fda69ccb7e8acf085194e1359b1facf3b7c8f5b8eca43172a2a199d22aa675a9

Resubmissions

16-01-2025 20:24

250116-y67sesxmgw 10

16-01-2025 20:21

16-01-2025 20:03

16-01-2025 19:53

16-01-2025 19:45

Analysis

max time kernel
202s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20241007-uk
resource tags

arch:x64arch:x86image:win11-20241007-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
16-01-2025 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fatality_loader.rar
Size

956KB
MD5

5c917c1945a53e6c6fd9e55c52a5071f
SHA1

33829463306b1ea8d8997c136c7ad87467773cef
SHA256

fda69ccb7e8acf085194e1359b1facf3b7c8f5b8eca43172a2a199d22aa675a9
SHA512

69d4e041c83e2298c1c8f56a48dee9be249ae4ffbd84b75a94203015cfde21998b8f798798de55dd9ab1813550c2442d89a84e1586a65c8c96d8f64513353e43
SSDEEP

24576:Rej8HegWnDJNfJJB8XWQ/zx7raihPUOOORYgZ:S8HfWDJNGXZ/Nra4rpOgZ

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "183"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	7zFM.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1228	Process not Found
5040	Process not Found
1600	Process not Found
2508	Process not Found
1048	Process not Found
2852	Process not Found
6036	Process not Found
2272	Process not Found
4440	Process not Found
3004	Process not Found
5548	Process not Found
1440	Process not Found
796	Process not Found
6088	Process not Found
1584	Process not Found
4488	Process not Found
5172	Process not Found
3600	Process not Found
1456	Process not Found
4160	Process not Found
4936	Process not Found
3052	Process not Found
1236	Process not Found
1360	Process not Found
1640	Process not Found
2576	Process not Found
4496	Process not Found
3952	Process not Found
3276	Process not Found
5452	Process not Found
2516	Process not Found
5876	Process not Found
1636	Process not Found
5820	Process not Found
5784	Process not Found
3424	Process not Found
2612	Process not Found
6116	Process not Found
1952	Process not Found
1984	Process not Found
2088	Process not Found
1268	Process not Found
1424	Process not Found
4248	Process not Found
1784	Process not Found
2196	Process not Found
1588	Process not Found
2992	Process not Found
5160	Process not Found
1576	Process not Found
5000	Process not Found
5300	Process not Found
2476	Process not Found
5832	Process not Found
5084	Process not Found
5304	Process not Found
3448	Process not Found
3444	Process not Found
5488	Process not Found
4084	Process not Found
3356	Process not Found
3804	Process not Found
4920	Process not Found
5248	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	2832	7zFM.exe
Token: 35	2832	7zFM.exe
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeRestorePrivilege	4636	7zG.exe
Token: 35	4636	7zG.exe
Token: SeSecurityPrivilege	4636	7zG.exe
Token: SeSecurityPrivilege	4636	7zG.exe
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeDebugPrivilege	4584	firefox.exe
Token: SeDebugPrivilege	4584	firefox.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2832	7zFM.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4636	7zG.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe
4584	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4584	firefox.exe
4876	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4668 wrote to memory of 4584	4668	firefox.exe	81
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 328	4584	firefox.exe	82
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83
PID 4584 wrote to memory of 2064	4584	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\fatality_loader.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2832
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\fatality_loader\" -spe -an -ai#7zMap5408:110:7zEvent18767
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1884 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10111257-f288-468e-bd93-c11fdef3dd0d} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" gpu
    3⤵
    PID:328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2376 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf50d7a8-0468-4246-9072-3a5b71b6c87b} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" socket
    3⤵
    PID:2064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3168 -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2904 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30c48790-21b7-48bd-8591-9eef92400e2d} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3520 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccfe68d2-ea7b-494d-8ad6-afd0d52747c0} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:6012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4128 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4120 -prefMapHandle 4028 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a71f6bf3-8727-4ee7-b7c7-e2325e314e4e} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" utility
    3⤵
    - Checks processor information in registry
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5332 -childID 3 -isForBrowser -prefsHandle 5364 -prefMapHandle 5328 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80294693-f0c1-4fa0-a8fe-47fb2c25a726} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5496 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {480cd6f5-3873-437e-a450-a1bd3393dc19} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd72ef99-78e0-4604-8756-7bdcf33a783d} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:1004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6116 -childID 6 -isForBrowser -prefsHandle 6080 -prefMapHandle 6140 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4d7a592-0cb5-4ad3-9e23-78ddf0e3a074} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6472 -parentBuildID 20240401114208 -prefsHandle 6484 -prefMapHandle 6480 -prefsLen 32655 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1d4d1ae-3582-4651-b600-2e65e2602173} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" rdd
    3⤵
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6084 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6492 -prefMapHandle 6488 -prefsLen 32655 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4198291-7389-42ad-b111-3fb12f9e4889} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" utility
    3⤵
    - Checks processor information in registry
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6792 -childID 7 -isForBrowser -prefsHandle 6492 -prefMapHandle 6804 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1875be4-1e97-4fff-8d05-03ed29b75164} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6940 -childID 8 -isForBrowser -prefsHandle 6948 -prefMapHandle 6952 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec3b0a1f-b030-46a2-978e-a2ece822d9a4} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
    3⤵
    PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4360

