Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 08:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://seeton.pro
Resource
win10v2004-20231020-en
General
-
Target
https://seeton.pro
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1716 firefox.exe Token: SeDebugPrivilege 1716 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1716 firefox.exe 1716 firefox.exe 1716 firefox.exe 1716 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1716 firefox.exe 1716 firefox.exe 1716 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1716 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 1716 wrote to memory of 4008 1716 firefox.exe 85 PID 1716 wrote to memory of 4008 1716 firefox.exe 85 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 2128 1716 firefox.exe 87 PID 1716 wrote to memory of 2128 1716 firefox.exe 87 PID 1716 wrote to memory of 2128 1716 firefox.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://seeton.pro"1⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://seeton.pro2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.0.1450879800\1619318284" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1864 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca8e223-20cd-444c-a5c1-fa11f15852f6} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 1964 142d8eed558 gpu3⤵PID:4008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.1.932754648\1847764872" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a787987-d3c6-4ef2-9c40-767e1c8b11d3} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 2392 142d8e04758 socket3⤵PID:1236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.2.1549488998\726530116" -childID 1 -isForBrowser -prefsHandle 3628 -prefMapHandle 3568 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6386f12a-2a18-44ec-bff6-d3ed43044404} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 3460 142dcdd7958 tab3⤵PID:2128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.3.857900936\1848648611" -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 4000 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2d49003-e1f1-4d05-b731-74d8ad8348bd} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 3020 142cc661f58 tab3⤵PID:4416
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.6.1051900081\1430020938" -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce4462b6-a2e4-42b7-8b95-18a92523399d} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 5136 142df314158 tab3⤵PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.5.1002036316\769299040" -childID 4 -isForBrowser -prefsHandle 4960 -prefMapHandle 4964 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1dfea3f-ed71-4178-9870-0d227d0a9df6} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 4948 142df015f58 tab3⤵PID:540
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.4.145234117\1455718600" -childID 3 -isForBrowser -prefsHandle 4852 -prefMapHandle 4808 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c417ecd2-40c3-436e-a1a2-19cea897d708} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 4864 142df015658 tab3⤵PID:3688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\activity-stream.discovery_stream.json.tmp
Filesize22KB
MD5363724b95379367a0489117ed92cfe0c
SHA11d530bd24e76f9d49434011c72f77081c0e33a94
SHA2564b57cd94bfe0f4d76f23e353b3ba7af8cdb6f0d6153da3668edb37ae20ae4540
SHA512bde3cc9db9b4654730d3e5a759dd8391904abe624d3215e71c6cfe8a7955d6d1b59033763b4aaacc2cee634610a6d80284f33967109ca416a42db31a9a442795
-
Filesize
82KB
MD5e15756d4a373df1b0ec68eff96cf15f8
SHA19cbb1acca508da6c0a831e1ee6094d46f6663f06
SHA256efed91dad6432ca140b66a3841843136b66092dfe9ce1efdd48f42fe33037545
SHA512cfd0c24de6324416fd2d790a57fdd481196709cadaebac96a94401f40f2136e6cd72892bc953edcd9c5bfc1f72499bd1181316359032e59ae81713f0e4d8a628
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\02DE2C16B8997D5835CE8476C15398006968D7AA
Filesize172KB
MD503a2868d9b577607834f8b6524056504
SHA109b5b9a53e7ff22836a0ad60535cf20c23ea4224
