2f2c3f07b2485d61419d74101adf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
86079dfeacbdd1bfd0ba427105d789a0

SHA1
07ef69aa33a25d5af668d6512bcc2f844dad32ce

SHA256
1ee9ed85da09f7bc7eaf89a6fe6215d5dbd4402c50a3a956c6d7c0c7068c8dc6

SHA512
c10256dd4bf5585402041479ed6111e2ebf0efda658acd65face4430f3bb48cec2b8e751d2cbf6c9f7c6888ecfd3068d6ddc252ae4f1e3c469c16dfd74bc27a1

Download Submit