Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 07:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/AstraaDev/Discord-Token-Grabber
Resource
win10v2004-20231222-en
General
-
Target
https://github.com/AstraaDev/Discord-Token-Grabber
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
flow ioc 46 camo.githubusercontent.com 50 camo.githubusercontent.com 52 camo.githubusercontent.com 53 camo.githubusercontent.com 54 camo.githubusercontent.com 48 camo.githubusercontent.com 49 camo.githubusercontent.com 51 camo.githubusercontent.com 58 camo.githubusercontent.com -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4040 firefox.exe Token: SeDebugPrivilege 4040 firefox.exe Token: SeDebugPrivilege 4040 firefox.exe Token: SeDebugPrivilege 4040 firefox.exe Token: SeDebugPrivilege 4040 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4040 firefox.exe 4040 firefox.exe 4040 firefox.exe 4040 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4040 firefox.exe 4040 firefox.exe 4040 firefox.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4040 firefox.exe 4040 firefox.exe 4040 firefox.exe 4040 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4996 wrote to memory of 4040 4996 firefox.exe 49 PID 4040 wrote to memory of 2144 4040 firefox.exe 86 PID 4040 wrote to memory of 2144 4040 firefox.exe 86 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 3068 4040 firefox.exe 87 PID 4040 wrote to memory of 4572 4040 firefox.exe 88 PID 4040 wrote to memory of 4572 4040 firefox.exe 88 PID 4040 wrote to memory of 4572 4040 firefox.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/AstraaDev/Discord-Token-Grabber"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/AstraaDev/Discord-Token-Grabber2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.0.1452434920\1168172742" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b62a124-4fb3-4566-9859-95cde90377dc} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 1980 2ac90fd7558 gpu3⤵PID:2144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.1.1868144878\679733781" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 2180 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a5d428a-2ce9-47a2-b096-5e2b53c17811} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 2416 2ac90efa558 socket3⤵PID:3068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.2.947909888\1530596155" -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 3112 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97d2b5d4-b939-4a32-8937-5d9781410ee8} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 3128 2ac951dba58 tab3⤵PID:4572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.3.1605388428\980440954" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6cd7a75-3fc0-4f20-9153-14aeed9cd4a8} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 3620 2ac960da258 tab3⤵PID:4152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.6.97001774\322781094" -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f9fdc51-c5d6-43df-9692-117519621d2b} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 5320 2ac97d17558 tab3⤵PID:4232
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.5.569791165\2021746584" -childID 4 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c00291c4-3abd-4b88-a006-07212f22b29a} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 5136 2ac97d16358 tab3⤵PID:4620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4040.4.365143937\1167773032" -childID 3 -isForBrowser -prefsHandle 4948 -prefMapHandle 4920 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {396d7171-39aa-444e-8d92-8d92389c59d2} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" 4960 2ac97d15d58 tab3⤵PID:2712
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD542d6829fecaac17e48e40d37fedb3f62
SHA1d13145d46e83c955090f1c51a6a99e39308a8062
SHA256402235970bdf7b6c67bead1e230d85c6b0063c6116d3725287a070df086cd502
SHA512c12a5777936973c5930b0da141fad86c36483934f993fb0af5063f2dfc486dd4845cc58994a5bee973c2f21949fbf76446d47322ac915774ac0bcf80b1f3c0e4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\277cae5e-13cb-4d59-80f8-7ee8d09ff472
Filesize10KB
MD5f20cd061be34fea72b0f4dfdd87c337b
SHA137d0b86db1c22378556b527f468213f664c3ab3c
SHA2564fc91116ce6f600fb4af8c48a027f9f8c22f6e68b5e34127d1f98776d3e4dc12
SHA5123ae2f18af647d79f014fccc4c0b39514010d5e3464b1fbf1c7f1717591c9c31875f9d43cf47f1689b35f59dc1ecfec3c3445640ec8eba69c582cac6edd155768
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\33ee7676-acee-48ba-bd10-c2134c5ee1bb
Filesize746B
MD50af4c9a89310b969da5ebae4c872984a
SHA1a1bdb744046cef15841465b55b84f7f8c0fcfd3f
SHA256cb341620639131fea2c3b0cb8cba27cb8ad3ff068148cf2688893ff40f4ef7b8
SHA512848239a87b09c6457d7dbda3d9d7660efcfdadad86ac47dabf5e06d4c5f402e62a5686e16651a60e0d7e2e5e1ca6e658a07e8ab59a2c489a9b512e680bcc5ad5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD59d545a69df73be6fb07387fde232674e
SHA10e0ea0ea7ccaaa425212b85a7c5f1672e351f9bf
SHA2564fc9f7759a378dc395c33f799601715fa3aec1801c3c963a2b405e2ebbc870a6
SHA512278ac9c58080077798223f486e71575245dd25e0ed9d9e1a6b97a45b6998f638952c1416335d8bc93690169e92b4c09769c41be3ff8924cce7ebb05297d3a20f
-
Filesize
7KB
MD5d278c9358c81291b363c20030a0082eb
SHA1ab62cf39caaee94932bc852a494d4ceaffd400cc
SHA2560b849f85f1f9435a7a2e5347882e7cebb07c70a2092e54bfce72b352376017b1
SHA5121408b0794d71924abb337db4aaec905a0ab06ac45b627c44cf57dfba4c6335c29ac0e97110345f0ef44b73d29b078fff0585487af64514efd872340bca70276a
-
Filesize
6KB
MD5313dd5f3a25a152d04ba73d2c7d5a1f7
SHA12a55022bc2994b3859ff4076352b80fbd8a5943f
SHA2569a7ea2bffe6f893d483917be642a1d43d8d578cfa6de777cdbf43fefe71f0db0
SHA512b070c4d5096e7c93068b17906732886af007c2fb287e5e32c4d0a04d7d614b72fbaa01b0c9caf97fc37c55290f839dee41575b0b12273260b29a0ae3aee61ce2
-
Filesize
6KB
MD56d403642b5bab397acd373c2bc2e5c66
SHA16f5cbe7d04bbac5a1067d48e23099f7f6b15ee78
SHA256cdf26abbc0254eab8264b376d99adc5999b9009dc0d70927e2703ae59429c3d5
SHA512429821ead332d28240b83f31092a8f712709b95e0964a647038db1ef608995e84e8ae9d18c1378c34f2d85af3524fc6d3ccfe3f47412646a44909de2e2cc3662
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD581877702bff63a6f926f0ce41b5944c1
SHA1f41ebd700572b0d72f9b454f1a4b10afa97b0b11
SHA2560b89c37ed8ee7fd1562306b52fe474db9546e3849661c0a0a495f620a450bdf6
SHA5120993796ca36e6b9ee3a83ea6286fea991e3ab60bedf5200d28d6150b1514d0c6a706d29698d2683d76198d09a9d93a405b804cf7e1f0e8da7b4a7eabe015d215
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD51e551f77e9ba8e4e72070809d81a6ef7
SHA102a60a5f8c406cc1083629b267239e7a5e955d46
SHA25648c4e44407894516c4d7264e4ff9fca0d500dc7479d24e9fdd39794931f719f0
SHA5125143b0228e927de946a58b7b39b42df89d64c0b9fe5d7b640b3944674fb52e2045c91fe6a42f8083f5f011c28ead0e3ba9f49d1da8165afe611b4f3e01d8e354