f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8

Analysis

user interaction
yes
max time kernel
209s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ironbark_1-1458-38.exe
Size 6.9MB
Sample260623-vehgnset4k
SHA256 f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8
MD5 ab9f9d02c5e8a5751e87fd5f14b78fce
SHA1 7f347d7007b9fd8f5149228f189f93b0e9ccf71c
SHA512 931c7510dd699dae3f9f38bf6f110f061a4008951bf42f3ac12aad130e85eed772784aba8fa0bb713628160702854ad839396dc7d942e698d25cd1ce57a9797b
SSDEEP 98304:e2eE9xWNu3LvFfafwSlkde15Etbl+10bgrm:RzFmlk8Q
TLSH
T18C768D03F39581EDC05EC0B48356A233EA72F8994739B2EB5BD40B112E66F909F1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "18874433"	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0"	ironbark_1-1458-38.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 99021f004902d5dfa3233b02040000000000370200003153505305d5cdd59c2e1b10939708002b2cf9ae7301000012000000004100750074006f004c006900730074000000420000001e000000700072006f0070003400320039003400390036003700320039003500000000002a010000aea54e38e1ad8a4e8a9b7bea78fff1e90600008000000000010000000200008001000000010000000200000020000000000000002a0014001f50e04fd020ea3a6910a2d808002b30309d14002e8005398e082303024b98265d99428e115f0000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000006e185a8840a4da4a812bdb871b942259ffffffffffffffffffffffff00000000010000001b00530065006100720063006800200052006500730075006c0074007300200069006e00200044006f0077006e006c006f006100640073000000000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d0065000000140000002a2f77730d0000006f00000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f0000001d000000530065006100720063006800200052006500730075006c0074007300200069006e00200044006f0077006e006c006f0061006400730030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe00000020000000000000000000000000000000000000000000000000010000006f020000	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	ironbark_1-1458-38.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4"	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ironbark_1-1458-38.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ironbark_1-1458-38.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	ironbark_1-1458-38.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ironbark_1-1458-38.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\c4611_sample_explain.pdf:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4504	ironbark_1-1458-38.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	firefox.exe
Token: SeDebugPrivilege	3412	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	4884	firefox.exe
Token: SeDebugPrivilege	3412	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4504	ironbark_1-1458-38.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
4504	ironbark_1-1458-38.exe
3412	firefox.exe
4884	firefox.exe
3412	firefox.exe
3412	firefox.exe
3412	firefox.exe
4504	ironbark_1-1458-38.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 3412	364	firefox.exe	102
PID 364 wrote to memory of 3412	364	firefox.exe	102
PID 3412 wrote to memory of 3116	3412	firefox.exe	103
PID 3412 wrote to memory of 3116	3412	firefox.exe	103
PID 3412 wrote to memory of 3116	3412	firefox.exe	103
PID 3412 wrote to memory of 1388	3412	firefox.exe	104
PID 3412 wrote to memory of 1388	3412	firefox.exe	104
PID 3412 wrote to memory of 1388	3412	firefox.exe	104
PID 3412 wrote to memory of 1388	3412	firefox.exe	104
PID 3412 wrote to memory of 2636	3412	firefox.exe	105
PID 3412 wrote to memory of 2636	3412	firefox.exe	105
PID 3412 wrote to memory of 2636	3412	firefox.exe	105
PID 3412 wrote to memory of 2636	3412	firefox.exe	105
PID 3412 wrote to memory of 4656	3412	firefox.exe	106
PID 3412 wrote to memory of 4656	3412	firefox.exe	106
PID 3412 wrote to memory of 4656	3412	firefox.exe	106
PID 3412 wrote to memory of 3240	3412	firefox.exe	107
PID 3412 wrote to memory of 3240	3412	firefox.exe	107
PID 3412 wrote to memory of 3240	3412	firefox.exe	107
PID 3412 wrote to memory of 3240	3412	firefox.exe	107
PID 3412 wrote to memory of 5764	3412	firefox.exe	108
PID 3412 wrote to memory of 5764	3412	firefox.exe	108
PID 3412 wrote to memory of 5764	3412	firefox.exe	108
PID 3412 wrote to memory of 5764	3412	firefox.exe	108
PID 3412 wrote to memory of 6128	3412	firefox.exe	109
PID 3412 wrote to memory of 6128	3412	firefox.exe	109
PID 3412 wrote to memory of 6128	3412	firefox.exe	109
PID 3412 wrote to memory of 6128	3412	firefox.exe	109
PID 3412 wrote to memory of 4980	3412	firefox.exe	110
PID 3412 wrote to memory of 4980	3412	firefox.exe	110
PID 3412 wrote to memory of 4980	3412	firefox.exe	110
PID 3412 wrote to memory of 4980	3412	firefox.exe	110
PID 3412 wrote to memory of 1872	3412	firefox.exe	111
PID 3412 wrote to memory of 1872	3412	firefox.exe	111
PID 3412 wrote to memory of 1872	3412	firefox.exe	111
PID 3412 wrote to memory of 1872	3412	firefox.exe	111
PID 3412 wrote to memory of 5984	3412	firefox.exe	115
PID 3412 wrote to memory of 5984	3412	firefox.exe	115
PID 3412 wrote to memory of 5984	3412	firefox.exe	115
PID 3412 wrote to memory of 5984	3412	firefox.exe	115
PID 3412 wrote to memory of 5736	3412	firefox.exe	117
