Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2023, 08:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://folders.earlybird.rocks/
Resource
win10v2004-20230220-en
General
-
Target
https://folders.earlybird.rocks/
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4732 firefox.exe Token: SeDebugPrivilege 4732 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4732 firefox.exe 4732 firefox.exe 4732 firefox.exe 4732 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4732 firefox.exe 4732 firefox.exe 4732 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4732 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 3120 wrote to memory of 4732 3120 firefox.exe 86 PID 4732 wrote to memory of 4924 4732 firefox.exe 87 PID 4732 wrote to memory of 4924 4732 firefox.exe 87 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 2112 4732 firefox.exe 88 PID 4732 wrote to memory of 3632 4732 firefox.exe 89 PID 4732 wrote to memory of 3632 4732 firefox.exe 89 PID 4732 wrote to memory of 3632 4732 firefox.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://folders.earlybird.rocks/1⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://folders.earlybird.rocks/2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.0.1869305204\1307506017" -parentBuildID 20221007134813 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52fe007c-0970-4333-82a3-c6cd1cf4f48f} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 1924 20d18f18558 gpu3⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.1.1640666816\534781423" -parentBuildID 20221007134813 -prefsHandle 2452 -prefMapHandle 2448 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67200049-856b-4ec0-837e-c803c2b719b0} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 2464 20d0af6f858 socket3⤵PID:2112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.2.413860988\1659727659" -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3192 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bf413c2-d04d-4f62-9878-86537c15aeed} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 3104 20d1be1d758 tab3⤵PID:3632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.3.62270368\491671949" -childID 2 -isForBrowser -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4eb5103d-ca01-4c61-b3fb-028431374881} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 4116 20d0af62858 tab3⤵PID:2448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.6.100294975\928068528" -childID 5 -isForBrowser -prefsHandle 5276 -prefMapHandle 5272 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3bc6f5a-dec3-4a6f-88b8-5be70f3456d2} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5188 20d1e9f4f58 tab3⤵PID:3536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.5.1530152237\1052731018" -childID 4 -isForBrowser -prefsHandle 5004 -prefMapHandle 5008 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09f2a0be-09ad-48db-bc3b-dfab48dec091} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 4868 20d1e9f2558 tab3⤵PID:2632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.4.1428895362\1728964820" -childID 3 -isForBrowser -prefsHandle 4836 -prefMapHandle 4620 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc724f1e-438c-4075-b4e1-2087d20960d7} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 4848 20d1e927258 tab3⤵PID:2136
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.7.2050764368\523536184" -childID 6 -isForBrowser -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e402cebf-f668-4ffa-87e3-6e7f6f47b701} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 2220 20d0af68758 tab3⤵PID:544
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp
Filesize151KB
MD5701bc033bf9b2bc077ebdc2e75a81ffa
SHA1b89ed446ed01faa282f2e4b86088ae216c19fe3e
SHA256d2abbe0a05f2fd0939697c43c06362b1ce1790d701fa435eb8d8c533e6b36ac3
SHA51245ee11e3be149a6fb40bfef949e19e237ba61192398aa8775a21d7ce0ae4406fb0522303edfcd1d78d2c46f660257b0b89dc150f4ee78d548c37f967d9baff0e
-
Filesize
6KB
MD5dad265da399242e1def07cb3981534e4
SHA10d48a4321706c3c3dcc59ff2f895d36357624d27
SHA256e04bdae7d6204622c9511bd234d6d9a3bd2ffec6c9b86855b30407b45941e365
SHA5126d311989f7e97a8abe2d2c00f971b879dd332e26fb62840542e8e0b8dee56e6db12263824641a479da028df2507d6914c50cc653c9b674888b956d4cbd024c1d
-
Filesize
7KB
MD51cf0d5a5a91a719966024557e381f571
SHA1eccb4c0f7af1e7b7ee3df24f6e7c60cf1e8d3277
SHA2568ef54442b9c8aaaf8535e2dbe054dfac17ddde2f2711acb1bafef1399634bca7
SHA512d77e2dfff6813be11b668dfcb77059518ef6c6fe27a9aedb9f49bdffebe7fb1fba4047bdadaa61a10b63a600c11b5c9cee63458f7b937a75b5327e57dadc5148
-
Filesize
6KB
MD58daaaa69a5f81f5ccd447c32cab96ac5
SHA18a4d97bf860da2e67dc00d1d5f5a4393bf401caf
SHA25690aa55b370192de3070a3143815a7eb9b445fea6a3610f8f4ecf2f794f067737
SHA512ed3e8d24c7646210c78392bfcdd3897e5361dd6692362781455ff105707eff32ba28f6682dcafd49a7ca3ea4aa368e0569c0db89621ef08fc968e9d335aa16e2
-
Filesize
6KB
MD5108b97b1ff7efbdb1aecce96d55ff2e5
SHA1bb72b2e0c3d859fe5e821632307a32df331b55e1
SHA256c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e
SHA512e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5a1674273fa258fea4ed47235b8a51abb
SHA11974377118e38af2c799cb676d4b132ab1499512
SHA256831773fa4716bb860dad073b05f9cf78bc6109964af2302d87590a8cf2411112
SHA5120f032a1bc15cd92f3ecef7c1dffedd8970e6ca0da29e49d56c956238dd7de2951a9cb57f3fde188e424b0aad027adc6557e0d8d2a42bc83a5d1bb700430c53b5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD53a83fdaba03b33051fcdfb0e1a114f00
SHA171fa87eec55c0f2e71424c19c94768f33630e1b8
SHA2566a3c40569b0b379b4c80b6c6700170606e636ff657220c561c5131cd65080aa2
SHA51241288bbc00ce45555d0165095d755b7c926967a6dc000a06665a97598d8513c70726267f13abce253a379eab5d8ffec51c2b41f6a66be7b8b7ab0a8f251c3049