lumma | 7a7e809bdd2430b7577b99f2e28a803f52a3b1e7f95c0da2980fee1cb7a3404d

Analysis

max time kernel
337s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

external menu.rar
Size

118.0MB
MD5

c2bc224a5c550413f2339183d8793e1a
SHA1

359a914dafdc343cb0d29318dda6c7d07cbc24fa
SHA256

7a7e809bdd2430b7577b99f2e28a803f52a3b1e7f95c0da2980fee1cb7a3404d
SHA512

3022aca0ab51bac63842fd0840203301f12da4e0a0a7af17f6e54772dc3f259a192a05fc496413fba0121330dacfb60b16f980140bae54ece5638f77e3af01c1
SSDEEP

3145728:7NzSEGDBQNRUzC2JD+W6bUfwu1jD5LefIc44LkQkJVh:JOKsHNsbuh8gn4Lkh

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 6 IoCs

pid	Process
5836	External.exe
508	External.exe
5960	External.exe
2060	External.exe
4324	External.exe
3392	External.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5836 set thread context of 508	5836	External.exe	127
PID 5960 set thread context of 2060	5960	External.exe	134
PID 4324 set thread context of 3392	4324	External.exe	140

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5780	5836	WerFault.exe	125
3888	5960	WerFault.exe	132
2760	4324	WerFault.exe	138

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	External.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	External.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	External.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	External.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	External.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	External.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 56003100000000004759d24912004170704461746100400009000400efbe4759d249265aef832e00000065e101000000010000000000000000000000000000004f88a8004100700070004400610074006100000016000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000004759f652100041646d696e003c0009000400efbe4759d249265aef832e0000005ae1010000000100000000000000000000000000000069172001410064006d0069006e00000014000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 50003100000000004759c44b10004c6f63616c003c0009000400efbe4759d249265aee832e00000078e10100000001000000000000000000000000000000defdd4004c006f00630061006c00000014000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 4e00310000000000265af383100054656d7000003a0009000400efbe4759d249265a04842e00000079e10100000001000000000000000000000000000000df19c100540065006d007000000014000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000004759d2491100557365727300640009000400efbe874f7748265aef832e000000c70500000000010000000000000000003a000000000054d6b60055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4544	7zFM.exe
4140	firefox.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeRestorePrivilege	4544	7zFM.exe
Token: 35	4544	7zFM.exe
Token: SeSecurityPrivilege	4544	7zFM.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4544	7zFM.exe
4544	7zFM.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
1816	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 892 wrote to memory of 4140	892	firefox.exe	105
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 4456	4140	firefox.exe	106
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107
PID 4140 wrote to memory of 2284	4140	firefox.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\external menu.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c09d7e7b-698e-4973-a506-0514c906d9e0} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" gpu
    3⤵
    PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2408 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21ec64c1-5546-41fb-9b3a-6d423d736cf6} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" socket
    3⤵
    PID:2284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3172 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a9ae345-d6a2-4ec2-b253-d9e764a29b48} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4304 -childID 2 -isForBrowser -prefsHandle 4272 -prefMapHandle 4296 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d8799ac-26ea-40e2-8b18-2dadffb9c9c4} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4896 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4920 -prefMapHandle 4924 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ab93ebb-ee81-4c5d-84f4-0df011e86725} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" utility
    3⤵
    - Checks processor information in registry
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -childID 3 -isForBrowser -prefsHandle 5224 -prefMapHandle 5200 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65bbf36f-0abf-481b-b867-577e994ee67f} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5288 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e2b6c85-2017-4964-9661-f0c25a0858e1} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5588 -prefMapHandle 5592 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a602e65-845d-4713-be1c-1ce0ee3eafa3} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6172 -childID 6 -isForBrowser -prefsHandle 6164 -prefMapHandle 6160 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8438913-f707-4857-9946-4d354f8424d0} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5864 -childID 7 -isForBrowser -prefsHandle 3524 -prefMapHandle 3512 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e797ff6-1aea-4032-9ebe-56680591b092} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2768 -parentBuildID 20240401114208 -prefsHandle 5548 -prefMapHandle 5536 -prefsLen 33371 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5f22aac-1103-4e0c-aa19-bbccc1407361} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" rdd
    3⤵
    PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5220 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 33371 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e99360e-3013-4254-b49a-01d08a7b402c} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" utility
    3⤵
    - Checks processor information in registry
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6324 -childID 8 -isForBrowser -prefsHandle 5508 -prefMapHandle 5492 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1085aced-20fb-4168-af25-7ca7cb3e09f2} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6716 -childID 9 -isForBrowser -prefsHandle 5676 -prefMapHandle 5672 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20abe288-c290-4ee8-adec-e74c571db4eb} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 10 -isForBrowser -prefsHandle 5916 -prefMapHandle 6040 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1020 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2cf83ae-9108-47f9-a847-c354cab0f868} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" tab
    3⤵
    PID:5596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1816