PID 3412 wrote to memory of 5736	3412	firefox.exe	117
PID 3412 wrote to memory of 5736	3412	firefox.exe	117
PID 3412 wrote to memory of 5736	3412	firefox.exe	117
PID 3412 wrote to memory of 5344	3412	firefox.exe	118
PID 3412 wrote to memory of 5344	3412	firefox.exe	118
PID 3412 wrote to memory of 5344	3412	firefox.exe	118
PID 3412 wrote to memory of 5344	3412	firefox.exe	118
PID 3412 wrote to memory of 4884	3412	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ironbark_1-1458-38.exe
"C:\Users\Admin\AppData\Local\Temp\ironbark_1-1458-38.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {04c67399-4103-4d41-806a-efd06a70f066} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {5ee99a4d-332d-45b6-9f34-a683fef4e2a3} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3548 -prefsLen 27276 -prefMapHandle 3552 -prefMapSize 270279 -jsInitHandle 3556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3564 -initialChannelId {0bb1ab41-3275-4e10-bc49-294b8147d1d7} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3740 -prefsLen 27276 -prefMapHandle 3744 -prefMapSize 270279 -ipcHandle 3752 -initialChannelId {759585e8-8be8-4225-b562-560de54bcc40} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360 -prefsLen 34775 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2752 -initialChannelId {1de83d72-1b1c-4b7e-9bfd-829b6ad2976d} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4756 -prefsLen 34931 -prefMapHandle 4796 -prefMapSize 270279 -ipcHandle 4808 -initialChannelId {3519645f-dfc6-4acc-b604-d7658e6673b0} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32952 -prefMapHandle 5128 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {288fcc22-d773-4ebf-b051-e21118e9e485} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32952 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {0c67f209-d406-4752-9b09-90ce88213294} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {9dc3c286-aaa1-4023-9180-305777de9eea} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6264 -prefsLen 33071 -prefMapHandle 6268 -prefMapSize 270279 -jsInitHandle 6272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6280 -initialChannelId {4c0feb86-b639-451e-a69d-556e54a605b0} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6516 -prefsLen 33071 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6716 -initialChannelId {44bb4f44-e64f-47e5-8174-defd0d973f10} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 33071 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {761eeb4a-f43b-4a0b-8402-2de0da92e957} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 5776 -prefsLen 35200 -prefMapHandle 5772 -prefMapSize 270279 -ipcHandle 5240 -initialChannelId {eb887d15-5027-4051-a7f8-5e8506a59319} -parentPid 3412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\AlternateServices.bin
Size 10KB
SHA256 a3c3897abbac1f3ec243d161a8b32f929f2162e139af6c4bdaeeaa59ea0a4051
MD5 60650b936df9d3885fea095eea629839
SHA1 ab25637f74b890d1559c1e095ebc94b5752f1086
SHA512 5980097c3a5009a6ec81d4b0c5e788a08e72063bad13bac793982b9e17f8178c74307815a9e85bee2dc726a7fdba45689268a80c0afd1c07ceaf5a1e1a3b0504
SSDEEP 24:wuhMZjas91vDr9xrDn9BnDm9VvaDh5q9F55A5fDK9FmDgd9lSD:ov5DJZD9NDcBaDfI56fDo0DgXAD
TLSH
T1F02263E76FB2B462F0A28FB44058714CDC33132556799594C64490F752C1FBAA13EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\AlternateServices.bin
Size 17KB
SHA256 e1e6985bda6be0581cce1a68ce1ea9c9bc518a6af69485f7332727ffbd5c7dba
MD5 52e1147d4b32720c212dd52ea268392c
SHA1 b2f3d6739666c96dcdb4e1d0d10faa87bb155a24
SHA512 be5384c24fa3bebabc174f9e20f782bcdb1d2914910dedd0bde74ed0efdc8e5a85bb257cf1cd3e7848a74206ca6da22b91b125c0920a29f64872206a9a9a4997
SSDEEP 96:lau6S+mBCxI56xaku4OuFM/pCryx2/byuZ/zy8t/uG:YQC22TZZLFt
TLSH
T1898230E76BF26462F0628FB0409C758CDC3313155A6CE694C64490E726D1BB6A23EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 18283220b7fa1c923f400347f2e4397bac57f58d18c6f15a6c2627f4c267fc37
MD5 057b4ece22e47c014f12ed5b31247157
SHA1 bce3a0275b324787bb6506fd76c0228992cbb931
SHA512 f23bde961649477f2c3f52712595fbbc411ec45d5b5825688e8808818ab6c346143ba6f316ee145d5a45a09b431b8bea8bd3742ec7c7c78a53af1daa995bc854
SSDEEP 192:M1d66JozGzgCl6mc0dSOv5zboPvmlyjQ+o:2d66JozGzgC1jrboHmlyj0
TLSH
T1A8F11CA8FA28863BC418527BDCA61B450F35389A9C4E3F1932DC700C2C576DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f024e1a9de116709ed04bd67aed57af47a34cf4dcc155401135cbe72c206b161
MD5 b94ddb45be5ccdd6bc235db072387990
SHA1 64341ca9d9af5e53e777c9a47cea17210cbce71e
SHA512 b9d7b7a4d921bee77336ac316c8a4468481351f8260f2de6563a176f1f22e9f732f73a52840018b9f243ad2b5ce55004fb5e113984d24ce84e9ce74976cf2116
SSDEEP 192:8Ov5zbowZmlyjkx61d66JozGzgCl6mc0d:/bowZmlyjjd66JozGzgC1j
TLSH
T106D1CA68F638963BC459523BCCA60B400F36399A984E3F2932DC741D2C576DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fe96fd47c67d4654b631e0f5505ba8a4bec3d7f118b0f01a2ffc1d4166d2f284
MD5 a7b740de8a233b58607ab6b8055c380c
SHA1 ca7cc499cb243ef083aa864f9fe9b534980c0071
SHA512 726bbd4df3d4aeba4888e0cd3e6bc5a18dc59d17cff15ef966dea85ac86f5827d805bd4dab6c767b6e045c717c45601a48a1c94527086352e3c16574746d6b28
TLSH
T11B219A4C3DF94D2EAA8BE26C7445028E53144A8205472D434E12EFCCCEC1AD9336EC7D
MD5 SHA1 SHA512 TLSH

Submit Download

18757b40-f083-4f4e-8189-2396a3565302

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\18757b40-f083-4f4e-8189-2396a3565302
Size 235B
SHA256 8818cbff7fdb486b7d53b04f65915a7c0287c93f9e7141240aa2773d81cdb355
MD5 7258828e26ff7d5c728431108371fa5e
SHA1 c68fc3419cdb0dfb8c08b591c66f9b2dc5bb91c0
SHA512 39bc765087b16b11cda21515881dadf4c749d4e033d98a218b50f6432d930da39c6c199b9694b526cc5e2c051bda1b8982993dcc8c318264efd1dd62efc93d13
TLSH
T149D0978068EC632C0C040F02F0E1F8CA306C8C3B10B168208A5200B88AB9AC80212C1A
MD5 SHA1 SHA512 TLSH

Submit Download

31c35ae4-0132-4eb9-950f-18db92fe2cbc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\31c35ae4-0132-4eb9-950f-18db92fe2cbc
Size 883B
SHA256 d6a68717767c25169274c990ad9a19e30e8444389fe2a38bb1e1ec74db72486e
MD5 bfe29002d593fabe5024c913a168411f
SHA1 752f90b53b9a5fc0a0677b1b4828825afa23c62e
SHA512 431ee0f3ece7268a8b2285a9fab85c47f476479abb903eed5d52f38beb07be126ebd2ff8ae30b4e75464552d3805db08d95d6c4d51658523e4bac579ecba3eda
TLSH
T18A110081A638B9B38C7CD25B855537028FE46A2380C644187EB15B180C7A92E936B20B
MD5 SHA1 SHA512 TLSH

Submit Download

49d2777f-ef0f-4139-bb6d-6396b6175600

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\49d2777f-ef0f-4139-bb6d-6396b6175600
Size 235B
SHA256 36522664bce19b2489aee0cfeb5776947a6a606b24f924fc530f77512090fc41
MD5 8ac08a83572462880271f9a2a85508a1
SHA1 56724054b42a84cbd6d3e8e9225a637760e74f29
SHA512 0bb46367eefd730fb89facacf89f31b489c73d9711411d2150679485adb2e6902785f020a68a1ac939e8d0e7f1e924be13eb720e4836212024bd7c229dacc9c8
TLSH
T1ADD097A064A8635D08003F1EF0A0A8C230A88C3720B89810CA608074D9FDECA0211D07
MD5 SHA1 SHA512 TLSH

Submit Download

6d3bdeba-89b0-4ea4-88fa-d1c4f2ccdb84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\6d3bdeba-89b0-4ea4-88fa-d1c4f2ccdb84
Size 12KB
SHA256 2a60abbd8ac34277379f4272bcb16644f2012f7180cc099ff3d87a22b980c17d
MD5 0d82dd4221006d1738a89343db5a0a72
SHA1 c4d9c9a76bcb42d2d8bd1979530eb0dfcd6f86cf
SHA512 b5dcbfbe6efc693f3838cab8a14d450fd3c9fab582fcb050b78ad94f6507487fe379b8de2277b9add6c9f1f5677055a32f7e4f447e9446434caa0993fde4113d
SSDEEP 96:JAcvrN6UjfavUyoE3k1FeqbHfGgMOzYoREI+O/r69XeEhCG/YxQq5w/NmGyQrN2P:TvlEcbWNtibGDDu9uSqpSd
TLSH
T17942CCFDDE12004B3E65E52EF2A5E96F2017293249CC879D6BFC483A26D6DBB1127314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1f544e9-d394-41f5-84bd-31242f4af909

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\a1f544e9-d394-41f5-84bd-31242f4af909
Size 886B
SHA256 a17e93d6435f718ef2798f30e76c85f25c4c26f728369c18d2a2b08ad6ec75b5
MD5 eeefb79a9215b21cdd0c4d49a3e057ce
SHA1 88f3849955b03e18a1ac396dbe9056a5622f0441
SHA512 4865fca78cf62de114a3f7d15ded2b741eb92ea4209b9108c327d4854ffd32224feead43be6e5bc87755a67eca54d53c5596b9734b925b7336c537c08a4e3745
TLSH
T1871127819674B5B3CC7CE1ABD5D137064BE4751380CA19183EA457180CBD91E536B207
MD5 SHA1 SHA512 TLSH

Submit Download

dcb10e0c-4c24-40f7-9aa8-eee5d506e2e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\dcb10e0c-4c24-40f7-9aa8-eee5d506e2e6
Size 2KB
SHA256 88a47eadb65e7f0ddbf000a3b91856f2feebe4c3eb44d880284a24a45206a9b2
MD5 5f3a84a9d4a1083f4d79a25f8fd8c0be
SHA1 4c9772590e29a18297d0d3f178931c0cdf8cee15
SHA512 37b34ca19b8a5ec923f06c5bb195b47204e66ca355b24b824b418c13349fa06511143d093bd99337de63c48b2f24f8c06adf26e97b8a80bb2ef87a1a1c460055
TLSH
T15241F55C35785D775CEAF19DE582278E97644B1300C62C432E62DF0C8CD5659336B47B
MD5 SHA1 SHA512 TLSH

Submit Download

ee771fdb-d5d3-4829-b1c3-49178ec76d71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\ee771fdb-d5d3-4829-b1c3-49178ec76d71
Size 16KB
SHA256 4782000af0e53d008232c2e649c99e187d33540def46e26f729e792bfb587b8e
MD5 872c849db57602e07a6415a4f3b081e2
SHA1 ab1a1bffd79c101a6bbeb83bc2767b4c436cc3cc
SHA512 4893e3024430677cfaecf8673886cb9c1ee369611af789ea3af004c47d81c2e0d83051a227c3a5b4a65502e7584034db62e8e0c04673fdbb6336d78452b32bd1
SSDEEP 192:0cX7FGQRHFABS21yjv5+AAVtp1pjyTaj+FAGgKLqi8XHtubCqc93jjkVckqbJqKX:0QJGQ9acNv5+TV71pyoIQbEKRnlRSC
TLSH
T1F272C856686045BA8251E368D4F87FC3E6F528CF4C418FCEDBE4BE086DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 7KB
SHA256 1e6a3124365ee8c5f4eda77259c2cd1787e32ec89b5d24ba4c6880383b4a25a0
MD5 70f3e786c53b12b842dc45d66665d091
SHA1 056fed0291cd82b9bf23f137cd973ee85c3226b8
SHA512 6cc3d91766ba5441c88ad1fa7ce7533e38db35077d0936f55c43d9b7e2f5290ce26618c4a14bdeec280a729c8f352a7e59cd55d9c23fde39d922959698a49770
SSDEEP 96:xHBUTUxQPqGq5fg6hNbzSWSSlWdv9jFnqH/8MBw88n8L4cn+8GLGS:HuCR5fg6h3SSddBw88tB
TLSH
T12FE12F789508CB7F64B676ACAC688C315AB2013B77BF28C710B654C4055CF3442FAADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 9910e0f87587f1edc6143f942c424f8c88ff89d4a2d0bac3b07b9e9a6473337b
MD5 b47cbaa4897f98438c8c33ef4f9455e2
SHA1 3995b978e182ffd8e26745ae4fe1c110bc47e3ae
SHA512 ba2e09d2bbf2d22d65a7fdd9d732f3c6f38d1d38bdd3733c0d5ae54c421b00de468deda945aa88256cac4641e244f455af5e535d5a256e337a1f7c83e5e04cca
SSDEEP 96:xHBUTUxVqGq5fg6h1zSWSSlWdv9jFnqH/8MBw88n8L4cn+wGLGS:HyR5fg6hDSSddBw88hB
TLSH
T1CAE120789448CB7F74B676ACAC688C315AB2413B77BF28C750B65484055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 edc11177a8ccf791480e99f7f74713d637bcfabbb528f98b5733140069bd3695
MD5 c92d17c49103a11491e84cef92604abd
SHA1 4f4025b9477d5497b60662e9fba45322eacbab44
SHA512 11c2ea3b750c4ab747cc77f6186829f1085f8d68b86b0d3ee2b101851126824bbe64f242c5094a10000b1006d90674a51c714389cf7abc783081b5b1e7e47c8d
SSDEEP 96:xHBUTUxVqGq5fg9o1zStSSlWdv9jk0nqH/8MBw88n8L4cn+wGC:HyR5fg9ocSS9HdBw88hC
TLSH
T1CBE131789408CB7F74B676ACAC688C715AB2413B77BF68C710B65488055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 ccb6b7317b5f1ba692ca4c6ed6d9ee3ab741300a01c525aeea74b53a7cb2ec0b
MD5 45c5b4be32911739d14aa226f4a93bbd
SHA1 0e8a5faaef37c1f40673f3b3103a6f79bab08f1f
SHA512 5d03aa834190cf8a75a1f140ed7b957bd4c971b18f224cc88b8567276bfee92f3308f730d2f94b3345fd889cefd3fb0c159add3a2acc0d441757c236ae71e55f
SSDEEP 49152:XiwbkMngvZR+JhEYhAG58Q9hJCHkda13PUTEd:ywbkMngBS58Q9hoHkdSXd
TLSH
T1431639F824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4611_sample_explain.pdf

Path C:\Users\Admin\Downloads\c4611_sample_explain.pdf
Size 86KB
SHA256 2353deadc9fa87817413b239841a373fb51de8b74a75d3c8c863de735ca0b4a0
MD5 88bb00da1e9bab21e9cb13248b8770b1
SHA1 22756265d4e1544e46259b9fb13c7b5b0762134b
SHA512 be75b49240830efc32e9f26b9db17bc9ec28e0f675d78accfa0f3d3b1eee91dea603fd88423092027aea0ac8954e2068a9625360c9c7e21ecb810ac274582297
SSDEEP 1536:dTQMFAn43N23zZihqU6PjlW9jeukqAAINI4bN0BKW+ZVbEoeT9LGPF:dsM9dkdisb0VeukTvR0BOVFWAPF
TLSH
T1E583E065C6CAACACD1430344533EB3564F8EF0A175C66C83786C67474BB6EDAF863A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4504-9-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-11-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-10-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-8-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-12-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-0-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-7-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-6-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-1-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

memory/4504-2-0x00000253954C0000-0x00000253954C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads