hxxps://gofile[.]io/d/ZPct9q

Resubmissions

20/04/2026, 05:17

260420-fy6ahsdx6w8

20/04/2026, 02:49

260420-dbcctabx7v7

Analysis

user interaction
yes
max time kernel
140s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/ZPct9q
Sample260420-dbcctabx7v

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
7336	test.exe
8152	test.exe
356	test.exe
6876	test.exe
8036	test.exe
8080	test.exe

Loads dropped DLL 22 IoCs

pid	Process
1828	upx.exe
1828	upx.exe
1828	upx.exe
7336	test.exe
7336	test.exe
8152	test.exe
356	test.exe
8152	test.exe
8152	test.exe
8152	test.exe
8152	test.exe
7012	upx.exe
7012	upx.exe
7012	upx.exe
6876	test.exe
6876	test.exe
8036	test.exe
8080	test.exe
8036	test.exe
8036	test.exe
8036	test.exe
8036	test.exe

Contacts third-party web service commonly abused for C2 1 TTPs 32 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
75	raw.githubusercontent.com
79	raw.githubusercontent.com
53	raw.githubusercontent.com
69	raw.githubusercontent.com
73	raw.githubusercontent.com
77	raw.githubusercontent.com
6	api.gofile.io
22	api.gofile.io
46	raw.githubusercontent.com
48	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
72	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
59	raw.githubusercontent.com
68	raw.githubusercontent.com
74	raw.githubusercontent.com
76	raw.githubusercontent.com
78	raw.githubusercontent.com
49	raw.githubusercontent.com
67	raw.githubusercontent.com
9	api.gofile.io
9	raw.githubusercontent.com
54	raw.githubusercontent.com
70	raw.githubusercontent.com
71	raw.githubusercontent.com
58	raw.githubusercontent.com
80	raw.githubusercontent.com
47	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
44	api.ipify.org
65	api.ipify.org

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
7792	tasklist.exe
2924	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6216	powershell.exe
7700	powershell.exe
6312	powershell.exe
7300	powershell.exe
4120	powershell.exe
2008	powershell.exe
3420	powershell.exe
6196	powershell.exe
7024	powershell.exe
7040	powershell.exe
4040	powershell.exe
2940	powershell.exe
5188	powershell.exe
4560	powershell.exe
1668	powershell.exe
6044	powershell.exe
4908	powershell.exe
7004	powershell.exe
7140	powershell.exe
5524	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upx.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Blank-Grabber-main.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
7700	powershell.exe
7700	powershell.exe
7700	powershell.exe
7024	powershell.exe
7024	powershell.exe
7024	powershell.exe
7040	powershell.exe
7040	powershell.exe
7040	powershell.exe
6312	powershell.exe
6312	powershell.exe
6312	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
1668	powershell.exe
1668	powershell.exe
1668	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
7300	powershell.exe
7300	powershell.exe
7300	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
6044	powershell.exe
6044	powershell.exe
6044	powershell.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
7004	powershell.exe
7004	powershell.exe
7004	powershell.exe
2008	powershell.exe
2008	powershell.exe
2008	powershell.exe
7140	powershell.exe
7140	powershell.exe
7140	powershell.exe
5524	powershell.exe
5524	powershell.exe
5524	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
5188	powershell.exe
5188	powershell.exe
5188	powershell.exe
6196	powershell.exe
6196	powershell.exe
6196	powershell.exe
6216	powershell.exe
6216	powershell.exe
6216	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	firefox.exe
Token: SeDebugPrivilege	3216	firefox.exe
Token: SeDebugPrivilege	3216	firefox.exe
Token: SeSecurityPrivilege	1828	upx.exe
Token: SeDebugPrivilege	7700	powershell.exe
Token: SeIncreaseQuotaPrivilege	7700	powershell.exe
Token: SeSecurityPrivilege	7700	powershell.exe
Token: SeTakeOwnershipPrivilege	7700	powershell.exe
Token: SeLoadDriverPrivilege	7700	powershell.exe
Token: SeSystemProfilePrivilege	7700	powershell.exe
Token: SeSystemtimePrivilege	7700	powershell.exe
Token: SeProfSingleProcessPrivilege	7700	powershell.exe
Token: SeIncBasePriorityPrivilege	7700	powershell.exe
Token: SeCreatePagefilePrivilege	7700	powershell.exe
Token: SeBackupPrivilege	7700	powershell.exe
Token: SeRestorePrivilege	7700	powershell.exe
Token: SeShutdownPrivilege	7700	powershell.exe
Token: SeDebugPrivilege	7700	powershell.exe
Token: SeSystemEnvironmentPrivilege	7700	powershell.exe
Token: SeRemoteShutdownPrivilege	7700	powershell.exe
Token: SeUndockPrivilege	7700	powershell.exe
Token: SeManageVolumePrivilege	7700	powershell.exe
Token: 33	7700	powershell.exe
Token: 34	7700	powershell.exe
Token: 35	7700	powershell.exe
Token: 36	7700	powershell.exe
Token: SeShutdownPrivilege	7336	test.exe
Token: SeCreatePagefilePrivilege	7336	test.exe
Token: SeDebugPrivilege	7024	powershell.exe
Token: SeIncreaseQuotaPrivilege	7024	powershell.exe
Token: SeSecurityPrivilege	7024	powershell.exe
Token: SeTakeOwnershipPrivilege	7024	powershell.exe
Token: SeLoadDriverPrivilege	7024	powershell.exe
Token: SeSystemProfilePrivilege	7024	powershell.exe
Token: SeSystemtimePrivilege	7024	powershell.exe
Token: SeProfSingleProcessPrivilege	7024	powershell.exe
Token: SeIncBasePriorityPrivilege	7024	powershell.exe
Token: SeCreatePagefilePrivilege	7024	powershell.exe
Token: SeBackupPrivilege	7024	powershell.exe
Token: SeRestorePrivilege	7024	powershell.exe
Token: SeShutdownPrivilege	7024	powershell.exe
Token: SeDebugPrivilege	7024	powershell.exe
Token: SeSystemEnvironmentPrivilege	7024	powershell.exe
Token: SeRemoteShutdownPrivilege	7024	powershell.exe
Token: SeUndockPrivilege	7024	powershell.exe
Token: SeManageVolumePrivilege	7024	powershell.exe
Token: 33	7024	powershell.exe
Token: 34	7024	powershell.exe
Token: 35	7024	powershell.exe
Token: 36	7024	powershell.exe
Token: SeDebugPrivilege	7040	powershell.exe
Token: SeShutdownPrivilege	7336	test.exe
Token: SeCreatePagefilePrivilege	7336	test.exe
Token: SeIncreaseQuotaPrivilege	7040	powershell.exe
Token: SeSecurityPrivilege	7040	powershell.exe
Token: SeTakeOwnershipPrivilege	7040	powershell.exe
Token: SeLoadDriverPrivilege	7040	powershell.exe
Token: SeSystemProfilePrivilege	7040	powershell.exe
Token: SeSystemtimePrivilege	7040	powershell.exe
Token: SeProfSingleProcessPrivilege	7040	powershell.exe
Token: SeIncBasePriorityPrivilege	7040	powershell.exe
Token: SeCreatePagefilePrivilege	7040	powershell.exe
Token: SeBackupPrivilege	7040	powershell.exe
Token: SeRestorePrivilege	7040	powershell.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe
3216	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3216	2856	firefox.exe	79
PID 2856 wrote to memory of 3216	2856	firefox.exe	79
PID 3216 wrote to memory of 2716	3216	firefox.exe	80
PID 3216 wrote to memory of 2716	3216	firefox.exe	80
PID 3216 wrote to memory of 2716	3216	firefox.exe	80
PID 3216 wrote to memory of 5680	3216	firefox.exe	81
PID 3216 wrote to memory of 5680	3216	firefox.exe	81
PID 3216 wrote to memory of 5680	3216	firefox.exe	81
PID 3216 wrote to memory of 5680	3216	firefox.exe	81
PID 3216 wrote to memory of 3972	3216	firefox.exe	82
PID 3216 wrote to memory of 3972	3216	firefox.exe	82
PID 3216 wrote to memory of 3972	3216	firefox.exe	82
PID 3216 wrote to memory of 3972	3216	firefox.exe	82
PID 3216 wrote to memory of 3888	3216	firefox.exe	83
PID 3216 wrote to memory of 3888	3216	firefox.exe	83
PID 3216 wrote to memory of 3888	3216	firefox.exe	83
PID 3216 wrote to memory of 2780	3216	firefox.exe	84
PID 3216 wrote to memory of 2780	3216	firefox.exe	84
PID 3216 wrote to memory of 2780	3216	firefox.exe	84
PID 3216 wrote to memory of 2780	3216	firefox.exe	84
PID 3216 wrote to memory of 3284	3216	firefox.exe	85
PID 3216 wrote to memory of 3284	3216	firefox.exe	85
PID 3216 wrote to memory of 3284	3216	firefox.exe	85
PID 3216 wrote to memory of 3284	3216	firefox.exe	85
PID 3216 wrote to memory of 4648	3216	firefox.exe	86
PID 3216 wrote to memory of 4648	3216	firefox.exe	86
PID 3216 wrote to memory of 4648	3216	firefox.exe	86
PID 3216 wrote to memory of 4648	3216	firefox.exe	86
PID 3216 wrote to memory of 2524	3216	firefox.exe	87
PID 3216 wrote to memory of 2524	3216	firefox.exe	87
PID 3216 wrote to memory of 2524	3216	firefox.exe	87
PID 3216 wrote to memory of 2524	3216	firefox.exe	87
PID 3216 wrote to memory of 5328	3216	firefox.exe	88
PID 3216 wrote to memory of 5328	3216	firefox.exe	88
PID 3216 wrote to memory of 5328	3216	firefox.exe	88
PID 3216 wrote to memory of 5328	3216	firefox.exe	88
PID 1828 wrote to memory of 7336	1828	upx.exe	95
PID 7336 wrote to memory of 7656	7336	test.exe	97
PID 7656 wrote to memory of 7700	7656	cmd.exe	99
PID 7336 wrote to memory of 8152	7336	test.exe	101
PID 7336 wrote to memory of 356	7336	test.exe	102
PID 7336 wrote to memory of 6972	7336	test.exe	103
PID 6972 wrote to memory of 7024	6972	cmd.exe	105
PID 7336 wrote to memory of 6180	7336	test.exe	106
PID 6180 wrote to memory of 7040	6180	cmd.exe	108
PID 7336 wrote to memory of 7268	7336	test.exe	109
PID 7268 wrote to memory of 6312	7268	cmd.exe	111
PID 7336 wrote to memory of 3700	7336	test.exe	112
PID 3700 wrote to memory of 4908	3700	cmd.exe	114
PID 7336 wrote to memory of 1028	7336	test.exe	115
PID 1028 wrote to memory of 1668	1028	cmd.exe	117
PID 7336 wrote to memory of 6352	7336	test.exe	118
PID 6352 wrote to memory of 4040	6352	cmd.exe	120
PID 7336 wrote to memory of 2444	7336	test.exe	121
PID 2444 wrote to memory of 7300	2444	cmd.exe	123
PID 7336 wrote to memory of 6004	7336	test.exe	124
PID 6004 wrote to memory of 6220	6004	cmd.exe	126
PID 7336 wrote to memory of 7536	7336	test.exe	127
PID 7536 wrote to memory of 7576	7536	cmd.exe	129
PID 7336 wrote to memory of 7596	7336	test.exe	130
PID 7596 wrote to memory of 4120	7596	cmd.exe	132
PID 7336 wrote to memory of 6116	7336	test.exe	133
PID 6116 wrote to memory of 6044	6116	cmd.exe	135
PID 7336 wrote to memory of 7880	7336	test.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/ZPct9q"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/ZPct9q
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 1792 -initialChannelId {a8b364c6-44ea-4d6e-84e6-c22fc0af3ae7} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {fc6b96fb-488f-43d7-bee9-3e1c45c07e46} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25213 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {ea7b6b87-d577-40f8-a921-414099a74fd6} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27323 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {f30c1600-8701-4bb7-ae85-0b228248e026} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1292 -prefsLen 34822 -prefMapHandle 3044 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3016 -initialChannelId {a2717d83-c2f8-42cc-acf9-bb845a7347df} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5192 -prefsLen 35010 -prefMapHandle 5196 -prefMapSize 270279 -ipcHandle 5200 -initialChannelId {3a61c98c-7084-4845-a04c-a0bead9f70e9} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32952 -prefMapHandle 3140 -prefMapSize 270279 -jsInitHandle 2804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2840 -initialChannelId {f40321bb-2ca0-4242-b688-50be64655583} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {d45a5d49-fea5-44ec-b2a7-54d9184aaf21} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 32952 -prefMapHandle 5956 -prefMapSize 270279 -jsInitHandle 5960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {7c3f996c-af93-442f-9eaf-36646a3fbdb3} -parentPid 3216 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3216" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4364

C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Extras\upx.exe
"C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Extras\upx.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
  C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7700
- - C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
    "C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe" --type=gpu-process --disable-gpu-sandbox --use-angle=d3d11 --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1908,i,2386699576591981854,10312951274866666544,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8152
- - C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
    "C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=d3d11 --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --field-trial-handle=1972,i,2386699576591981854,10312951274866666544,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).SerialNumber""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).ProcessorId""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).ProcessorId"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7536
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid
      4⤵
      PID:7576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Manufacturer""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Model""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    PID:7880
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:7792

C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Extras\upx.exe
"C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Extras\upx.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7012
- C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
  C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
    3⤵
    PID:1040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2940
- - C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
    "C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe" --type=gpu-process --disable-gpu-sandbox --use-angle=d3d11 --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,6200510876228697448,17276264584055459998,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8036
- - C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe
    "C:\Users\Admin\AppData\Local\Temp\3CZx4Yh9Q5eCe9rTXyBJGj0PNwN\test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=d3d11 --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --field-trial-handle=1992,i,6200510876228697448,17276264584055459998,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
    3⤵
    PID:7124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer""
    3⤵
    PID:1512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).SerialNumber""
    3⤵
    PID:7188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).ProcessorId""
    3⤵
    PID:7224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).ProcessorId"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber""
    3⤵
    PID:7936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber""
    3⤵
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).SerialNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""
    3⤵
    PID:2948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    PID:4860
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid"
    3⤵
    PID:6324
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid
      4⤵
      PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Manufacturer""
    3⤵
    PID:6272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Model""
    3⤵
    PID:7376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    PID:1292
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...