Analysis
- user interaction
yes - max time kernel
488s - max time network
600s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 03:34
General
- Target Firefox Installer.exe
- Size 1.4MB
- Sample261102-d4y3aaex2y
- SHA256 10fad0789a16665af7073fccd7fcb1879aed624312db99f598b80c4f43f565fa
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 40 IoCs
- Runs ping.exe 1 TTPs 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 51 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58e172A.tmp\Firefox Installer.exe"C:\Users\Admin\AppData\Local\Temp\58e172A.tmp\Firefox Installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS81610CB8\setup-stub.exe.\setup-stub.exe3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nsnE51C.tmp\download.exe"C:\Users\Admin\AppData\Local\Temp\nsnE51C.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsnE51C.tmp\config.ini4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS84BEC130\setup.exe.\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsnE51C.tmp\config.ini5⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"6⤵
-
-
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"6⤵
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install7⤵
-
-
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB7⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB8⤵
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "2276" "\\.\pipe\gecko-crash-server-pipe.2276" "C:\Users\Admin\AppData\Local\Temp\\" "752" "20261022150525" "764" "804"9⤵
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install7⤵
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "5916" "\\.\pipe\gecko-crash-server-pipe.5916" "C:\Users\Admin\AppData\Local\Temp\\" "716" "20261022150525" "764" "796"8⤵
-
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startup4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startup5⤵
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "1896" "\\.\pipe\gecko-crash-server-pipe.1896" "C:\Users\Admin\AppData\Local\Temp\\" "752" "20261022150525" "764" "804"6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 1924:26056 -prefMapHandle 1928:307257 -ipcHandle 1960 -initialChannelId {c69a60d6-450a-48c5-b7f0-ccb6af4bef6b} -parentPid 1896 -crashHelperPid 0 -crashHelper 1968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 2180:26056 -prefMapHandle 2184:307257 -ipcHandle 2040 -initialChannelId {4a5b4268-4bd4-4aac-8323-dc5617dd43fb} -parentPid 1896 -crashHelperPid 0 -crashHelper 1996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4088:31822 -prefMapHandle 4092:307257 -jsInitHandle 3996:161360 -parentBuildID 20261022150525 -ipcHandle 4104 -initialChannelId {184b0da7-3a17-4ed7-8acc-f465e5234cff} -parentPid 1896 -crashHelperPid 0 -crashHelper 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 4276:32641 -prefMapHandle 4280:307257 -ipcHandle 4360 -initialChannelId {58c7f813-8fbf-4d70-9b6d-18f765579ae2} -parentPid 1896 -crashHelperPid 0 -crashHelper 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2524:32793 -prefMapHandle 2504:307257 -jsInitHandle 2952:161360 -parentBuildID 20261022150525 -ipcHandle 2892 -initialChannelId {d5199233-c43b-4079-a2bf-91d102db49bd} -parentPid 1896 -crashHelperPid 0 -crashHelper 3036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -sandboxingKind 0 -prefsHandle 5760:36223 -prefMapHandle 5764:307257 -ipcHandle 5772 -initialChannelId {8618a55f-b4ee-418b-995b-d67ff3da5c63} -parentPid 1896 -crashHelperPid 0 -crashHelper 5780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912:34428 -prefMapHandle 5924:307257 -jsInitHandle 5916:161360 -parentBuildID 20261022150525 -ipcHandle 4480 -initialChannelId {ed40104f-4593-4121-aeb9-8de8ae3e5463} -parentPid 1896 -crashHelperPid 0 -crashHelper 6020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6332:34474 -prefMapHandle 6336:307257 -jsInitHandle 6340:161360 -parentBuildID 20261022150525 -ipcHandle 6348 -initialChannelId {831a1eca-6bda-42e1-95b7-db4498b34314} -parentPid 1896 -crashHelperPid 0 -crashHelper 6352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6512:34474 -prefMapHandle 6516:307257 -jsInitHandle 6520:161360 -parentBuildID 20261022150525 -ipcHandle 6528 -initialChannelId {6211bc30-4ab3-40cd-89ff-cdb22bdecc36} -parentPid 1896 -crashHelperPid 0 -crashHelper 6536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --ping-cleanup "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports" C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tye97km2.default-release-17935910109806⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c for /l %i in (1,1,60) do (del /f /q "C:\Users\Admin\AppData\Local\Temp\58e172A.tmp\Firefox Installer.exe" 2>nul & ping -n 2 127.0.0.1 >nul & if not exist "C:\Users\Admin\AppData\Local\Temp\58e172A.tmp\Firefox Installer.exe" (rd "C:\Users\Admin\AppData\Local\Temp\58e172A.tmp" 2>nul & exit))2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Local\a8d785\f03ab0.exe"C:\Users\Admin\AppData\Local\a8d785\f03ab0.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c for /l %i in (1,1,60) do (del /f /q "C:\Users\Admin\AppData\Local\a8d785\f03ab0.exe" 2>nul & ping -n 2 127.0.0.1 >nul & if not exist "C:\Users\Admin\AppData\Local\a8d785\f03ab0.exe" (rd "C:\Users\Admin\AppData\Local\a8d785" 2>nul & exit))2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SaveMeasure.docx" /o ""3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt3⤵
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9636 -s 16842⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 9636 -ip 96361⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
Uninstall.exe
install.log
shortcuts_log.ini
Firefox.lnk
Navegação privativa do Firefox.lnk
~avegação privativa do Firefox.tmp
~irefox.tmp
update-config.json
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
activity-stream.contile.json
activity-stream.shortcut_cache.json
activity-stream.shortcut_cache.json
asrouter.ftl
webext.sc.lz4
prep_Activatable Class_Hermes_perf.cache
Firefox Installer.exe
setup-stub.exe
AccessibleMarshal.dll
CoreMessagingXP.dll
InstallationDirLayout.dll
Microsoft.InputStateManager.dll
Microsoft.Internal.FrameworkUdk.dll
Microsoft.UI.Composition.OSSupport.dll
Microsoft.UI.Input.dll
Microsoft.UI.Windowing.Core.dll
Microsoft.UI.Windowing.dll
Microsoft.WindowsAppRuntime.Insights.Resource.dll
Microsoft.WindowsAppRuntime.dll
application.ini
crashhelper.exe
crashreporter.exe
default-browser-agent.exe
dependentlibs.list
dxcompiler.dll
firefox.VisualElementsManifest.xml
firefox.exe
firefox.exe.sig
freebl3.dll
gkcodecs.dll
lgpllibs.dll
libEGL.dll
libGLESv2.dll
maintenanceservice.exe
maintenanceservice_installer.exe
marshal.dll
mozavcodec.dll
mozavutil.dll
mozglue.dll
mozinference.dll
mozwer.dll
msixcomserver.dll
msvcp140.dll
msvcp140_atomic_wait.dll
nmhproxy.exe
notification-helper.exe
notificationserver.dll
nss3.dll
omni.ja
onnxruntime.dll
pingsender.exe
setup.exe
b4c535f4-4feb-4018-b427-f2502e451b97.zip
AppAssocReg.dll
CertCheck.dll
CityHash.dll
InetBgDL.dll
System.dll
UAC.dll
UserInfo.dll
WebBrowser.dll
bgstub.jpg
config.ini
installing.html
installing.js
installing_page.css
profile_cleanup.html
profile_cleanup.js
profile_cleanup_page.css
stub_common.css
stub_common.js
AccessControl.dll
ApplicationID.dll
ServicesHelper.dll
ShellLink.dll
components.ini
extensions.ini
liteFirewallW.dll
nsExec.dll
nsJSON.dll
options.ini
shortcuts.ini
remote-settings-startup-bundle-
tmp-vvb.xpi
tmpaddon
tmpaddon
f03ab0.exe
SaveMeasure.docx.LNK
SaveMeasure.docx.LNK
index.dat
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.automaticDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
EFBV44OTJFXZM7LX89F1.temp
QI2BC6RYYOR6K718Z7HL.temp
U02SGIBX5ZNSS7ZNW7G9.temp
ZI3A1NCPI4YJ57NYU2YX.temp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
ExperimentStoreData.json
addonStartup.json.lz4
addonStartup.json.lz4
addonStartup.json.lz4
containers.json
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
038854c2-3660-4f54-b694-07ac5fab0420
30205f18-825e-4b6c-953b-00da3ce63e87
32587295-4756-4f73-af22-fe8aada08ee8
55fef627-f907-4a39-96a6-1687cc711b42
58e9a29b-4f0c-4eec-82fd-1a9077fa7e45
5e1866e9-8d9a-4102-8977-d1bf41865f23
896dd26d-ea3e-45ab-b55d-f9393e8746db
d17193dd-097a-4236-b40c-203fded10bd3
d5c00b9a-8b62-4f93-8d50-4f8a93b3c9fd
state.json
extension-preferences.json
extensions.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
handlers.json
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
search.json.mozlz4
20261018-0-default.filter.delta
20261018-1-default.filter.delta
20261019-0-default.filter.delta
20261019-1-default.filter.delta
20261020-0-default.filter.delta
20261020-1-default.filter.delta
20261021-0-default.filter.delta
20261021-1-default.filter.delta
20261022-0-default.filter.delta
20261022-1-default.filter.delta
20261023-0-default.filter.delta
20261023-1-default.filter.delta
20261024-0-default.filter.delta
20261024-1-default.filter.delta
20261025-0-default.filter.delta
20261025-1-default.filter.delta
20261026-0-default.filter.delta
20261026-1-default.filter.delta
20261027-0-default.filter.delta
20261027-1-default.filter.delta
20261028-0-default.filter.delta
20261028-1-default.filter.delta
20261029-0-default.filter.delta
20261029-1-default.filter.delta
20261030-0-default.filter.delta
20261030-1-default.filter.delta
20261031-0-default.filter.delta
20261031-1-default.filter.delta
20261101-0-default.filter.delta
20261101-1-default.filter.delta
crlite.filter
data.safe.tmp
data.safe.tmp
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite-wal
3870112724rsegmnoittet-es.sqlite-wal
targeting.snapshot.json
xulstore.json
~WRD0001.tmp
trace.txt
trace.txt
memory/2888-831-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2888-477-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3980-405-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-410-0x00007FFD23C70000-0x00007FFD23C80000-memory.dmp
memory/3980-1030-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-409-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-1020-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-406-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-411-0x00007FFD23C70000-0x00007FFD23C80000-memory.dmp
memory/3980-1019-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-407-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-1031-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/3980-408-0x00007FFD269A0000-0x00007FFD269B0000-memory.dmp
memory/4640-350-0x0000020F2DE00000-0x0000020F2DEFF000-memory.dmp
memory/5176-186-0x0000023281E00000-0x0000023281F00000-memory.dmp
memory/5176-185-0x00000232819B0000-0x00000232819D0000-memory.dmp
memory/5176-179-0x00000232801E0000-0x00000232802E0000-memory.dmp
memory/5176-201-0x00000232940C0000-0x00000232940E0000-memory.dmp
memory/5176-187-0x0000023281C00000-0x0000023281C20000-memory.dmp
memory/5656-135-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5656-5-0x0000000000400000-0x0000000000446000-memory.dmp
memory/9636-7918-0x0000000008180000-0x0000000008190000-memory.dmp