63784f25a485944de47297b410a86ef06d87908700b0d91da9ac38c5121f0767

Analysis

max time kernel
146s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2025 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HAN LLEGADO LOS DOCUMENTOS ADJUNTOS-password(v6Z3UoEi).zip
Size

889KB
MD5

bab1852ac639b0288b8b1127c9a488ce
SHA1

4d96008edf7ec659ada6c007307f9adcd82a4a1b
SHA256

63784f25a485944de47297b410a86ef06d87908700b0d91da9ac38c5121f0767
SHA512

b9df30d0361cf3d4ebc92185ccee5607fd9d111052e118b784fb535251a5b4cbf2d6f72b7834961d343ee442b68935102d5d32d547c6f75512a3b9284d7b40d1
SSDEEP

24576:aKrZ4L8W7yUau9M+5EDI5nrE8ZOAN9nkjf:l2wZiM+5E8l9bnkL

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 41 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\Registry\User\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\NotificationData	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000047596f65110050524f4752417e310000740009000400efbec55259612d5a04ad2e0000003f0000000000010000000000000000004a000000000053194500500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zO48D90DD7\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml:OECustomProperty	7zFM.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zO48D30339\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml:OECustomProperty	7zFM.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zO48D60429\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml:OECustomProperty	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3460	7zFM.exe
3968	OpenWith.exe
112	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	3460	7zFM.exe
Token: 35	3460	7zFM.exe
Token: SeSecurityPrivilege	3460	7zFM.exe
Token: SeSecurityPrivilege	3460	7zFM.exe
Token: SeSecurityPrivilege	3460	7zFM.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: SeDebugPrivilege	2768	firefox.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3460	7zFM.exe
3460	7zFM.exe
3460	7zFM.exe
3460	7zFM.exe
3460	7zFM.exe
3460	7zFM.exe
3460	7zFM.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
1168	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
112	OpenWith.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 388	112	OpenWith.exe	80
PID 112 wrote to memory of 388	112	OpenWith.exe	80
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 388 wrote to memory of 2768	388	firefox.exe	83
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 656	2768	firefox.exe	84
PID 2768 wrote to memory of 1108	2768	firefox.exe	85
PID 2768 wrote to memory of 1108	2768	firefox.exe	85
PID 2768 wrote to memory of 1108	2768	firefox.exe	85
PID 2768 wrote to memory of 1108	2768	firefox.exe	85
PID 2768 wrote to memory of 1108	2768	firefox.exe	85
PID 2768 wrote to memory of 1108	2768	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\HAN LLEGADO LOS DOCUMENTOS ADJUNTOS-password(v6Z3UoEi).zip"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\7zO48D60429\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\7zO48D60429\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e184c8ad-31c4-4ec1-8498-032637a3f28c} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" gpu
      4⤵
      PID:656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2eeea08-bc69-483d-b20c-1f5c8de1e7ca} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" socket
      4⤵
      PID:1108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3328 -childID 1 -isForBrowser -prefsHandle 3272 -prefMapHandle 3268 -prefsLen 24739 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96599a8b-d652-4c3c-bc97-2519483325c5} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
      4⤵
      PID:4932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3708 -childID 2 -isForBrowser -prefsHandle 3700 -prefMapHandle 3164 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f07a8b-51ef-4d5a-a714-d35f15d8ba86} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
      4⤵
      PID:3872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4176 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4200 -prefMapHandle 2880 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cc38f8a-8958-4d64-8b7a-39b053a46054} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" utility
      4⤵
      Checks processor information in registry
      PID:2424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 3 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a822d7e0-9bc6-4131-9cf8-adaaee6e24f6} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
      4⤵
      PID:1036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 4 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd374651-4b7d-4639-8ac9-f9b3f9f8bb23} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
      4⤵
      PID:2808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 5 -isForBrowser -prefsHandle 6016 -prefMapHandle 6024 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf000f65-11c0-494b-9a66-3a9a950f2315} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
      4⤵
      PID:3464

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml"
1⤵
PID:2912
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml
  2⤵
  - Checks processor information in registry
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vo8scey3.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
0f2704cea075ac1d463f009bd8dc8ef2

SHA1
dbc4530f543b0a36e8d598cff28b3a0786e38cda

SHA256
07615b607430bbecfc7a07bb9f3f575290138eab98a0ea032e60b252ddb7d956

SHA512
74b55532d5e45fd4c3d13f8c8e2288e158b1c27b624ed6902b621aa0f565fca655430fc7be3cc8fe09c1c80514e821ef0ef60ccaec6daa9adfda884c0cc03c99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vo8scey3.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO48D90DD7\4153d78e31eddbc21325cde2804858412a2129590615af8c8bca1007d45b969a.eml

Filesize
888KB

MD5
19082a397a447678690ce8a2b44bae3c

SHA1
b9257b65e0ae591d353a9daba3704247752e047e

SHA256
b7792035319ff736f52a93bf767cf1571a6d1b33fb3d830b9001695c19562f36

SHA512
d6350e7f45d1403dbba0f08490e33a1afbb8bac19214a274cb873303aeec1fb6d364834bdc93fc645c9b4f7c5233ec2188d5b9d309251f58778beeba5815d0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\AlternateServices.bin

Filesize
6KB

MD5
8b7c327ddef11a74ba861c1569c1afac

SHA1
e778939045ea9464b157f98e0ae75b0a4752a05a

SHA256
8a8566443816b0c6c9c7731036e1a393221b8706012a73ba261e0448e3c5285f

SHA512
6f730d2ef17f23eec790fefad8b776c2db9fdad155221ac592359ed4f0a5b49054297ccd175ca54eb27b2f0288803a478a2b7391e46df9c14f289afc0ff975c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\AlternateServices.bin

Filesize
8KB

MD5
3a634c2bf7149a6d58d3d49d41336213

SHA1
b3d89fe9c83b0c128cb83b762c63e084dac98499

SHA256
67d9cd91b084eaf9ff40b7697bfe9ce31d3cb3b3ecbd9397a5be61bf9f4f427d

SHA512
b8d94a69e77abb1ccaf9718724ea3b8c516c5eeaae5f8391cf35e260a858f8fe4812fa0f1718ee09c8f3a0bb5632fb6f00e1c663508028bb94568d5d5966e737

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b4eb92ce2fa8f383610054d5f51f3f0e

SHA1
f18c312b23b40a205e38acf6662342b7feda984b

SHA256
b0351f628562bf94bb8468872a9f60bf723c03ef42fc836b773ccabc5dff1389

SHA512
bb233ff33140e99fd524524cfe3c859583326cea5ccb154c40084a44363e491071bf265ee5d8bbed71752f95ddbfac30919f99d54ee70562eddaa054ac0bdd7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
3af291ff2be395377d595ed1d9608938

SHA1
d0edca98bc3221f88880153b186ff3bbe86a7ed2

SHA256
950dc8a5b735b9d6a7e0fc68d9ea171600a5fd01d2aca4fabf465d996653e972

SHA512
e982defd00ad544f7e8051bcea36abb9b65273e4998637cc1c0770a1283e6c37590d08f38ae7699c5446488deeffe53e0e7ffa46f849da28e628e480f037c8fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\9c9a3cb0-dadf-41dc-a5ec-0b3cdbbfb6df

Filesize
23KB

MD5
a3163214fcf3f87fff49a74c4c1e1006

SHA1
217c4a76589db4e91076f18deef56b2ff6db76b0

SHA256
18eaf8bb81aa6533a55c1c633b640c3b254ac87e2adb0cd8b3c925dbfbe0a6e9

SHA512
497c07f27c365023ab7a2cdeff310be370fe901e4bfaa409e41afe1410655db43f2a963dcbc8b008eefa657d1e60080902495814a38a6a2ce685e37d87aa0f5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\a45883dc-829c-4913-ba07-cd31fc3cb940

Filesize
982B

MD5
fbe25fdcc1db66648efd8df66d716467

SHA1
8986387527dcd78d1c595ce74156ef28b024c94d

SHA256
10df26d36ed9148110c3fb665902876b675f2796ee604d5e460b04a274283b29

SHA512
30e7039fc5b4000d8ddf034a9b2c3ef3b3138b4d3b93eec10ab6ebc97b6de223f8c69e826f09f4f2facfb397a1689988f17fb75cba2a5ce2212e167fd8d52251

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\b453a49d-54f9-4fd4-a3cc-84e52a9d9ec8

Filesize
671B

MD5
94eec94959c5629b69317383898be18c

SHA1
4670ee2287df559de9d77edab2c757eef8e9910b

SHA256
bdc78a07e7d205bdbbcb1efa4c8cd6b9ff6ee6d3704039ec7bc67c425eb88ed6

SHA512
6a920fd14d67704c384a1602415ac1700737ab99fd61ae316720c3d971b7d4412c3e650996f73092ba4b5bffb10e18d94fa50ad4aa6b530ef4b62a57e8bd5e25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\handlers.json

Filesize
431B

MD5
04a76693f9e03f2dc773e5601d01d406

SHA1
5e636c0a047d6687b19e68354a5a3ca4dbd06acd

SHA256
669aa78ac9f14cf4fbb6001f41d5d941d16852d5155a14aee76d83405017dc77

SHA512
f61972489f17bfe02dfc71a098d1f7e366fb6e00552dde2a1c451753d1aba41d2b646889d7e40df52428738c4ca04fb7e265f63c5240a74999671e58f0d1a3d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\prefs-1.js

Filesize
10KB

MD5
bc75f62ce231b55dc79dcf47b02294f1

SHA1
e576e3858b7614c8d8457817d744041ceaa9ca69

SHA256
ac79839d8d48b2dd178cede21cf26b004db296f02b37030fce1bac77b14dac05

SHA512
c50a5f3ac2e569a6f231a21211ade07ef7d66a8853748741eaf4fea162aabb27c47dff623f61f4de98a637f5ae4a632e6944bd9d7fba297a46cea280d88b42cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\prefs.js

Filesize
10KB

MD5
80046f7ad5f443fe6dbe6956814b062b

SHA1
4f2d29236d8de1b20674393ce89622126b7e6fa7

SHA256
63fce5ebef60e607156cfb15a92cecc1f5598cc0d271401141ea23a645f41fe2

SHA512
da552ce29145035c5bf6f699056c0af83e54e42cc9f1cb62d5b721f26e5229b20dda6967d56e3627920e764a69d4bdd1628dc8976dcc7ccc647ffdeee1abea25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\prefs.js

Filesize
9KB

MD5
c1b547beb2c08605fa9e7a90e9cc9cda

SHA1
f4e0e6173c6ae95511652e434b64b5f1da3b904c

SHA256
e7081ed68ebe4e879fa8b7256deeb48c374edf5f7d919da6a1aa7329e81d5473

SHA512
857b72e37c29ff3c447530a1584dfb6d542c9279df543eb0a7616cafd9cbe8b80b7f0c112d50d0d6eb99af5a20db7765fbe25cbfeda1b302270f5c0e3911f7ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
36d4a0f74be484e3c2bbaeba80035ae3

SHA1
64193329b16cfca9c04bb45c78286d3505735cf6

SHA256
f5995ab0dd5fd236beaec3e89aeab8c43a9fac1dd6d6ccf80e4ce493d721c4a6

SHA512
909ac305853328d14d1b9843d7c68ecc90bd02f73c5fcf883b316cf03fd678762e7b0ca3bb30f8bf2da40d8f88e83b050541bac18c3ac929f09995e924f3e283

Download Submit