C:\Users\Admin\AppData\Local\Temp\External.exe
"C:\Users\Admin\AppData\Local\Temp\External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5836
- C:\Users\Admin\AppData\Local\Temp\External.exe
  "C:\Users\Admin\AppData\Local\Temp\External.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 804
  2⤵
  - Program crash
  PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5836 -ip 5836
1⤵
PID:5208

C:\Users\Admin\AppData\Local\Temp\External.exe
"C:\Users\Admin\AppData\Local\Temp\External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5960
- C:\Users\Admin\AppData\Local\Temp\External.exe
  "C:\Users\Admin\AppData\Local\Temp\External.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 776
  2⤵
  - Program crash
  PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5960 -ip 5960
1⤵
PID:4552

C:\Users\Admin\AppData\Local\Temp\External.exe
"C:\Users\Admin\AppData\Local\Temp\External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4324
- C:\Users\Admin\AppData\Local\Temp\External.exe
  "C:\Users\Admin\AppData\Local\Temp\External.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 140
  2⤵
  - Program crash
  PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4324 -ip 4324
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
a3bfa7dcbf1b6a3f3a41bd57d276a1e3

SHA1
41a43e4fd6901a406127423f891fd1e00b218618

SHA256
284c08815693a7ca0ee8f1b1cc247bb5683e0d63bfc609fdd5dabc7ac081db70

SHA512
75cfb86c148264c49daa660364feaa2d7d030f80d883a7297b380b41f47dd6e4661f2676c74087c6db56a975f2056cf479e10d16512d409efa71e40a17353ec0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\External.exe

Filesize
334KB

MD5
7abeb6aeff14bbbd069adf7d734d9d7b

SHA1
21c72a3a1fe058bf11a33e91f4f3c8a8c9fc0f58

SHA256
da81518a746a5d955d8e0dc51f3af9513cabdd878ae8c31e27c58f3095d0ea63

SHA512
35d12fde101bf5eed50145bbd3b87b71c4e2a1c36c3770e8c8f8e1b3fcf85bcf14533fa1ff7e3672ee2d89a7f119e36361de1fc4898f8dfcd696cc0b3ad1f439

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RTZECFF7RLOGMJXKB5EB.temp

Filesize
19KB

MD5
47bb8ec66ab102b88c3f5cbbef035b4f

SHA1
7f32046bf3885c84f8ba465aa75f040c2e2e3777

SHA256
d6770c8b5f1bca71aa225e04e065c6dadba72f1949c4e6872479d8b511669feb

SHA512
7f8e669f77427775297eb730dfa6470d2bc725d7783c2207e9e037636d1f1c9df4afb8772cf5b4e5bf4124f0e4a22b07851397f917e7a646afc9fb7c10c9bcaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
6KB

MD5
2429be5a0e5bd6cd5f686f4531190c62

SHA1
3d0c86b9f9ccca774e92f43a33fc5f2c06ac4e0b

SHA256
185d8419e659945fc4531ed00db2bf0873acee30c609bda0a5c81a8700e5ccf0

SHA512
ba95a5bb15c79bd8547193a757c4a631e363ae8bcb728d30f9d8d9f89750d6247c1c1d8a6772511a5d699be60d0e1113de8610e8c4b9f74db47bad1a72505664

