Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
597s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/05/2023, 16:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tributario-cpfdl7hweq-rj.a.run.app/622354/FFADJLWE6Y02KDQE35IIPNBC2895DA/Factura55276391*3.
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
https://tributario-cpfdl7hweq-rj.a.run.app/622354/FFADJLWE6Y02KDQE35IIPNBC2895DA/Factura55276391*3.
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
https://tributario-cpfdl7hweq-rj.a.run.app/622354/FFADJLWE6Y02KDQE35IIPNBC2895DA/Factura55276391*3.
Resource
win10v2004-20230220-en
General
-
Target
https://tributario-cpfdl7hweq-rj.a.run.app/622354/FFADJLWE6Y02KDQE35IIPNBC2895DA/Factura55276391*3.
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2236 firefox.exe Token: SeDebugPrivilege 2236 firefox.exe Token: SeDebugPrivilege 2236 firefox.exe Token: SeDebugPrivilege 2236 firefox.exe Token: SeDebugPrivilege 2236 firefox.exe Token: SeDebugPrivilege 2236 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2236 firefox.exe 2236 firefox.exe 2236 firefox.exe 2236 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2236 firefox.exe 2236 firefox.exe 2236 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2236 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2052 wrote to memory of 2236 2052 firefox.exe 66 PID 2236 wrote to memory of 4408 2236 firefox.exe 67 PID 2236 wrote to memory of 4408 2236 firefox.exe 67 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 3920 2236 firefox.exe 68 PID 2236 wrote to memory of 4856 2236 firefox.exe 69 PID 2236 wrote to memory of 4856 2236 firefox.exe 69 PID 2236 wrote to memory of 4856 2236 firefox.exe 69 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://tributario-cpfdl7hweq-rj.a.run.app/622354/FFADJLWE6Y02KDQE35IIPNBC2895DA/Factura55276391*3.1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://tributario-cpfdl7hweq-rj.a.run.app/622354/FFADJLWE6Y02KDQE35IIPNBC2895DA/Factura55276391*3.2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.0.1833241848\922831680" -parentBuildID 20221007134813 -prefsHandle 1652 -prefMapHandle 1628 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7d5674d-d40d-4f28-8473-ca802e5f7fd9} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 1732 1e276717558 gpu3⤵PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.1.1215517263\702718972" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 21749 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97c96363-4d21-4276-a6a7-211e6ceb70d0} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 2184 1e274a4a858 socket3⤵PID:3920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.2.49918344\1278374606" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3056 -prefsLen 21832 -prefMapSize 232675 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a805304-cc1c-4ed7-b8f8-ac39c36209f0} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 3100 1e2794d2558 tab3⤵PID:4856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.3.38056477\1476955539" -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 3844 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde09039-646b-41ea-a5cd-200268450f09} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 3856 1e27ad70658 tab3⤵PID:4840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.4.1035640820\550870824" -childID 3 -isForBrowser -prefsHandle 4424 -prefMapHandle 4384 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be93d2b-9ff3-4593-b846-4e8814979d71} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 4408 1e27b938658 tab3⤵PID:5116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.6.672798800\2031668402" -childID 5 -isForBrowser -prefsHandle 4776 -prefMapHandle 4780 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66f30305-96d1-4a2f-ae38-bc4c6c35f418} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 4684 1e27bbeb258 tab3⤵PID:5092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.5.1745570888\1270437112" -childID 4 -isForBrowser -prefsHandle 4588 -prefMapHandle 4664 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef7071aa-996b-4756-a549-a1aaa0382878} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 4580 1e27b939258 tab3⤵PID:4100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2236.7.22069081\56926482" -childID 6 -isForBrowser -prefsHandle 3220 -prefMapHandle 3208 -prefsLen 27759 -prefMapSize 232675 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78da144-8942-4cb1-9186-05c41d9bfa15} 2236 "\\.\pipe\gecko-crash-server-pipe.2236" 3612 1e269f5e258 tab3⤵PID:3348
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\510gyhsb.default-release\activity-stream.discovery_stream.json.tmp
Filesize144KB
MD587e2fb50cc792d22312c916c8073afa4
SHA107e6963ca55504796c8f2f30a3c82ebc1d38dc13
SHA2560b98db0977dfb470537a48705b137a640f2d26060b9c8f36e8ed0d99cb37e6cc
SHA512a43208cce4b107353b615aee224ebc93c310773518a34e4a92744f6e30a4b466360eca87bfaa8b21e38a846fda437c2a09d2f94f421a90236e65954cbf184425
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize5KB
MD55bf46bac316852bf98a2ed986305bf84
SHA1934d57253ecce9a83b7e66c8b8da08687e1de476
SHA256b783d36e2ddb7bdd97604e1c6d58df19d2badf9f24054aa62ca1f00878efcd66
SHA512f05ccd95b8a5f35669745eb164c245a0a705da0317bde06b1cf2d574aa0b73decfacd743615601fa2a9cae0ce3225eda5115286bf65142b64a9542e822571544
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\addonStartup.json.lz4
Filesize5KB
MD5f250c684a241935c2794c30ae164ae52
SHA1ea384bb1ba6744718b3bb8180800365d19887692
SHA256ff08fca842608945bab874f225d809065a58d1eda82f37f80f727bff95bc00a7
SHA512e16698db5705fb140ab0579c4ecbe51ba7fd2d494bf987c23bc5c46294e84749a3f1b43d0ef43fa75e7ce0d1b67ac3c22421717506be6fedb4dac49e2e7870ad
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\bookmarkbackups\bookmarks-2023-05-23_11_5lxkRdLxY4uLxvp7U9J81A==.jsonlz4
Filesize947B
MD5e264eae3ceb9c55e350502aa8ee34665
SHA13450193c413e6dc549de54f757f5543b71f72653
SHA25676fbfb2797a9173c1d46538da15149c94fed5a20b8c1401a8064a5657336d452
SHA51216dc15aceeadd602693c0f48f66f1de84e959f5faa58f1d8ef6e24c3bb763177e4078f5cf504a9542fdc08be20f0a5f134d4e63faf743af623cdf2843293826b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\broadcast-listeners.json
Filesize204B
MD572c95709e1a3b27919e13d28bbe8e8a2
SHA100892decbee63d627057730bfc0c6a4f13099ee4
SHA2569cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
SHA512613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182
-
Filesize
224KB
MD51dc67c6045dddf076deb72a78a77931e
SHA12295173960c6eccfdbf3e7e1b4a62df14bd7b988
SHA25659d334d65475d87345d4c342ae5d84072678c676cfb8e68e0f55912cf115cebe
SHA512c4e9fd7280f58dc393514e831e8d381a5e6c6238ae480d7a3d3713d6acc2164e789ca7fcb4f26d5f98bb29d925893f8853f066d5d59c5b4787e5b2c2df22e6e1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
Filesize
6KB
MD5c205c8a6591363331cd60c7286ad4ac1
SHA17d4c89374e88116484984f5d0b5df0d59aa63ecf
SHA25681db871d08aa9e5a991e6e04e462d416753cb92830860bca520d0c73d69b07c0
SHA512fd09bd9b7d42c6bfa6e508c071d0a67caba2437ceb56e0088cbf72e85690619ba9e7a81f2bc9956405a93210e2c46b8ec4bbf5aa7341f382457a5926ab9cd7c9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5c12575ca632c9e5aec1d62607fb5df16
SHA178676d0fcc386f3203f9d5df0e0c5ebcb5b68ed3
SHA25629ac6f178a9cd582d4ab6095c590cd3179e1f1d2eb611d7994d03c561f0b095e
SHA512f6046046fbda96606813404b64c708af15be8be7ff21199225f7c30fcd2b1ae1144dc701ff8819c9e5fe86dd9ed0154864edc35a97646c383e4712c98ecadd33
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD50bd74c5487fa5f98e7e221ba034a62f8
SHA16d72fd6567fe9234a6274d18f9f12ebd249e694c
SHA2566a2a5dae890e639f844ba576db71712a84d9dc0749bbed1405e118261d4ab230
SHA512871cb37d4c1e01b4dfb0b60eda09c169064c08a31f9c6fb42db9c1491a89fdf139be887fa38d44d1047502235bac520efed24ab43efdd1cb3b6447b1f23ee30c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5643cd63a8abcd7eab522adb4d02ae609
SHA1942172af5063027de9d7cf192afdb4bda2d525f9
SHA2561986ca783bab9b41c6b6318739e11fb4f3e0dbf96656597c947f7300985b2060
SHA5129622b7aaf84f8dfe272987e0c76ced9ddf9588fd51838e32b71a81129fbc5ce77c1180439887dac3cd37c4964a0fc180f1a0026eb2eb8f31584abb38e65e14f4