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3664

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4552

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2832

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:1492

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SignOut
1⤵
PID:2092

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cf055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-1-16.2021.4552.1.odl

Filesize
706B

MD5
7a03590452d95a99deeb1bdccaeedd90

SHA1
eea0440f014ab8c1e4e293f7d94e436dc721e129

SHA256
84672d2d874b3d569a8fca9d7304e4d9e9598af8e197ba1b19472eebefdbf984

SHA512
0dc91b0de5b8c53cf7a5ba78292240aa0beeac85fca204548ff3ad5bed679950dc37614fa1ad830d00755f70630becab19fe10b9166f4b0a03480b4fc97f840e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
5cf0a9e4045f556a62d4cb4441ee7d29

SHA1
453e1f9c4897992648335b9e3868fa95c22c4a95

SHA256
d9d7b70444fa4308c3efaf4b546ba1d9757dbaf31f9f4ea53203e421f84c6669

SHA512
5224dd67783ccec8c1aa6a69542eb219c48102f17b642ff4f22e1448da32f3b9c039e891ef8ec17576e7faddfef8d717509c98b48888fe0f8f2f84866a9dc450

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dfn8djy7.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
8KB

MD5
254abad56512f1a3e5556b699c8b6cd9

SHA1
33dab9c11ea7c4b3b45b62fe52230ce6ea44c12d

SHA256
81cfcec26a6e5a517305746c8196dfb7d30a2b709ce5da73d1ec8ca622e904d7

SHA512
109066b2f8ad117f540f8a91624729dc85b485a5b2ff77bdfd14af59c25c5605b282c27281110e1ace1f941d2c5ef07ac13fd6a5e0005a6299a639570f115d94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
13KB

MD5
2737874c438a2d22e56f29f5d03c7957

SHA1
2d51947a46ee8677b3f226820e2daab8ea8d7213

SHA256
53aa6deda979be2af40b5b2a5442d927777f69738f974929c6e3da37e4e1a9c3

SHA512
3123925ac6f425f014d6b17a759cc2cde1b30d1dc9b61da0ff07da222d5ad980867f687054cf777f7ad028ba61a29771cfd29fbe9359be97c4b9681576e061dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\AlternateServices.bin

Filesize
21KB

MD5
ef5ca6862dcfa664610806eee9e40a09

SHA1
a3f29e3c11b7981d2838fa3313996549a8a7dc26

SHA256
ed688ad9ff54fb7d99022fc1977e72d6a715e1abc00eb209ffbae69420466521

SHA512
1dc571f0f3c92248db7d5b1acd8439b44473f4369f517ce34d99b356c20f1aae434eebadae78d4d7425c524c698872e9adbf9917866c70b829bec12da84060c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
400c06f1a3fec363e3c25c922ffe5560

SHA1
f32062ff5f4fba4120fe8e16fa156619fc12d02e

SHA256
87a958a0d6a43cbcf26bef5b6e59ebcd8d6257000f2c3cdb9ebb65b88098a4a1

SHA512
3c5d7deffe5ab60de1b4eb6ba7362adc3467a9275b64e8cab496962488a703f3703b56687e882e683894a0c712eef945187aed55e59632f3e7bc1ebd9b85b285

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
40KB

MD5
acc64cfc997b0ad678934d6413bdc73d

SHA1
6284f30979e22d583606f5ec2ed9f3a4416bd0dd

SHA256
18496d5c6a8f8a0df4bd3ef23600d6289672afb6021d8ebe35797981336af205

SHA512
9294735d8ca03c2f52560a4d5e19db5914555ce03fd7828e6ea2c6fd0a54e6a23733547e3caef16a0ca22545ebfa4296934981cb0fcbfa73caf730d29390087d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
effa28cefedaf882dd9004b57746f8d4

SHA1
6aff44869e92b57236162f744f979bcf246d2a09

SHA256
9aa68aa3bb96c7398c8b721a7908fb91c3fd26566229b7509a35c27f2f3ee60f

SHA512
e14441b7c38bde2469b07d3956b54f35d6fbd1614c5d563c6614e23b6548b03e0da60b1fc2e725c735ca990629d5bc31a8f1540623ad2e785004d754152a4dfe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
ea0cad1d82bc842b9e0809b012f27c42

SHA1
b51f12f4d8e91849aea2ff3f91a9b2161aef1d7c

SHA256
230b4ccc97a29243c3455009f3cbaf31dada0583a692d3532cfa851e54b96676

SHA512
2c742571efc221d9e7b366abef331f8318f535005cc265c4a7eaeb7ac21a5ecb20cc556c2e2e1374042f004a5ed9a63015b4e0c84dbaa53dd464b8e2c006f1e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\2ac1bd9e-0e16-423c-ac55-ad8142ada058

Filesize
25KB

MD5
56007bcb94355a4438be6fede58c4406

SHA1
80e981dc92b7880db19b8a95d04322629af3f711

SHA256
95bce8218139fadd10305bb4d95cb43164e2e4cb02c9c8ce5d324d4fe1e16911

SHA512
740fbe3ef5b635a1f5c74ba1c171450517443fa38a0333fbbcab679c60892b662eaeeb72eb1eaaa276c53a52abaf0dca587bf0ef499febfc7a7866bf56ae3f9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\4392d489-f262-40fa-ab9a-a311db322cff

Filesize
671B

MD5
6115c794fdd48c7175f5e15100901c9b

SHA1
22a92c571dc7b622fda44ce2316fd8aaefa90dc0

SHA256
4da8496f44aa039a6bc1f3810d5d5c091e7b6a57762ef3fcd0f95298a3a8acde

SHA512
fe8ba3b5023990297f4d7eaf4f991146c753869bdf3e9a08fd0c10321110104bc36f13227edba6d0ea186b6c34dc93a69a766481b29fc69b036c664965e30bb1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\datareporting\glean\pending_pings\b24174f9-23c1-4b21-b3d9-400fc50eefc8

Filesize
982B

MD5
a6bd99e9d3fca83fc0536237416bc5dc

SHA1
72c457f7dc13cd77ad6d87ba7d20351597c349c4

SHA256
ed2b40d19e40cf92553877a0c458e14eef00e503c297df860bdc8d3df26c7aea

SHA512
0a02ca29285f534ffa574c8c31e734d2f8fe66535f835bd59297e2343ca880a3036973a500c126f5678ed88e4a90bbebd142eb01cbbf7eee29c98c58c067d2f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
11KB

MD5
0937990854938233227c8347fd1e7c87

SHA1
528b1f2ef685ec44ca464407b2b5f44934606236

SHA256
874cbc90403b01b19f2bf4cef7c009770ca90d073dcb05166ce76fbeb6338e2e

SHA512
b7db91760c92fdccc1781bc8723b5b4a55012c4d2ea49c57018e2cea3b22e29aef2146e6cd99be781d9c470dcf06cb2f0a29dd1995990887438dd6e1e44ce973

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
10KB

MD5
7622f740b4c9fdc0cd29c5d62ce61715

SHA1
9cc2f3cf2a0b204f9e3f13213dad5e7625a997d9

SHA256
3e111d43344570f6511c66e31436a1fb7eef68ad33f01f432e18b8fe3ca618ce

SHA512
0de339c0ae16a3b3a5bb2482652f98383ba1ae2838bbdeda9554a8cf766432fe83830374baa28a7de39c73a83eea567829a19980611e6803fa379c70b5186bb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\prefs-1.js

Filesize
9KB

MD5
464cd13637b0d7183abf56ec79229e4e

SHA1
8f653a8d3e423ac672aba12d60be6b23689ae647

SHA256
812923b0a772a08e1a7b0ddc4b71c60ac0df625045b78ba94ba90b9e905f9ad4

SHA512
b2232e239973b6943d8747be072e77d9faeba3550622a3644c88e70addcbde851ab97a49a3bc2494520d0163f4a0e7b5abeb44e4571399753d782d2011e01ae8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
9945cf241c4d6aba69c0f72dfc76aea5

SHA1
bf09e219b82a0cb76fb7c4c8dcd3f2b462cdd99c

SHA256
2896dd632c1251b7278b0c78ec93bd5dfe3816b0fa50f949075d44e216696df2

SHA512
0a40e45a97054142468af6c0e7d65c8b85740fbf470360c8fe7574defb250e3723d22502f5ba6553018ada0a7585afb2039f6ca0f4affed312f76cd2241bd842

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
a79d597a3232326cacb33457236399d9

SHA1
2b2719e8ab3772b6196cfe07263c14bd12975152

SHA256
dc090900321eb4f9f898fd7e303341858929edfc6fa49b7cc0ad827917c246d1

SHA512
f1875698568b591e8183d0c2a18468e7200d08168632d53e22962afe650f988f164dd6eb7356d2266fa30f0c7425cf232f2562c2160b6c4370453a0d81a77c74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
825ae65114846aa6c149d0097dce2277

SHA1
96111fde8370d32eacb11959da275bd06afa0873

SHA256
4167505386eab2175a33db0b7af3f9a69389e21889e55f32f0ea33f2cec5193a

SHA512
12f8104a7498e6519bdfbcef443b55b8762a72324dbcb8b087f1af9d6d08f0bb1c8dd0724a2db364f7776312d53ff7b265a36ddb22dd4831607d52a1345d7c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\cache\morgue\195\{887d79d1-e1c4-4814-94ac-fcfeeb7726c3}.final

Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\default\https+++www.youtube.com\idb\1569979697yCt7-%iCt7-%r3efs7p6o.sqlite

Filesize
48KB

MD5
326874d39e6ba8be754eee37704bc248

SHA1
69007e7d7569ef3cd157c1e2b2ccfdb521d179a7

SHA256
82dadbe962ecde79ba2862f87823fbe192525a54008f9cebd0ed757b81644c4b

SHA512
15e47002823bf96f5e0ea24beb93cbff4c3ce50233e522dd19ac1b23508f427ab7f3c087ed0ffc8940d9cb663f0604ad4f4b745b20db033b179beb6d9506d267

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dfn8djy7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
5d0a485c6575ffa77a45a9789921f9f0

SHA1
207468b870c413099bb675a3e162346ee2d417bc

SHA256
728b08f74ada44e54c1b8c28beb43047e7f2c34e6abf27484626975807a5a17c

SHA512
fc94ec23d20863fad9ac2e97d919efb4d40bb9a914df7ecaeb063e6284cb008bb5ae1ec37eacc25aa3ea706ef1f00f769632314bfd5ff615b4dc217c3ebbc279

Download Submit