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
7KB

MD5
2166c6996b54c187b7308f402f3064c2

SHA1
bc358637a2ab1f84b25666c7d987d6bec1d803bd

SHA256
ed4e2dac9c0df005d95a3b7b6c4aab721dd7ba912d95d918a893069fd20204b0

SHA512
9581710a7bd9cbd2e8e8f19ed210ad049bf0eeac0afe0b92ce8b821cd302106f8ed471d63cd59ec9f62fc4527eb422a2d9e84bfa8031e31db8335e1cf39a8b59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
13KB

MD5
e3603fa1b348cc3358bd4081c6c5e552

SHA1
c6aadcab5375fffc6cafbf541fe2b5d5d3cfd579

SHA256
af44420b56149f9cefc1190d1937ebf0dceafd0b9b86a1e5e277205be3a066a5

SHA512
0c23facb47c913e32fb1fec32b6937123c3e8e3a6c0bacb28b225f8c8fca67732da7113e21404a1e0d557c94c765585129c85fc0e4eaa36123c9bd29623f0d3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
d7f1526215dd950a205ee499532bf1c0

SHA1
b84ab8c1b7f428a344b0dd992bc1f766cdb26fc4

SHA256
ecb04b1ba050cc3ef560cf24a377aabc23fec39c2be3cb8660ca1d58bbe44daa

SHA512
21c090f181b4b3fe34c0f4605de4bd9ce5b06541b6f6d121bed48fb7bdc5c5952c07f4cf1c97b3d0394221b459f6f0c88d4e48bcbdad120259c8b53c0a6708b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\44e974aa-d793-4a29-a7e1-ef7dac51a3f6

Filesize
982B

MD5
65e02a0aec06f1a12c26306451b09f5d

SHA1
5af25bf6cdbd53c1acfbfcf4d26998ca5650b924

SHA256
674361a14f21ae7fa6078054a29a43c4d2c2563f121c9f3e5417e8774bb3a766

SHA512
51cbd9d966f490d9f03cf61409fb18abfa7c0854792da7fb1df2ef32dbafdd48f37ee0eeeae26ad7ca23a39ed0378aad462314300e0086567ac79bbbfe19916f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\47120445-d347-46b1-b32e-d41fd57468a3

Filesize
26KB

MD5
e73ea3358c3fa33cefae0a47780e4968

SHA1
3f6fcf356faa536375c33ff9c7a099854d3aafb3

SHA256
27df50f62aab8fb0505493bdc2933f4415401d4550e14d2503958c6d0b5a7ac3

SHA512
af8a1ef91d79060cdcb874484cef0ceebf7c0158ece0b59c3fac350e8c1685e6f35122e393f785103375088e4531ee7fdc39a2c7ff1255cad5b35f860c68be32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\de93aa62-6f4b-49be-90bb-b69674a486c3

Filesize
671B

MD5
e7f2fbf91d4fa99c76138ba50a36c209

SHA1
c06f61d152e5423515748893eaa4c923f10d8713

SHA256
d60cdb98e7eb49c4ee87114d08c9654aa39d4ba272f212a61305b5599217f180

SHA512
f9f87020e51806abab0665524ef5872034da509f836a8ea4619c7dd66f8f5cee904ab05700ddb48bdb5d73e8e4521e85f4c2f95d843c946b693221170d1238ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
10KB

MD5
b764a6b5542a2ca68f4ae28d4c5bb973

SHA1
c83336e909606f62630b0d0c59d5ea3b67eb49e0

SHA256
e5806fe585b6098331d9d08049841aa77b5034d05428966b800ade0ccfbb54a7

SHA512
da9ef80bf5428e697759b52a32da4a6500c2cb941b9b2e200ddaa4c4ce28bc594b2440d65721072d50a6b54757b8154d373e22a441e80b4b5aa1d945fc38e916

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js

Filesize
10KB

MD5
2091e16c380e1a7527f9fbc9e628ba98

SHA1
fc6cd141d0a6e71d80134701107c24c3abe5d4d5

SHA256
8738d0433dd4a432b5ee4f87213a64a5b9b52a0cf51be1e8114d418c4e209084

SHA512
e8c74e59ecbefae5a731e4b32a121e955e7e5c8b2ccab59bdece0768bbe7fbddfc4b8ffa04ba4d699d5e5c1725bf145663cd1f62d67a1c109231fcc52e35a956

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
bf34990cdba456bea16fca5752f9165b

SHA1
8d53363cdf19f522471cda8a9e72fe587c485257

SHA256
9deb4e5fc09c037834a09817b3a2e724d970c4af9a1cd84e8e525797b75cdf26

SHA512
9eb41dc47204be5d550ae3087e300604d949006f5a67d97a529c16ca19e0ca9c4a050bf2655ef1535364d89919c0b03f91cddeb99b6a0622592748e447e65694

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
a96010ff00050eec32a56e6e02e3dc7c

SHA1
5760163e2559b6d8b7d21300b2c6196e212717f7

SHA256
4191c368b15c4accee0aaf74657bb4094313d28a662b782fbf4b3a2a6a493c8d

SHA512
e223773aae8567cf9c03ba19b4ba7bb17193a8fed59ee1b369017b5baf110e5fd1b7d3a7ca2cfd83a24fcf79528a3e93407b1ba029d4dc7e5b8c5909959b3f17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
ac0f377093166ae2ab91e7ad5f9c1adf

SHA1
8917ddca8291cc07a0813343fde2e9ccaa93ab90

SHA256
1afd13913739cae86c2f50ba7786de802aed842e10c3390a438393a20e5eedc2

SHA512
6a9bce573779f56b0821f5223262f029327b6d70fa3e937ac4a5bd58dbb9d1c65e7c9140626e6b118a804bb22905246c0b091289941fd893fce4264a1ad4d16f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
9efa2c9f73eb52379626e85d30495a2f

SHA1
a2bc90608867048ecb1145cd25a33c2d939f3a16

SHA256
f71b305aff436771b8d2ace936ead205d11f5d4f9edcd90bd27502801cad19c2

SHA512
1a073f41cd5387bfe0fa59098417dfc6fc2990a1f831d85c89b2090a709f953b6c00585e65b8d2c7e86a0d90f0d8d977a38a6d09f58c6fb35c10833231c8d317

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
52bff66a5ac35cc5da0e9fca14fef435

SHA1
bc36bb859532e5bab805862fb61e4a5b4ce7fde0

SHA256
aa0aae83097f2034e557c8692d219dc14cecb9ee07e5644ee401f7fbdc94a64e

SHA512
753dd8c4ea87db022b17d87e5443cf8705525dd5d4045fa1224dba14f694f9fff74402127d4f0456f09067f418b4ea2098be93fe2d42630f18e8cb5be7f4e366

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
2b8edc7279bb857945d56e7621ef7c57

SHA1
b900366a4a4399136f8de6ddd3c1ceac7c7cb9a6

SHA256
7c1ffdcdbb3c5ed4866a72823c174a6075c51019291e1af43553bb4028da2345

SHA512
2891a62aec9d46c55455d3a7aeb740aab2d62dc9067e95f9670d1dfa0cf2b4efc6ced6cf7e12a3424824e51cceeb94588524185b18602b9c02492ef855d650f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
c8658d528b61ed9929394157042cb3fd

SHA1
2ec7c04b527d7548e99364cc5961a96da9e101bb

SHA256
03a2feab3cb746ef0d084cf56392ac589b2944355bd94797a7eb7953e36b06c6

SHA512
77a751113031620febe193f539f781c49d82fefb158c54c17ea7854dae12f64766edcf5af143ae48848c492c3ecc10372dc9b9865d49b45c7844b0a6ca17efcd

Download Submit
memory/508-733-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/508-731-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5836-728-0x00000000005F0000-0x000000000064C000-memory.dmp

Filesize
368KB

Download
memory/5836-729-0x0000000005550000-0x0000000005AF4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads