Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    290s
  • max time network
    317s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 05:17

General

  • Target

    https://partnerpulse-form.inxeption.com/score-request?utm_source=email&utm_medium=targeted&utm_campaign=meet-partnerpulse-allcrm&utm_term=partner-pulse&[email protected]

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://partnerpulse-form.inxeption.com/score-request?utm_source=email&utm_medium=targeted&utm_campaign=meet-partnerpulse-allcrm&utm_term=partner-pulse&[email protected]"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://partnerpulse-form.inxeption.com/score-request?utm_source=email&utm_medium=targeted&utm_campaign=meet-partnerpulse-allcrm&utm_term=partner-pulse&[email protected]
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:336
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.0.1177285903\846349472" -parentBuildID 20221007134813 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e0a4b31-cd7f-4d7c-905a-888438a4eba5} 336 "\\.\pipe\gecko-crash-server-pipe.336" 2008 217f5804a58 gpu
        3⤵
          PID:4492
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.1.1330188142\805716626" -parentBuildID 20221007134813 -prefsHandle 2420 -prefMapHandle 2408 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87895a7f-f40d-478c-a826-e7bfdfdc3876} 336 "\\.\pipe\gecko-crash-server-pipe.336" 2432 217f45e6258 socket
          3⤵
            PID:3484
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.2.440134909\197512293" -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 3168 -prefsLen 21792 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c11e005-fb85-419c-b575-ada161e3f656} 336 "\\.\pipe\gecko-crash-server-pipe.336" 3184 217f88b5a58 tab
            3⤵
              PID:3380
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.3.101687210\998582781" -childID 2 -isForBrowser -prefsHandle 3864 -prefMapHandle 3860 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c95f07-cb82-458e-9b28-42402336418f} 336 "\\.\pipe\gecko-crash-server-pipe.336" 3876 217f73f2258 tab
              3⤵
                PID:1960
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.4.296691184\1102885947" -childID 3 -isForBrowser -prefsHandle 4576 -prefMapHandle 4640 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71d17d21-7e45-4223-9e6e-70cd53a1e916} 336 "\\.\pipe\gecko-crash-server-pipe.336" 4636 217fa568858 tab
                3⤵
                  PID:2976
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.6.1787855237\1273691221" -childID 5 -isForBrowser -prefsHandle 4520 -prefMapHandle 4516 -prefsLen 26842 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7025551-cb11-4afd-8f19-dad2114dda3a} 336 "\\.\pipe\gecko-crash-server-pipe.336" 1692 217fa987c58 tab
                  3⤵
                    PID:1316
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="336.5.668315975\163626287" -childID 4 -isForBrowser -prefsHandle 4536 -prefMapHandle 3820 -prefsLen 26842 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baee7784-cd73-45d4-8a25-c5bfa087578c} 336 "\\.\pipe\gecko-crash-server-pipe.336" 3832 217fa568258 tab
                    3⤵
                      PID:3856

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uzw33i5d.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  22KB

                  MD5

                  f875939ea20871c5b2ca55f5616ae627

                  SHA1

                  643572e9d755d7cfb98ca0a90fc256e25a4826fc

                  SHA256

                  1711755e5174ec2c8eea79020a894ff7b7a6c04aec9adf7223142ad0142aad39

                  SHA512

                  7c4e1f6436f6864f26e4ce24ae627fc3e9b1166c82eae32f58f508bce0c3b05663415dcc784fc4eeae687e88e6eb95f51c34a17ceb2c6945df19a383ed23f630

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uzw33i5d.default-release\cache2\entries\180089313729568CF6D0CAF9991F0FA4115478F0

                  Filesize

                  13KB

                  MD5

                  156e6e7b41ac4cc48056934a3b24cc42

                  SHA1

                  47c70c07731d8c3b0e6cde92d9f74264913efd60

                  SHA256

                  192319a2ed3072e0b2060259828500317221a2c6651b1afd7a71525aca678644

                  SHA512

                  9520a35275b39f0adbd4e993fbd3438e491141576910294cd6c3b0ad548de81f6571b481d9484b32a1701646216f5e89fe82d9cbd00d51749495cd4e375a1536

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uzw33i5d.default-release\cache2\entries\7FEF50EB1C89E58D7202896295BED2C7C56D1C99