SHA2566c972a5a502955ef28d19a6e1dd60f06a9e58d52e0a871e00fe0493031e4c671
SHA512dc4c56783ff9ab2a73f309ea904e4d9eb036fd0a88d2f68f34c2db8d9119cf159fb86ead643bc3ba803aadd75768ca8d44fe393a9b213e76cacdcca67f49c195
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\1C47A2F1ADBC9C791F9D3618190802C31FC5D471
Filesize18KB
MD513dd89129acfef2224fb879e43d32505
SHA1e41915b14b9c28b6734a6ca2826a37ff2bbd39be
SHA256facf7821a6e528b8549a4ec9fb1364e4e5c76722310f5faa2ef427a2a9688255
SHA5124728faf4a8f932948e3737ae8804fa7ea2abafc1b4fdaa1d083cee4479e9cfc0e2e1b3b4ffc58eed5a0cf941f3a81f9fefa4814e92434be499bbcc2653b22e97
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\358841DBC836F9C271FAADFC09A273C54E486C4A
Filesize129KB
MD52a03ab2694afa828613c345ce8cd3094
SHA1cbeb028f76b9dce1f901c1ae0d3ce760cd839a22
SHA256f2b287708e62cb08097a3c8ff922ae661bb593915bcd2b91a4ef04123d499fc7
SHA51219118b20496340cb4e875156fdbd88dce7c26b2a9b1943d99ba85a15752e1e2a6756a3f7e634a6d6ce704d64c777136b0d5878f9a8ead0a9e21fd41866ecb9a0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\39B9D7E92958B31E0FD3FCC4EB0DCCAF7FE12E8E
Filesize170KB
MD51a03cb0c2a6b0b01653561e9ef29b77e
SHA116dcfebb28c809942524aa6e9b69daddc1b41bd9
SHA256accb4d2c0d7d4df1905ade243f01967ee90daf531e91b9ef3e7f8c8d2b1621b2
SHA5121dd0cb9e42d35cad04b75c0d0997dcb7688b73326f90d351e8e70d7b7ce9b5bd60f5ddc12f7726b5fad7f5eaf6cea8098a6deb7c5cec2450da1b1890e292d7f9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\440DD7F82158DB8A069A7A2E3DB43BE9EEF23120
Filesize38KB
MD50fdf923d30b7df8d564138fc27cf598d
SHA17dd039f3ea6a903ac038360d44fb88cd8ad8bbed
SHA2568018f0bb4c2e14d5aa4d3846ed9368a6a31e5ff8b30bb872a1e00a51901c503d
SHA5127c904a05c89cc007c3232843846d185838ff6eef983bf61690cc34ad381b4718fda98a1771ac5613dc7734d08dc44771262f10bf55533ee24fbb9cb0dc864465
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\A8FD31D8F4420375895B4FAC44123C510CE2F9C0
Filesize169KB
MD5fcdb4a4f687f4abd50ba4b249005eff1
SHA1b388afd459ff1e0414dadb69dd5fb35c4f4c9942
SHA25641e78912666eae61e0d7576bef495cf78bb590e85a575afc2e7c802e53a574df
SHA512ba31aeabd21acc453ddb8974cd4bfc7f03213e353a1229bb729aba3389f1de2cf8f95f261263a43f1c3d57971e9ef2cc7069ef6788ed8f8aee48d97fb7a93ab9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\BDB35F67C49502E852D8AC866B0983F623E1C130
Filesize171KB
MD5d6a7ac37e748fa9f47e1de01d159e702
SHA10ac7884a9d3c229a7aa2b948fe73c0347f174c3f
SHA2562e24f5bbf322c34e9fa36ba80b3ea86a2bcdb68cc060ed9f505d8e038ee5760b
SHA51291e64aa29655dd012a213c80bee3423d87c56f9108a6cd6d5f3f18338e63ec065a252d7a6137641f846ba9a6fc376d47d4b75aaf8ee92a70c7cc7d1075ee75c1
-
Filesize
6KB
MD59dbbbb74aa376da92c30a5e0fe21f7f7
SHA12a5f243884f168359593d17c1e63d5e96390e219
SHA256b97218ac7ce06bd79645039075bfa57a94c5339f21d3c803e80bfdd2d9513313
SHA51241f0871c9bbf54f9cc2f37c4afd16189142964220e75613dc28646cb84ad37f39a7f8bf3ced9066054a0f328a0f1994c70ad3177ea0f06757ddb2ecc98815659
-
Filesize
6KB
MD54797422ebe8b9ab12d538f489638bea0
SHA13805c7cb050b03191c0369d5d4d783a5f0f02f3a
SHA2563bc1dcfdbfc5af9090e53882370856472f94fa3b15be00c73975d87b854b4683
SHA512d4a5f984877664d2d4441f8ee8d99be129d19c6fcc3a8ed2c785b0e614929ae4b5a90353ac934fdefae61f7fbb0f57a0d48b1b92e8f3228770f4bf140e904e83
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3tq1igo7.default-release\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5961108c50bf4b2426e80a9bee726a288
SHA1d959a68c8e83c5d691d983bd0c62150bd9d7e08d
SHA2569c8f31253747dd65a6b4589d1a20baee49dfd6410649d027e2cfbe4b2bb261d6
SHA5123e5bf8c540e1467db86326465b6bd915808ea38b05c049dab79d67429557367635fbf26ce3c56069f77be99980b891aca9319e7ecb31483dc10aa3e4e4292366
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3tq1igo7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize176KB
MD5ec368fcc528eafb8e2af023c57c4a326
SHA153e8e48a6c2bd4d534106c032e6ca6aad37f3a5f
SHA256ce7097683cf04296938c4818347dffde6aca3b0c14954faee6fd49b58fc9735e
SHA512d6c58683057b63c436711ef703c9a67b9871bef2237cf5840e5bffac031f29c14de4c0fdd48b259b5f6cec2a18c0ac45f07847c2946f9b421e594771a15d533e