hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

25/02/2025, 00:10

250225-agcnzswq19 10

24/02/2025, 22:06

24/02/2025, 21:59

24/02/2025, 21:19

24/02/2025, 21:13

24/02/2025, 16:47

Analysis

max time kernel
341s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20250218-en
resource tags

arch:x64arch:x86image:win11-20250218-enlocale:en-usos:windows11-21h2-x64system
submitted
24/02/2025, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
62	1408	firefox.exe

Executes dropped EXE 3 IoCs

pid	Process
5560	Gruel.a.exe
3240	Gruel.a.exe
2568	Gruel.a.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MediaPath = "C:\\Rundll32.exe"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Rundll32 = "C:\\Rundll32.exe"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEX\DevicePath = "C:\\Rundll32.exe"	Gruel.a.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Gruel.a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com
62	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe	Gruel.a.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Gruel.a.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gruel.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gruel.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gruel.a.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Control Panel\Desktop\Pattern Upgrade = "TRUE"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Control Panel\Desktop	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "kIlLeRgUaTe 1.03, I mAke ThIs vIrUs BeCaUsE I dOn'T hAvE NoThInG tO dO!!"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\Gruel.a.exe,0"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ = "kIlLeRgUaTe 1.03"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\Gruel.a.exe,0"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	Gruel.a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ = "Shell32.dll"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ThreadingModel = "Apartment"	Gruel.a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InfoTip = "kIlLeRgUaTe 1.03"	Gruel.a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder\Attributes = 00000000	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\Gruel.a.exe,0"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Downloads\\Gruel.a.exe\" %1"	Gruel.a.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Gruel.a.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6068	explorer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	firefox.exe
Token: SeDebugPrivilege	1408	firefox.exe
Token: SeDebugPrivilege	1408	firefox.exe
Token: SeDebugPrivilege	1408	firefox.exe
Token: SeDebugPrivilege	1408	firefox.exe
Token: SeDebugPrivilege	2360	rundll32.exe
Token: SeDebugPrivilege	4276	rundll32.exe
Token: SeDebugPrivilege	4276	rundll32.exe
Token: 33	6412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6412	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
6068	explorer.exe
5560	Gruel.a.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
5560	Gruel.a.exe
3240	Gruel.a.exe
2568	Gruel.a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 2208 wrote to memory of 1408	2208	firefox.exe	88
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3760	1408	firefox.exe	89
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91
PID 1408 wrote to memory of 3228	1408	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 27419 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {307d154d-3544-4a02-a116-e1ba17839fff} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" gpu
    3⤵
    PID:3760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 28339 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02a128ca-e61d-412f-bee7-5f2ec154306b} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" socket
    3⤵
    - Checks processor information in registry
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 2812 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e8602c1-19dd-4565-9a65-e4698d5a922d} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" tab
    3⤵
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3588 -childID 2 -isForBrowser -prefsHandle 3580 -prefMapHandle 3576 -prefsLen 32829 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {184fd46a-a6a6-40b6-9607-b0e535816b7f} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" tab
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4592 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4584 -prefMapHandle 4464 -prefsLen 32829 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a14d373a-5fa9-4424-a9f2-81e96991469f} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" utility
    3⤵
    - Checks processor information in registry
    PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5412 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b0f2407-8749-4445-8cfe-f1bd6550c1b5} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" tab
    3⤵
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea7ea5dd-dd98-4248-b67d-bd3f65159bba} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" tab
    3⤵
    PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 5 -isForBrowser -prefsHandle 5852 -prefMapHandle 5796 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f393bcd2-05a9-4c63-a5b3-2ba95dcf032a} 1408 "\\.\pipe\gecko-crash-server-pipe.1408" tab
    3⤵
    PID:1052
- - C:\Users\Admin\Downloads\Gruel.a.exe
    "C:\Users\Admin\Downloads\Gruel.a.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5560
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl @1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4336
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL netcpl.cpl
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL netcpl.cpl
        5⤵
        