                  Filesize

                  443KB

                  MD5

                  0fbba3943dabbf48d5a4c762381b0da2

                  SHA1

                  0c69a2f55b9370cdf22e4de1c3ae8995f4346d92

                  SHA256

                  728a1577689270b779deabda722618716e123c836e7b3072e37d18815f7cf4c5

                  SHA512

                  90cd2ff0414b2301a8a60fe2b63cc6e9c02a39735c7ab7250cd0e2d9d74e91951a2d16b76594692bf0511e197fd48e5b2762a9fd74d92fc278e640e297212421

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  8.0MB

                  MD5

                  a01c5ecd6108350ae23d2cddf0e77c17

                  SHA1

                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                  SHA256

                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                  SHA512

                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  2938bcab55df241aa9b99c5cd57f8a2b

                  SHA1

                  669bec5031d4bed215f33f1975f3d4f117c3ac8b

                  SHA256

                  2d4ccf454669db115cb005a92104d4ed705a8d4a1028442f92937c45761567f7

                  SHA512

                  c66dda78af9e9747b30bdedda347aefdaae61403f8daf52c1acad58110c0fba68aba4f607f8f7fcb9550dffd8835cb2291ed08fe1d747d3579f96e4a494c2e90

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                  Filesize

                  372B

                  MD5

                  8be33af717bb1b67fbd61c3f4b807e9e

                  SHA1

                  7cf17656d174d951957ff36810e874a134dd49e0

                  SHA256

                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                  SHA512

                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                  Filesize

                  11.8MB

                  MD5

                  33bf7b0439480effb9fb212efce87b13

                  SHA1

                  cee50f2745edc6dc291887b6075ca64d716f495a

                  SHA256

                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                  SHA512

                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                  Filesize

                  1KB

                  MD5

                  937326fead5fd401f6cca9118bd9ade9

                  SHA1

                  4526a57d4ae14ed29b37632c72aef3c408189d91

                  SHA256

                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                  SHA512

                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  ff8bdc767575c7267e36c5466fdbc7bc

                  SHA1

                  91ed67cc4cec7b9ee27ea4ae13b52b1eb638539f

                  SHA256

                  e5053df406170fefb253160e1179c076e749b0ff45a36d0e01719fd34d6cf628

                  SHA512

                  20eb15752a9244e3c43600bdf218e51352e94e0007bd5d64cd41d2a070da52710d2431a98751d1cfac3a5f7cd1038672bddd0db957295ec56647b07c02aa94e8

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\prefs-1.js

                  Filesize

                  6KB

                  MD5

                  94b9261ce71f67da61f7532244928189

                  SHA1

                  2f2b7769c2e4f31c9dba3cc88431e898aca2faf2

                  SHA256

                  9426ce606ef813444025b49bdd9235172a05805a64ce4aad8957199d0f198723

                  SHA512

                  f1a7a4e39543a46c12acc899ef37407b97ed90c362334bedbd20b7efa57508cf98d46b3a566ac084ebef26a39b6633c0c5814f4357deefaf395ab666739c0458

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  5KB

                  MD5

                  6c1b8f8d1d4cb48cd15896b2bcf85ba5

                  SHA1

                  9a62b0eedbdf08ba732c3ee0ac690ba2564745df

                  SHA256

                  b551a3d9fe9d3f2ea2ff2efd2fdf526ea6bf3cb8ce93ca3e943524dc8a9f3c30

                  SHA512

                  cde891703b6c12ff918f99b436d1b0c394e2622eca6840f5df7bbafc8408fc25a4237d0a20749ed38f386f46f3667d5471f7dc78548710b3fb412f5b3af74a77

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  1KB

                  MD5

                  882bb5cccd05ae51a9e3157b9b2edf18

                  SHA1

                  936373b9f321562b711aa3bff257b59e161419d5

                  SHA256

                  f729619def600ede2c08d482dc20201387d5fe867efcdc53e1cbded098ebc10e

                  SHA512

                  f145848a6a7c92f06551fe1ea8ac1c01acd4677d86f684c48e1f85446413aa1b13c7ea9493d66a9a615dcf4a4f207767dc91c4c3adb683698bd206eaed9ed644

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uzw33i5d.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  5KB

                  MD5

                  5946859d1775429abd884169fd247abd

                  SHA1

                  171d3f40539ec6f63a81b8338ba9fe9514680f67

                  SHA256

                  7a0edc595f9ec728399e6924a1973be5e4a3c64a2517cf21e0ed8c03744c0a73

                  SHA512

                  64e0ae120abe43d4bf2e253d218572661f4879b61fe88c65bc22ffab9d728c78a0e27a9dc6a2dda0b1bda4bae6eaae16440c3d42776a11f709129f5eec49b9be