chaos | c773c6821f2962c2c89e482ead7edc03768a9c9835cdd264c3c2189f2c8dbd40

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-02-2025 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bloody Kmax.exe
Size

7.4MB
MD5

cde22b810942c0c6eef2e844a2fe8eae
SHA1

633ec7f9defbda8c7045f69e0a5ac1654068def6
SHA256

c773c6821f2962c2c89e482ead7edc03768a9c9835cdd264c3c2189f2c8dbd40
SHA512

e666fd809335888e4cf725e45f10fc7353dd3801a703f39353985b7ef35c6de1915abb22a54b4b1608fee86dd1c1c7b6c7b0b9d5215910164e1fb2469c32e58a
SSDEEP

24576:aaL3vVD8Lpq5u+B0cAUmhInhvctethPLqrzHBCBoNyUr4epjVGXWkY6V5vovNYiw:L9gvS3thO/EabZkY6LVm6fiMhZnLDUR

Score

10^/10

chaos discovery evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: KmaXx Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/1192-1-0x0000000000CD0000-0x0000000001438000-memory.dmp	family_chaos
behavioral1/files/0x0004000000004ed7-7.dat	family_chaos
behavioral1/memory/2288-8-0x0000000001310000-0x0000000001A78000-memory.dmp	family_chaos

Chaos family
chaos

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
372	bcdedit.exe
1840	bcdedit.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2288	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\az4fhvmoy.jpg"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\gmtp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\gmtp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\aufm_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.gmtp	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.gmtp\ = "gmtp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\gmtp_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\aufm_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\aufm_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\aufm_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\aufm_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\gmtp_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.aufm\ = "aufm_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\gmtp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\gmtp_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.aufm	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\aufm_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
548	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2288	svchost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1192	Bloody Kmax.exe
1192	Bloody Kmax.exe
1192	Bloody Kmax.exe
2288	svchost.exe
2288	svchost.exe
2288	svchost.exe
2288	svchost.exe
2288	svchost.exe
2288	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	Bloody Kmax.exe
Token: SeDebugPrivilege	2288	svchost.exe
Token: SeDebugPrivilege	2264	firefox.exe
Token: SeDebugPrivilege	2264	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2264	firefox.exe
2264	firefox.exe
2264	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
288	AcroRd32.exe
288	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2288	1192	Bloody Kmax.exe	31
PID 1192 wrote to memory of 2288	1192	Bloody Kmax.exe	31
PID 1192 wrote to memory of 2288	1192	Bloody Kmax.exe	31
PID 2288 wrote to memory of 680	2288	svchost.exe	33
PID 2288 wrote to memory of 680	2288	svchost.exe	33
PID 2288 wrote to memory of 680	2288	svchost.exe	33
PID 680 wrote to memory of 372	680	cmd.exe	35
PID 680 wrote to memory of 372	680	cmd.exe	35
PID 680 wrote to memory of 372	680	cmd.exe	35
PID 680 wrote to memory of 1840	680	cmd.exe	36
PID 680 wrote to memory of 1840	680	cmd.exe	36
PID 680 wrote to memory of 1840	680	cmd.exe	36
PID 2288 wrote to memory of 548	2288	svchost.exe	37
PID 2288 wrote to memory of 548	2288	svchost.exe	37
PID 2288 wrote to memory of 548	2288	svchost.exe	37
PID 1908 wrote to memory of 288	1908	rundll32.exe	39
PID 1908 wrote to memory of 288	1908	rundll32.exe	39
PID 1908 wrote to memory of 288	1908	rundll32.exe	39
PID 1908 wrote to memory of 288	1908	rundll32.exe	39
PID 2132 wrote to memory of 2716	2132	rundll32.exe	42
PID 2132 wrote to memory of 2716	2132	rundll32.exe	42
PID 2132 wrote to memory of 2716	2132	rundll32.exe	42
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2716 wrote to memory of 2264	2716	firefox.exe	43
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44
PID 2264 wrote to memory of 2300	2264	firefox.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Bloody Kmax.exe
"C:\Users\Admin\AppData\Local\Temp\Bloody Kmax.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:372
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1840
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:548

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UpdateRequest.potx.gmtp
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\UpdateRequest.potx.gmtp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:288

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Public\Desktop\Firefox.lnk.aufm
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Public\Desktop\Firefox.lnk.aufm"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Public\Desktop\Firefox.lnk.aufm
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.0.1500616999\1243541637" -parentBuildID 20221007134813 -prefsHandle 1320 -prefMapHandle 1356 -prefsLen 18084 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31753acb-91f7-4684-bc30-f047709278cd} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 1408 f6ee358 socket
      4⤵
      Checks processor information in registry
      PID:2300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.1.1272207217\1769325134" -parentBuildID 20221007134813 -prefsHandle 1564 -prefMapHandle 1584 -prefsLen 18674 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31c7ec3f-7675-438f-bda4-53c6f96413a3} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 1616 1439d658 gpu
      4⤵
      PID:2180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.2.563559951\893002929" -childID 1 -isForBrowser -prefsHandle 1972 -prefMapHandle 2052 -prefsLen 20460 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94a5149d-a366-4a63-a54c-25e6c5b1e9b2} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 2044 1439d058 tab
      4⤵
      PID:2592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.3.435992650\510473524" -childID 2 -isForBrowser -prefsHandle 2792 -prefMapHandle 2784 -prefsLen 20671 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f940066-1735-4464-a4a2-632ca3eec740} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 2804 1b8e9058 tab
      4⤵
      PID:1472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.4.1146154362\1854764954" -childID 3 -isForBrowser -prefsHandle 3140 -prefMapHandle 3144 -prefsLen 20748 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b479b2ee-11e1-4e04-b6b3-4ba79f1a7ab2} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3128 1c680958 tab
      4⤵
      PID:2716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.5.2078672364\1350635922" -parentBuildID 20221007134813 -prefsHandle 3176 -prefMapHandle 3076 -prefsLen 20789 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e6a73f9-7cb9-41fb-972a-c788d4d855a7} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3160 1c681858 rdd
      4⤵
      PID:2808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.6.747624072\1094556642" -childID 4 -isForBrowser -prefsHandle 812 -prefMapHandle 3660 -prefsLen 27941 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98a67187-f594-41de-ae55-8166400b85db} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3632 20e3b258 tab
      4⤵
      PID:1692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.7.772891433\2030614697" -childID 5 -isForBrowser -prefsHandle 3888 -prefMapHandle 3892 -prefsLen 28116 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e87a1b6-b1e1-45a2-b887-59b207c657e0} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 3880 20e39d58 tab
      4⤵
      PID:336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2264.8.634820384\2007659550" -childID 6 -isForBrowser -prefsHandle 4060 -prefMapHandle 4064 -prefsLen 28116 -prefMapSize 231738 -jsInitHandle 808 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9efe0ac3-6021-4b81-b2da-51cfecf4360e} 2264 "\\.\pipe\gecko-crash-server-pipe.2264" 4052 2178df58 tab
      4⤵
      PID:1772

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk.j19i
1⤵
- Modifies registry class
PID:2348

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk.j19i
1⤵
- Modifies registry class
PID:3028

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk.me8o
1⤵
- Modifies registry class
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\70sagwgw.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
00daf0b967ad4c58bc73032321b22bcf

SHA1
d5c8eec5b2d1015dc5488951b35fa0a5be990c9c

SHA256
acd469ef0b29319e533896590b5e38c930cde6b76b73510e7db3ac5aac429c9a

SHA512
29a56ce130382bce8d1c497bd6bd7c1ebf5e259aa13c2751c24d9f302815bb1d6098e2d3a7aa4ebb29d002e398ff62b09fb2ea796491451d0308be25bf9eee5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
32145ed0b07bc62d57fd24651e358df2

SHA1
d89fb64fe7eb2d964ea9c519ba558fe472391323

SHA256
0c0ed3d414ca81555eb74a3784b2f4a58a079905f8bf071f2a286c590b09eb2b

SHA512
7b792d79290d3d90ba0338be85c01fda35867ec25619288b0acf451b627edd5f4c35dde44cd3aa885ccc0ad409a46ab54c9b0e136b36f7296da8f028f8bcebb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\datareporting\glean\pending_pings\19a63eba-bd43-4580-a27e-576cae396469

Filesize
586B

MD5
f804a0040bbada0bc4b5955e7dcd5f24

SHA1
4b6d9d5f9f6c867a5e347ce1d0936d63e6f9e275

SHA256
0f3d3560138228189449f5aaaae25d1f430edf0c61cece12876b542e801bbacb

SHA512
94a9caf621947e8117d76870314387092a49b719620da2c66a74191aab519da80a6e49c21ad92a59c65d31d9004430419bc6754fab59d50a397d604a271a9335

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\datareporting\glean\pending_pings\f564fbdd-0f98-49e9-bcc3-4574b5fbf59c

Filesize
655B

MD5
b9510157b0c4e19c783a98555b7ea6cc

SHA1
6a9a0696b14ec3deb230e12c5bd6da67564d8f17

SHA256
3dad79724357f5679ad1d87ce0f9b6a08980bd74f1c922f71625949fa5179ef9

SHA512
27130f42712a43a69ea1411c3e8810b853d187f4a8d2f679ca3bc86c57d3e1c75c7e6c6a5816caa83c174a8bbeca4d85a9c3d9e779231aba4edcea1104a1edda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\extensions.json.tmp

Filesize
8KB

MD5
0845aa8e32eb8a76d3e30a07872c493c

SHA1
64c4f90da37c62ee808c1d816ac4a365a4e13c2a

SHA256
bd1eefed51ce9125eedf6423292ce473630b201fc7999f81a1fc3a3daae8c3a8

SHA512
c6e033ddec8811283d224c22dcaaa464456893c6052791b431b3750f8f238a324dde4efba2def50148c79c46ae0f9e33c1319f60caa66230e1040c1b1658af79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\prefs-1.js

Filesize
6KB

MD5
44306339004fe53126633c34d6292507

SHA1
1643229e0974cd166c4ada658a937ca3bfd2005f

SHA256
93ecd1c72d57112dd1bb0a5bad648d3d639a65a2261c4dd83e88942fa234ebe2

SHA512
ed75a9dcf53f5471685c69d012128c38645a5216291661c04b2f4d21608378e989b774c1b00a26afca0e28980e7675433c98cf4655176757111ed6bf39ef7ab5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\prefs-1.js

Filesize
6KB

MD5
2a7ab433ec44ee180db0fbd0e3e811bd

SHA1
b1a676d865f235a857ea67137d2af600080c0e13

SHA256
36343dd851ebf2dd49e6de151efcf8da4dcc3fe4543acacfa6d62176fa785072

SHA512
80cdf7f15efcce8aa9dedf5cdb2a6543a0599cb7ad21dcb6a05caf17727a5d93ddb280802626fbd9c912b67cf3914ca4868d913ccea65d9118b77716dc40ca84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\prefs.js

Filesize
1KB

MD5
8b0756288a18abe74263efeb3311a5bc

SHA1
190d00a709b1fa6e6c6b0f779a84ab205be8c213

SHA256
c24cc5997abdad79ede17f248c89b228e0f991e685775a1e96ad114ec9b998d9

SHA512
683777ca1fca615e92c6a68a8eca5807c0d86a7e990f6830726ac694b0dde0535ab21ea59c73f23e3cede3266c8af98366c74085da7d625e1929e1d48fd39c43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\prefs.js

Filesize
4KB

MD5
2b5160388f20c3aa84446f7ba2a04197

SHA1
e158275fe133e5e16d4749060d9a6dbd448499da

SHA256
e0d4f744d0afa056545d85565f4feba2cc05d469e7519751dfeecd9196ad5082

SHA512
b6ed5958160aa0a0bcead2e759db03f483fef557534e577070b3d37c82358342516a801ae9966a036e5bf0f9f2eba9a87d7df89505c78817b45dbc3740693115

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\search.json.mozlz4

Filesize
280B

MD5
41d220d4783f67d2b57beec20c135229

SHA1
6e97765e77920b6010fac2cb4abf1e3cea106541

SHA256
5d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc

SHA512
dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
e08ef355498ae2c73e75f5a7e60eada5

SHA1
c98b5ab80782513f6e72d95ab070e1ed7626c576

SHA256
d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c

SHA512
a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\sessionstore.jsonlz4

Filesize
869B

MD5
2e93db8fa3c3d91ff61402260b72981c

SHA1
2c741d1ec161f84df73290fb97de76bb927c860b

SHA256
3aa0e013a4130049a83437e1e955ae1403669345784f8ee418fff642c14a88a2

SHA512
c79054e52124aa1d7a7124c2fd8473bfeccc573f4e32e36c474e9193cbd9cf24046337ebcff27328625f18af2d57787d2fdd4eb4193a1fadef877adc4fd51f56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\70sagwgw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
48KB

MD5
59b1e56616b427257f03052719a424dc

SHA1
01374008c311fce990f518fb09873f1e95b04ae7

SHA256
f2722a2aa84689b9ae3767c837bf8f152f87a5900dcdeda2a30117fa914021fe

SHA512
698784f1be6211d4ba36331b20e8d544d5d49ee3990cb28ec1b3555f9f4a294942779e3c3e46ebba90676adb2a608fc66678b0b6c19ecefe67c2e6181a78579a

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
7.4MB

MD5
cde22b810942c0c6eef2e844a2fe8eae

SHA1
633ec7f9defbda8c7045f69e0a5ac1654068def6

SHA256
c773c6821f2962c2c89e482ead7edc03768a9c9835cdd264c3c2189f2c8dbd40

SHA512
e666fd809335888e4cf725e45f10fc7353dd3801a703f39353985b7ef35c6de1915abb22a54b4b1608fee86dd1c1c7b6c7b0b9d5215910164e1fb2469c32e58a

Download Submit
C:\Users\Admin\Desktop\UpdateRequest.potx.gmtp

Filesize
711KB

MD5
568d9630bea56099563f3e9ef67abdbf

SHA1
482b06015edffd69d9e004c78f75492e37778c3c

SHA256
13d605a049f289bd4673d56bb55c26ce61ac5d64aeec871c51f2cb306bf14035

SHA512
f6d6f7cc499837ece45df74503a785a3ee543ab04ac2398bb752d84e8b879b1e6d62f8c6ceaf05c040b51984139d4624b347785a003531689d300a587ae5e6e8

Download Submit
C:\Users\Admin\Documents\read_it.txt

Filesize
956B

MD5
21501b5bf2cbccf8dea4c2f064afb233

SHA1
ea75a95c8c1fbd35e05a8fc63e892801aa8ceaf9

SHA256
ef1d252cb05fa5030012511212d472855067477a6930e33ab034064de5c23b2e

SHA512
f0b0352bc047bd0b31a0bc188fff1ee9e039c0cf05f69d8cf252ab0036b343f9fc02e99ef42d72e6577e5a571e8544bc945c9ad16033b6da0c77418040f92520

Download Submit
C:\Users\Public\Desktop\Firefox.lnk.aufm

Filesize
1KB

MD5
d1ba1e1627416b07129d25bdd2890409

SHA1
7ab9d95242ec3c613dfbdc8e377e42beba813781

SHA256
2ceb9077e1b8e0803f7e4759fb3bee0b102239d7d2122f0008f55242db8e5884

SHA512
85d2bbed7b6de1d647faa4623bceaf1815725f46c224eb194a1d19bf3cf304a8c62bf54e18c8bd7baa60c72ff1298c4205243d996374319d76d64ab88bce9d23

Download Submit
memory/1192-0-0x000007FEF6083000-0x000007FEF6084000-memory.dmp

Filesize
4KB

Download
memory/1192-2-0x000007FEF6083000-0x000007FEF6084000-memory.dmp

Filesize
4KB

Download
memory/1192-1-0x0000000000CD0000-0x0000000001438000-memory.dmp

Filesize
7.4MB

Download
memory/2288-472-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-43-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-34-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2288-8-0x0000000001310000-0x0000000001A78000-memory.dmp

Filesize
7.4MB

Download