        PID:5692
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,0
      4⤵
      System Location Discovery: System Language Discovery
      PID:5872
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL main.cpl @0
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL modem.cpl
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2360
    - - C:\Users\Admin\Downloads\Gruel.a.exe
        
        "C:\Users\Admin\Downloads\Gruel.a.exe" C:\Windows\system32\rundll32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3240
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL main.cpl @1
      4⤵
      System Location Discovery: System Language Discovery
      PID:1084
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl @1
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5124
    - - C:\Users\Admin\Downloads\Gruel.a.exe
        
        "C:\Users\Admin\Downloads\Gruel.a.exe" C:\Windows\System32\SystemPropertiesComputerName.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2568
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,1
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5860
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL timedate.cpl
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,0
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0
      4⤵
      System Location Discovery: System Language Discovery
      PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3852,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
1⤵
PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4072,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5500,i,6925591690600939166,85426131164229687,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
1⤵
PID:4896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:6068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
f8b593e3c2c979d444a95eadae5a566d

SHA1
62fbd869b54477fe899808b043fdf1d2069509f0

SHA256
b949f0471c156956218567e7cc9ea7da7f6d9dead2edb6623781b448dc43d824

SHA512
cd117894f249eb717d98f93dae3225691234c911e1d8c5ab6ec9e9e9538f3becb14aa44ba155f9a5d241acd887cd7e481f2290aebb8a1c55e52a5a13c596715b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
f21089a16b4a07d947d5fb895fd069b9

SHA1
78d909e1e4d6f8d6a8d3b9b87d30a27c72028d97

SHA256
43f6251dd081030f61a94162307b62e92f9a3a3d3cc47fd6685bab56a539ac43

SHA512
596222678f10e509eb0123b215c8ef17d1d9dae31a302d10eab5a145c47cd858227045a879043e130ff1148f0daddcc0b64208539ad92cea0f1fa65071ffccdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rr7c0353.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
626e07ab61d44d95b722b6ccb36cb663

SHA1
34b0668c5be65d182700bea5adfb17cc7dc9a40c

SHA256
b77ae5093a249735237189b2c2da46bb9bb24472afa06b9d550d5a1190f5daf3

SHA512
8e8d0c1f5c0427a540027dfb7124740ac72a131d8e315c8fd92189818c92bb42a356d5bb6c83d08d5a29deea336f3c9dc4992925b21c986a2f0cdd2964f771cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\AlternateServices.bin

Filesize
8KB

MD5
0f96a9e07cf6d3f3f9e4a50ab40355fe

SHA1
f385b035d68447bcc163fbc0c19d2b3c5ed1102d

SHA256
220f87c1e3670ccd64eb6468ea38dbc8b88535927cff63266b4c8c6ccff1ae37

SHA512
db55ecdef1c1c06bbde82c0c2d5befbee024543b6851ce0829dcfc57aa6384d41a4b8c01eb9dd0e8d165147de93784a3a5358c5fbb9188c1b432889844771336

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e3736d27cb03ce06bfc911ddb9dbd19a

SHA1
4d73e63506cef913b3b180c0387fdadc76fe0577

SHA256
8ad68d69e8208c4f227af6f6ea17cd50cb3cdbfc223a7f255087c0c148cfdae4

SHA512
49e70e8c60ba8f7b6325dd171f926b7b902bee7252e367b6c6ad2ddab3ed4ece9c078ea34f225200ad4fe7c07bba06a94b21ea3772882b9f9aba4b17eb7e9eb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
39KB

MD5
33e914eae9e9dd127b541a7450e919e5

SHA1
22360df17df9b62e3379cc77d269d10ae395fbde

SHA256
583de6e5c718bbccde8a1f04a681fb19da81a1ff0721efae595011b82e97db8b

SHA512
75fecaa9c21668ee7113ddf7b5dba3677799338ceef5c9d35e947846057d462866a35dee838215f0e2f7b6c673ce81fec2acae115b55f263dc100cf3e6871677

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
c461269c8ff816db4bdd35ce29cb9224

SHA1
e92d6ce69b4f9ffcec3ff18eef2685af389f5801

SHA256
625fcdaeb4ca6600dd822fcf0084370e75de9b4878409eb1dc6751b0441e0325

SHA512
c77938995a645bfa7dd7d8ed7c65b15b6cd86cecd933bb5ac187156e4f3409d1d9554bd360912d2cd7b0ff6317ee37bafb29cfc07152da42441cdb1fb5d4d60f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
39KB

MD5
a972fc400c3de9714fdc09ca77a8c62b

SHA1
749a258c468b24e02c0e004f9d7b9e7924630b3d

SHA256
f4f0a234afef61c273eadfc10aa0acdf0ece97cc637e77079281c28a7cba1bff

SHA512
337db6beaadd01a89be8d705895a0a69df37bb209c883c86751e9f834e649f141a6e697d2cf71ff4e513c5a1b10a593e5125d0d342bd7ed348c852b69b38e17d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
60KB

MD5
7124dd83c2e4ce1786069a04c5240bd2

SHA1
c71f704966d32498158b8c7b1e3c4a601844173c

SHA256
16bae7945600a2a01255aadf7b90d9496e2410a4f0906ca940b7812701480a07

SHA512
e41ef201b11b4d8a36fe05c382f7ddebfecfeb450d1e8214e4fa79fb683ccc34aa9dca132c4c40e5e9e66295f88b2e2b2374a61aa92c0a1ca213242e8dc5d559

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9cd9d0099dc725c8e53aa746ebfe9481

SHA1
1bfa92bd3826f427159bed194d2e6e519059b234

SHA256
90934108e0b9822f10a27abce5323f21970640bba0a88a8badba69c2afdbce19

SHA512
62c1393e68f1b9592fc6f98270fd33cc0576897c026df3dca59ab2c84e91673caf74ce96ce477678ad0ed62610793f265e8a60a80fa459e6474111544f12ae29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
6816589ced8a307344a3bfbf8417e91a

SHA1
589e035c048da7f30427b4f348c9b883d1af4416

SHA256
96a4a982fefd7150b74e92ac4cf6c7abe705fa6f7c8b42db8f95956eafcf6df9

SHA512
42532ebd51cccd36132733f61f6458c2d0b093c6958ef5d7e47f33a76d7e3f09994f536c32726b4d97e7e1cdc79718d4276345dc5f23f63708fcba021d76e5d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\pending_pings\4385bf0f-3d62-44a4-b601-cc3dd796e77a

Filesize
26KB

MD5
b2aab4b151ef826bc54fd943023ec309

SHA1
142e6535534011a5f837ddef1417b1232c962153

SHA256
c52b7e48b975c8a2db68d0767a4233aa57bb494637b72811aef2912b0a8f01a7

SHA512
731709bff3e6814f62a83021ca95a962a0c4214910851112d1f66323b434084d7dd6913ee5a9a71b0c736de20de91123460f69ca078bc4b51ef8bbefe377a7b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\pending_pings\5acff6a9-1685-453f-9845-2997732352fd

Filesize
982B

MD5
353396732f693b5c220cd2320952c0f1

SHA1
2b47091fc2202b3aa8c46c0ccd16086a43a074bb

SHA256
700a36c61175538d73200594bc850b2a33f2e972bcae6f70fe8143fd0de103b2

SHA512
842ae0d3bced7fcd0cd452f84efd98edaaf5e4d028ea1afdec5f13b735551d829cafa669fb65e8577c1a7f599d27723cc22ff30cbd9eaccdb1fe4ea7ca1853a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\datareporting\glean\pending_pings\bb96d6f5-6b00-4638-bf2d-1fcc2edaf567

Filesize
671B

MD5
5509bb348b629dda953b4431b37be4a8

SHA1
85271c39655806bbff061382bd6224b0210061a0

SHA256
1eee7b58ed2d2a45594ad9183aa948d459a03be288cd9d47c61dedf343a2b3dd

SHA512
1b586a6c9759d747d3807d1a169cd7026789da7a9c2eb7fd139039a94896257089f55831564b5094dc92c5602dee7dc7ebbb070bf4704b036e1049d441be67fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\prefs-1.js

Filesize
10KB

MD5
142e6e02d5341d49d7cc16879ffbd691

SHA1
e47445165087ba628a516b3cb596ec6a8cde380d

SHA256
f87b7299ed3b216bf43969d84b3b088d960c6d9cb5dff04ab1d21ca44c276d8e

SHA512
3bd106e836de48da23982176ffea2a18ac9cdae8d32abf3dbf9f2405bdb1d2d838d190ba249281d79a32722957181ae7341d58bf23e64549e6afa6313d5f3bc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\prefs.js

Filesize
12KB

MD5
f73d4d9f0fad11b7de556d05c89d214b

SHA1
744a0b088d34d86fb7dd87b90dbce9d9cbd21e08

SHA256
f17e9950e7f005dcdb2bcc1951976e83b23b75950395b63b0582ca57effb2338

SHA512
36cfd727898d9963a1de7811b927ce19c4d5adfa5ce3957d1e76a9bd6cb7e38b2312e93b5296167fae850cc8761147396a859ecb172942135d6d3558ec1a3073

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\prefs.js

Filesize
10KB

MD5
615bdc905bb523ecc1278a557f2e30da

SHA1
260b0a95d58967b8055900fa7f311353bdca417a

SHA256
77bae4c8a02fd1fdde4091e22ef08dc19e3801ef8c1f78316b8bab00639f2bf4

SHA512
ce1e780d56e88a9329930f2da03b775c4b98e7f36736dec2c4348a0d8d6a1ea2fe99479f831d84cb0f5b3c3d62c9c0c7f39ed603cb4e8524f6643e1d363512aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\prefs.js

Filesize
11KB

MD5
d79f421508e2b850d803f80c31f3148f

SHA1
f37805d76d7bf9cc17d16146078b68a9f41492ec

SHA256
240e8fd849a492744750cb08317bfdbd45a06a38c326092e19064a2d815c0a67

SHA512
2753033b3263ce59a9ea952c2538f425974898b46dc53cb36fc17404b2dc6b07cd582345c4479db64accc77367d8552e7c48e076958703eb83cdb036ad690b22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
87f9101d51de228b58b571c3b184809f

SHA1
be708c326d5094aee6db9be8e2ade1dc6d6b72a4

SHA256
faaaa9d0387ba8b1af2855fec166c5b4eb386b86725f3d65892291935d517d03

SHA512
8d6e69a909b194b8a863fe089b4b4a6a202cc89d2497480bd9e8c516e2f7c2c3aed6ba23d2993856df0027aff806ddfef3cff8faa1bbbfc5358e68a55bc13b2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rr7c0353.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
21492aff123dd561608e64691f61bb72

SHA1
c580b3299db219c010fd146cfb77bc5c22278383

SHA256
cb84e1f8a9de2865164dd69d4e765adba7baaa0d4612aa7e1f7f1f6c9656004b

SHA512
12ce20bd1ddf02fe4c2fb5377e474d28b0aab1d167865c59ce22e788395857425a33a46cfb128e0679feef2e4f7e4aa0f519eb2cbdec7c18f753ca05b280ed17

Download Submit
C:\Users\Admin\Downloads\Gruel.a.exe

Filesize
100KB

MD5
b0feccddd78039aed7f1d68dae4d73d3

SHA1
8fcffb3ae7af33b9b83af4c5acbb044f888eeabf

SHA256
5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6

SHA512
b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d

Download Submit
C:\Users\Admin\Downloads\Gruel.a.exe:Zone.Identifier

Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads