Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2023, 16:13

General

  • Target

    https://iqconnect.lmhostediq.com/iqextranet/iqClickTrk.aspx?&cid=PA16LS&crop=0000.0000.0000.0000&report_id=&redirect=https%3A%2F%2Fmidar.store%2Fbgvobwvnzxrbv%3FembGF4cXVvdGVzQHNjYW5nbC5jb20=

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://iqconnect.lmhostediq.com/iqextranet/iqClickTrk.aspx?&cid=PA16LS&crop=0000.0000.0000.0000&report_id=&redirect=https%3A%2F%2Fmidar.store%2Fbgvobwvnzxrbv%3FembGF4cXVvdGVzQHNjYW5nbC5jb20="
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://iqconnect.lmhostediq.com/iqextranet/iqClickTrk.aspx?&cid=PA16LS&crop=0000.0000.0000.0000&report_id=&redirect=https%3A%2F%2Fmidar.store%2Fbgvobwvnzxrbv%3FembGF4cXVvdGVzQHNjYW5nbC5jb20=
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1784
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.0.776542982\748496684" -parentBuildID 20221007134813 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf069f0a-ddea-4c19-b27a-7cd0422afda5} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 1996 2549b0d9258 gpu
        3⤵
          PID:2612
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.1.46080274\327656687" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e458533f-cade-414a-b24f-3a43dec35d9b} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 2420 2548717b458 socket
          3⤵
            PID:2904
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.2.2122454630\451389641" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 3052 -prefsLen 21792 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e7e493e-5313-4d89-b642-7d32d64a5e24} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 3116 2549eaf6758 tab
            3⤵
              PID:4796
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.3.1550102607\827295503" -childID 2 -isForBrowser -prefsHandle 3772 -prefMapHandle 3768 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8518d21-34ae-4769-823a-3f090e917bf8} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 3780 2548716de58 tab
              3⤵
                PID:4784
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.6.616723985\1307333056" -childID 5 -isForBrowser -prefsHandle 5176 -prefMapHandle 5180 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69d987f5-1e53-466a-8af0-79a183125e89} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5164 254a12c8558 tab
                3⤵
                  PID:4992
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.5.332735691\637489246" -childID 4 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b53aa50-018b-40cb-aed8-a7c81a8e1013} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 4968 254a12ca958 tab
                  3⤵
                    PID:3728
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.4.492127247\2046250597" -childID 3 -isForBrowser -prefsHandle 4832 -prefMapHandle 4664 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ce82b17-ea0a-463a-b12c-dc6be7220515} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 4836 254a1131858 tab
                    3⤵
                      PID:3084
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.7.219723646\906886675" -childID 6 -isForBrowser -prefsHandle 2996 -prefMapHandle 2912 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d822777-ef16-4e90-ad12-b0659393fa7b} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 4832 254a08d2258 tab
                      3⤵
                        PID:228
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.8.1163976267\881678223" -childID 7 -isForBrowser -prefsHandle 5732 -prefMapHandle 5736 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {689a3a8f-569c-4b34-9d08-ab99e267d438} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5724 254a1e16658 tab
                        3⤵
                          PID:1052

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      149KB

                      MD5

                      4e1aea1db4ae14d91685b62acc6028a1

                      SHA1

                      afd9526384c3c7059bac47204f0109c1787edbe6

                      SHA256

                      f439bdcc5a5cea2f9844adc93daa72286e7c4bbdf656aa6bd13b9fba0a83db6d

                      SHA512

                      5fe2a95bc39ab305e630e1f1a23e8da999eac6684c7b4ee39d29c5332b96da2f3a3599cdc024c39de24070ca1ee28cc1c406e43df03e52cdd59263c50cd32284

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\cache2\entries\ED9826654AE8BD972BDE17A9E0A449D3F881E430

                      Filesize

                      14KB

                      MD5

                      314d6ae02beaa1d7ce2156e08119c566

                      SHA1

                      ae3c63218b2c541080831d9eb7efcae9b6ee69b4

                      SHA256

                      4ace743bc5d2d92a69575017fa92cfb99e5cd82d388b264322d283937e179418

                      SHA512

                      c731f2e9d618f026e5dbdc80c880a6b7c96df5bd687d9e7b6871bf77d177b14cd21dd880b5f1fb687e3861a2fdc84ca56f0f8d5aac3706d115e4f348b5bb5e07

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      2218eff9cf5889ef6f77e4ca8604d039

                      SHA1

                      c9abd94fbb78a40bb397928ce92a05f616ac0ec6

                      SHA256

                      b1b3bd1cd5416b188aac08becea9e72ec3c5049e15345d747d99aa6502fe6e0f

                      SHA512

                      a04f03323cb01845215b3dcdab93a7c405de89a8261fcccd46291ec369c3c4a0693bfa8223fa301da01fa0721fc26db3528ef07ccc1f442287d95208bba48f0a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

                      Filesize

                      8KB

                      MD5

                      17551ccab20c41b1ae83f1a0cffc0a2d

                      SHA1

                      d99edd7619fd13a9a2ca57ab1ca289797b162dab

                      SHA256

                      6b863ed6140caf83942297ffcb82013ccc47b1250fcf184be3fa86abb0e4ff59

                      SHA512

                      a96873166eecb7358df1c8214f0f3d5ff281745e860386a6efcaae5f163c45e76c02b84b34489fcc5bfd7c77a0b21f87cbe02e2f743463a36044cf9f44f83e41

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

                      Filesize

                      10KB

                      MD5

                      37926119e03bbbbc479ab139c0dc9457

                      SHA1

                      d169f0e6f39875bc7398d52236d913a654f34e62

                      SHA256

                      69ce9761d434391beecbcd7aa52344b0f6e76ffc2d89e9865d5085bd9f9d6e71

                      SHA512

                      e708ab4b5183ab7f48da6ace94421334ff81da4bc659a4d4728b7c1ceb2304dc1618c7c3baa93183af32cd5671144a95662fd3eb38d5100f996870e9e2d8b09a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      6de979e6784bf9541ece029eadd2b189

                      SHA1

                      3dca12947ad4bf0ddf3dba7a0075f9b64ec8fa41

                      SHA256

                      37e6169669563f85485607e1f5cca3fac6771d2858d545c30691ef81e59760bf

                      SHA512

                      e2bbc818a2ee36bbeb4f6a1a5106c8d7304c36e98382401e1b804cfc769efd82d2038967cae718e2ad3054efd64148c3833dceca255bffd36f5b985352a74d06

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      3KB

                      MD5

                      32070b62825ca2b0f7ef2f744131fd2e

                      SHA1

                      da65d9be1addafb8173e20d4fc7c31303b153698

                      SHA256

                      eceee94660ae0fb001640523c5876b705c2ea6bb091ee3073f88f4617fa37239

                      SHA512

                      e3a0888a55201858a94e2bdbdd22dcd646dbff0f05efac800eb9e3839add778a0d48fadda88da9f0ee55437d277c27aa65cade901b2ed5e3ffc98169963671f2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      3KB

                      MD5

                      28ca4763c013c07a0b616c30e583f287

                      SHA1

                      d082d00bb4a0846d43e55783e4511d9c3cbc7899

                      SHA256

                      ff53ed6c45e11542bd5c50e84d2a43dcaaf80cbdb32da4afca7be73443d6e0c3

                      SHA512

                      f618fd52b1522b198d057daace6045903126ad00a6a77c82e6aa0e8e0fa7f05a6a364596ca25745acefce25cb6d41053a1460e7828f3a227dc5e5bc569d035b8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      3KB

                      MD5

                      f1571512ed3d0fff21efc04ac7919a50

                      SHA1

                      b82f95d9ad73aecd06df363daa073f9880510598

                      SHA256

                      aa861bcd14b9b806983554f9e6254e794f8d970afbaa04cf7cf43c5e6c6fd938

                      SHA512

                      f6c2c3c192d8c741a5eda63dc69bb83f382b9a82e04ac167046eacf12d472b2f29c0f72991165830f3eabaadbb6874f71e93833108da58df895cc9911ae510e7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rzyhfx4n.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      1.3MB

                      MD5

                      966ad6ab56c330cdec68c02ff1a80604

                      SHA1

                      6bab06255db6e94e8f67b344a1581f7cccf0a3ab

                      SHA256

                      4510a8f5ad1407c7a3b125797dc331818b2e2142b7aff7531ce5a8a44ca962ac

                      SHA512

                      85c46b1e3e2fcb4d4f5aa781903cba60fab488f910d41bb901ea9c57a58c515168dcbcc2b957e7b402054496a70aa26faf8e61274d5593ccd29fe7b9eb8244e8