hxxps://pinnaclecoreloans[.]com/apply

Analysis

user interaction
yes
max time kernel
3s
max time network
14s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pinnaclecoreloans.com/apply
Sample260917-283s2aeb49

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	firefox.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3588	4896	firefox.exe	88
PID 4896 wrote to memory of 3588	4896	firefox.exe	88
PID 3588 wrote to memory of 5232	3588	firefox.exe	89
PID 3588 wrote to memory of 5232	3588	firefox.exe	89
PID 3588 wrote to memory of 5232	3588	firefox.exe	89
PID 3588 wrote to memory of 4904	3588	firefox.exe	90
PID 3588 wrote to memory of 4904	3588	firefox.exe	90
PID 3588 wrote to memory of 4904	3588	firefox.exe	90
PID 3588 wrote to memory of 4904	3588	firefox.exe	90
PID 3588 wrote to memory of 4676	3588	firefox.exe	91
PID 3588 wrote to memory of 4676	3588	firefox.exe	91
PID 3588 wrote to memory of 4676	3588	firefox.exe	91
PID 3588 wrote to memory of 4676	3588	firefox.exe	91
PID 3588 wrote to memory of 2772	3588	firefox.exe	92
PID 3588 wrote to memory of 2772	3588	firefox.exe	92
PID 3588 wrote to memory of 2772	3588	firefox.exe	92
PID 3588 wrote to memory of 2660	3588	firefox.exe	93
PID 3588 wrote to memory of 2660	3588	firefox.exe	93
PID 3588 wrote to memory of 2660	3588	firefox.exe	93
PID 3588 wrote to memory of 2660	3588	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://pinnaclecoreloans.com/apply"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://pinnaclecoreloans.com/apply
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1952 -initialChannelId {f6d9c070-5e56-44f8-b0ad-7c7aa5ee2207} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {ea2910ee-6ae0-4caf-9a04-6d995b56b511} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 25164 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {13e75023-87c1-4b52-8967-f2b3a5c13fcd} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27274 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {4acde438-71fe-46a1-91aa-4e46243b90fb} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3444 -prefsLen 34773 -prefMapHandle 920 -prefMapSize 270279 -jsInitHandle 1064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2800 -initialChannelId {44aec9e5-275f-4bd7-becb-6be7f898ef56} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 35010 -prefMapHandle 5016 -prefMapSize 270279 -ipcHandle 1596 -initialChannelId {274a29f4-c64b-40c9-a5d6-9312c1be56e3} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {c9466c7e-4237-40b8-bff9-3db6e5aa06da} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5844 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {7954de02-8863-4612-ad21-15c33881ab09} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6036 -prefsLen 32952 -prefMapHandle 6040 -prefMapSize 270279 -jsInitHandle 6044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {22008457-22c8-4811-a848-e944dc437148} -parentPid 3588 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3588" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\AlternateServices.bin
Size 10KB
SHA256 da3c68f8773d2ccbe1a8003ea4d0b9ddc34c40e1a091e86fc920d333f66c9ed4
MD5 050fee40f1c49769e4ab22c2bd204ad1
SHA1 cbadae9341188b56c895fce48daf65e939fe58cf
SHA512 c256c61e1d692ca41ee348fdb92464145892a2bfc2ef8b15b87b1ed3f2facc3fd60dbc32ef848e9c69c5569888b4f78e58c67eb8e97279bb63e1c3ab0068c712
SSDEEP 24:NuhMZmquFgbHkaDux2WDbuFUf/uhGf8quBezNnuhWlduVi:mpebHkbbaWWM8pQzNu4YA
TLSH
T17622E3FB237A9923E0121E7064A83588DC3306161D94DBB46E5CA0D74B913DDA63FB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 d2befca216f88fc7628b184243713f82ec3973d5e1b2f8427c150727fc48a58d
MD5 9db7ac5796c8df777bea6ce5517aa6f4
SHA1 1dd38e1230a1eaa9c7a7a2a7cbf340d8bf736200
SHA512 ccdc7555fa9c95610d84349e88aede174e375d8fc1af644632dfe573a966a9224808b670e2782129b3d6483613f839bc3378d0ab928a17fd0953702810a96b5b
SSDEEP 768:iKmx1YiGcm+u8d/RYxfE0QbSbbbkb9Yd1/:ax13d/+H
TLSH
T11DD2F144EB2A953FD42952BBDCA507102F79B8C958092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d84b7d4bdc8875f561c08a8aacf0917ff47ae2b56446a6a04bba96688cc24964
MD5 34c14c0516791c12b694e2ee5596d331
SHA1 3560d11bd30c6a190b110f77b2be4948e15511e6
SHA512 ee99e4b591a5ea062d437c11fb0efb5df4e521a19f9e29e968754080df8989629a7b35a7e29a2d99a1d46577c374b70692671dab66ec3f9ec4d1116f2ef5e270
SSDEEP 768:j1nZbx1YiGcm+u8d/RYxfE0QbSbbbkb9Y:Dx13d/+
TLSH
T12AD2F144E72E953FD42952BBDCA507002F79B88A580D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\db\data.safe.tmp
Size 56KB
SHA256 f562aab08a17703a045dbcf06f4523d59ad200f7c361fdf841fab6edad74bdd9
MD5 41aafacbc93d08afafa2c2fca6866bbb
SHA1 b5656c06c7fd07824168ffcece8fd563f11ddb80
SHA512 82cc9434e590b07d246e5dee1803967ccb5a00133f34174d9c01cc6120720b0557104589544e311d75853c272cc8d13af0e205ca896655f65aedbd6e63f2d982
SSDEEP 768:ZIJ1PdTogQiXo3Z3efiFexPtGcm+ucvbXoZ+KPyyCpl1Pb+b2b1bbbr0mC9UaCaj:AdTogQiXANefiFexxbYZ+fy9UaCak+
TLSH
T1F3430E80EB2B403FE82441BBA99517282B29F85149596F5B3A9C00791CCB3FF3D5E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4b6cf6653c02074c703728a366859420dade88b3179cd28f00ba94126cb57056
MD5 554c3e2b11ba33564df11bc552bf11f9
SHA1 c2f9cc3b392a28f551b71a8aaad54e5bc7415ec0
SHA512 cf491a4321c661a67d974e3432dd457a618111be8cab9213b3d765ca11f9915c9dcac9803ed379a66c310e1494915772c0c8c472958c53a7486ca8e5faf3a284
TLSH
T1EC216E5C35B94E6A5E87E69C7441068E53958E0708872C834E03EF8DCFC1AD9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

00a9d940-00b2-4072-8027-426a6c375876

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\00a9d940-00b2-4072-8027-426a6c375876
Size 235B
SHA256 f22f8eabab35b2ff5e369b60d2b74e5e67b5c84279daa92fc6a934802d5e73d6
MD5 347bc73d45b9e6f7a149a7efd0897206
SHA1 793d15725566131a6735ae75d4d1827f09fed00f
SHA512 5024a71a205bdf8fab80a27ba7f06774842bb8e1e51d1a53e31fa026da38d2ca3d9cb39d3c1a9c3943876557ed8090b9e00b9d3cc3bf7f63b9750c2be12ca384
TLSH
T1F8D0978028C8B37D88180F0BF0B0ABC634488C3398B07820D9A24034A9B9FC402A5C2B
MD5 SHA1 SHA512 TLSH

Submit Download

15863935-2fb1-4f51-8617-b16dd8c90f66

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\15863935-2fb1-4f51-8617-b16dd8c90f66
Size 6KB
SHA256 f30c2ae4d016652f21593cb3457c01b719c7b13aba81ac1929acec43633f902e
MD5 217a6cff774c9740140cd9e62b738981
SHA1 908ba90c2cb39aebf778fd8ff6a470a86365299f
SHA512 88b976fbccbc3c0d24da3eec1dc2ae5cf6a8c83910b38a822dca75a17bdf220cacb3afbe62aef5146db931d3bdf182b23985f427e3b6107f8b0ad72b3244a8af
SSDEEP 96:lWjlvtNFU1t1Dn/0/9fF/vO7MmwH0UhyeMp1HqFiLeD/0V/MwChnemN636AJsEhu:lslv4W0iStj3/zD4c2
TLSH
T15AE1BBFEDD1240433A66F62EF5A9BEAB005A293149C8C79C6BFC483A32D2DB71557311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d54223a-fe2b-4ae1-b165-72d52d771b49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\3d54223a-fe2b-4ae1-b165-72d52d771b49
Size 235B
SHA256 30617925f56b9719aa9106101b93b308136b2db1ddd646f850b20ac9807f9366
MD5 8c64fd766e47a4b53ba9fbca677f5787
SHA1 2394744200f01fc0f8202326d2153d96b2f3ac3b
SHA512 54fd6459f7bc0d1db8ec07d505f399b05ed4090e9e3b5bfbca76ece80a587e295e5f1646771f160277ce5ab10982ed726a17579f288c740a36f9e82e9e5877d7
TLSH
T1E2D097C874C82B6E0C000F07B4E06AC230444C3324F6A814C6E21578E9BD9C842A1817
MD5 SHA1 SHA512 TLSH

Submit Download

6db4a622-b514-4883-90af-1db5992338bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\6db4a622-b514-4883-90af-1db5992338bc
Size 2KB
SHA256 8a367355cd077206a64aecead6ab0d0cdae3a3e6098a105bcb6b7962daffb7df
MD5 1f6e35fcd7e82167989e66e4d6f0ad46
SHA1 c5b209d6837b4df294a5b8f60e95de2e7e4b0650
SHA512 9602ae773fa48f9c96e907f090974f48a856f9290c813d8a0ead4a9d604f95a37ccf55e0d222c37bde508dd3183ce66b304c22573ffa9456687bc35acb647f60
TLSH
T1DE41216879BC4D769CCAF14D8582238E97E0990300C67C476D52EF0CCD9265E737E52A
MD5 SHA1 SHA512 TLSH

Submit Download

fb1e305d-eebe-440e-be6a-b923f16e46e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\fb1e305d-eebe-440e-be6a-b923f16e46e4
Size 871B
SHA256 75651e3c1f1c7a8e7b4cfd1c3fa4ed2a3f4204829a5fba053e53489a5de2605d
MD5 f6ca799a07cfd42d8e9ff26fe5a298bd
SHA1 6cc98d18f9cfae1f6cd18315d1315e30d0836d5f
SHA512 b748704eccc4bdda18377583943ea1db511c5ded5777fa7a017a94af3b9c00fd92c3a42b243baf0a280770269473744f43a0b45faa12881ac4ed28882a5d9e93
TLSH
T1C1112F509631B6E1EC2CC34F89A63B069BE47523C0CAD6083CB15D044DBB60E93BA74B
MD5 SHA1 SHA512 TLSH

Submit Download

fcd95656-ef96-4c1b-a6a6-4a9703951c82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\datareporting\glean\pending_pings\fcd95656-ef96-4c1b-a6a6-4a9703951c82
Size 886B
SHA256 23fbee8c506124abe1b5531e20053bfc5920dc2bf93d67c99c1fd5d8b9ebef7d
MD5 19e0ba710145b43a9ad8f286172fb172
SHA1 2c494c7c3e200fb6f111d8c6a04bcd727f260bf4
SHA512 7479fb9e7b66c5e512e5886143a5c1fe79232b33ed593a895a383fe6cec5828c450295592e5e3b1bf609fa0c5f972a25ed276d0657e003929b8257336410769a
TLSH
T1C81104409635B6F1CC68D29BD5B13B438BE4342380C69B187D605A140DA791E577B607
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\prefs-1.js
Size 6KB
SHA256 863c3a2cdcb65edb0a20d46b74e088cf0d5fbb93a47e73840028ad828ea6def4
MD5 b800330f4587c74fa645b4fbdd8db65d
SHA1 590db6accd002125911c00e28f6a8f490112576a
SHA512 4987e96094f32582a21cdc4eff208f7d4472f6c3de48bb66fadf4afada4977d2eddf8b74dabfb417143e7bb130eecbc2ce2f845e74acd148103f656cdc77e59a
SSDEEP 96:xHLUTUwyqGqEfsdDf1zSq9RSSlXdv9jt+nbHutdBw88u8L4cnrjp:1oREfsdDfPRSSb6urBw88P
TLSH
T172E110789448CB7F74B677ACAC6448716AB2013BBBBF68D750B54484050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wx55ht6.default-release\prefs.js
Size 6KB
SHA256 ee2b230d616198f30a315d7f6368227172cd101f8e822fa9abddc0c3541c2620
MD5 f866fc0c507db2d69d4510ec9441e82b
SHA1 fdf9ae8dba9ba903b18b561718ebf222365bdfc8
SHA512 626b1ef8f80a586da5eae73f3fd7f5b4a6138466531e5d96f92625a9ae626bdbb92e5f141b2958396078ee09d8040e40c3725b3aea5ecbefd07881820ad8037f
SSDEEP 96:xHLUTUwyqGqEfsiA1zSpJSSlXdv9jKnbHutdBw88u8L4cnrjp:1oREfsiAQJSSAurBw88P
TLSH
T1E6E10E789448CB7F74B676ACAC6448316AB2013BBBBF68D750B54484054CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads