Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/02/2024, 18:16

General

  • Target

    https://www.youtube.com/watch?v=8iRnBsCmf7Y

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.youtube.com/watch?v=8iRnBsCmf7Y"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.youtube.com/watch?v=8iRnBsCmf7Y
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.0.780629451\1894038808" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b2e2589-a0cb-4971-beed-96362d39b063} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 1948 28ef0915158 gpu
        3⤵
          PID:1124
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.1.223659668\875403283" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1724f8e1-6145-4500-8cb5-cb6d67dcc7bb} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 2380 28ee2f70458 socket
          3⤵
            PID:3940
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.2.1314693385\265675351" -childID 1 -isForBrowser -prefsHandle 3508 -prefMapHandle 3504 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99023b10-18ea-4263-bf43-31f8d4a062b3} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 3516 28eef761258 tab
            3⤵
              PID:3924
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.3.1370113086\1159073621" -childID 2 -isForBrowser -prefsHandle 3948 -prefMapHandle 3944 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {873ba344-4841-42a9-89b7-0cffa7372527} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 3956 28ee2f6dc58 tab
              3⤵
                PID:832
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.4.1976202535\1032764174" -childID 3 -isForBrowser -prefsHandle 5160 -prefMapHandle 4640 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d88d16f-d72f-4a57-b03d-0f902b9e2dbe} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 5176 28ef6e3fb58 tab
                3⤵
                  PID:2892
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.5.1836399919\1834087058" -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5200 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96aae3d5-5b0a-4547-be2a-5fb56d9256cb} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 5308 28ef6f24858 tab
                  3⤵
                    PID:4608
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.6.1338802521\939223287" -childID 5 -isForBrowser -prefsHandle 5508 -prefMapHandle 5512 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63ad2157-377d-4ca0-aac5-7d8b868f6358} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 5500 28ef6f24e58 tab
                    3⤵
                      PID:3436
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.7.34793573\1001107555" -parentBuildID 20221007134813 -prefsHandle 5812 -prefMapHandle 5808 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e78e6a10-2908-4b2c-9451-e93e316daa81} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 5820 28ef6f27e58 rdd
                      3⤵
                        PID:2532
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.8.1660245729\217089021" -childID 6 -isForBrowser -prefsHandle 6036 -prefMapHandle 6032 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c067df5-bac7-4db0-b81f-ac21b3014571} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 6044 28ef7a26358 tab
                        3⤵
                          PID:2552
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.9.267625012\10778328" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6044 -prefMapHandle 5340 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81ed48ef-3416-45d6-bea5-38fb16d32121} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 5948 28ee2f72858 utility
                          3⤵
                            PID:3368
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4776.10.1479333935\788979670" -childID 7 -isForBrowser -prefsHandle 6560 -prefMapHandle 6540 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b029e4e5-ac91-4f05-a71e-36bd2369feca} 4776 "\\.\pipe\gecko-crash-server-pipe.4776" 6568 28ef77c5958 tab
                            3⤵
                              PID:3152

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                          Filesize

                          442KB

                          MD5

                          85430baed3398695717b0263807cf97c

                          SHA1

                          fffbee923cea216f50fce5d54219a188a5100f41

                          SHA256

                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                          SHA512

                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                          Filesize

                          8.0MB

                          MD5

                          a01c5ecd6108350ae23d2cddf0e77c17

                          SHA1

                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                          SHA256

                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                          SHA512

                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          2KB

                          MD5

                          da4adb37985c92738175d0a3af31c759

                          SHA1

                          b919c70ee215b2f5a6cf64b35adf175f653232f3

                          SHA256

                          50d4f290699d1912ee8b70508d90405b48700ecbfa7d03007d88f22dc6ec329a

                          SHA512

                          a8dd18584d9c8cf70461937711cc9a2cab4cde37ec70ee36070d31754a168f997157709cfa8c33f0ecc6e6453c5e446442152cd32636df118159b9298da9fd72

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\pending_pings\6acf40fa-93e0-4cf2-8c0f-9b605f5fb26e

                          Filesize

                          11KB

                          MD5

                          61069325a703d34410b9063fb5c8e514

                          SHA1

                          c9fdff56d614722e38babe03e0d376804ef951b7

                          SHA256

                          0bf7d5cc076a8d55884ab9495e21d6a9cc3b943670c994705f89850cfa621c4d

                          SHA512

                          df631cd51ea98df41d94f8888bbd2e99020b0386c3ab7dfd346e4037d57d52452d5e0c793d94f888f67189f7eac03c0d8965c6e1001c2d8a8e52c0c6efd222df

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\datareporting\glean\pending_pings\b1c0c225-f33e-4e0b-9477-bcf1dc0d7cba

                          Filesize

                          746B

                          MD5

                          464e2dd34da62189f22b2c7bda30bdef

                          SHA1

                          e57433c6df9f830a706def19500b7d7644fa39a1

                          SHA256

                          1ceadad5fee0c8f79659f2d8d8faf322fe623986471a186b1e22e57dddf9a87e

                          SHA512

                          c8ef63cab9c1ff8d98549924250217c6831f434434983e87e1560225bf073c22157c08387396981070e55095d9559e6c3fe66d7488e780e7dd27f000c8a7a7d7

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                          Filesize

                          997KB

                          MD5

                          fe3355639648c417e8307c6d051e3e37

                          SHA1

                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                          SHA256

                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                          SHA512

                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                          Filesize

                          116B

                          MD5

                          3d33cdc0b3d281e67dd52e14435dd04f

                          SHA1

                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                          SHA256

                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                          SHA512

                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                          Filesize

                          479B

                          MD5

                          49ddb419d96dceb9069018535fb2e2fc

                          SHA1

                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                          SHA256

                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                          SHA512

                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                          Filesize

                          372B

                          MD5

                          8be33af717bb1b67fbd61c3f4b807e9e

                          SHA1

                          7cf17656d174d951957ff36810e874a134dd49e0

                          SHA256

                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                          SHA512

                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                          Filesize

                          11.8MB

                          MD5

                          33bf7b0439480effb9fb212efce87b13

                          SHA1

                          cee50f2745edc6dc291887b6075ca64d716f495a

                          SHA256

                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                          SHA512

                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                          Filesize

                          1KB

                          MD5

                          688bed3676d2104e7f17ae1cd2c59404

                          SHA1

                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                          SHA256

                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                          SHA512

                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                          Filesize

                          1KB

                          MD5

                          937326fead5fd401f6cca9118bd9ade9

                          SHA1

                          4526a57d4ae14ed29b37632c72aef3c408189d91

                          SHA256

                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                          SHA512

                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs-1.js

                          Filesize

                          6KB

                          MD5

                          b92f5aa106447693d5a188b401a5aad2

                          SHA1

                          26972be7bd17ae850e6fc3b56edba214ff93038e

                          SHA256

                          594368d8f6056a7343056bfefe4be7991d288299458b88e55b3706be8c76f88f

                          SHA512

                          411fec2047398d58f23109824f43c291d48556d729b7b746505809bb0bca1ce523decdbadb54fc9af3c204a12ae5af969d8245e9ec3db61d5b2633d93ee382db

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs-1.js

                          Filesize

                          7KB

                          MD5

                          15bc1605abe469e5934010ca90a00560

                          SHA1

                          4d3d1c1737713e3a3411e0dc21b1c6f84a3ca817

                          SHA256

                          d088b40109fbc1d0ecb6b5712e2a4787e10e5b0344c85f3c1c2ca4e86223c47a

                          SHA512

                          5f537303c3d554a034db0f7c5a35e2021ac795df916b41ea4c4dff525beec14716ee47f3b348d6bd3c1aa58a9443e5cd72d3ca8993c90c754314d5ec8cd10eae

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\prefs-1.js

                          Filesize

                          6KB

                          MD5

                          f0ae259fa2474eed6911eaec2433debb

                          SHA1

                          6ad29bb06bbbb7591ef683a3db05fbea17548a50

                          SHA256

                          d4238370a66b79300c4911bb47b005bf9673aec4c4d697806daad8f1b555b94f

                          SHA512

                          529b38ff5612145bfa731a39d7bb1d0e050e32b4beab26cc3a1dc32e11141ff71a8111cb001dfef1dad175ad60b46af851e79dcc8a27ff3b4672be52b4a5abfa

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          2KB

                          MD5

                          d1a3f35b50985bac8ba668ae89b5d85f

                          SHA1

                          bbac19b14f9959a8bec77c92b9965370126e6114

                          SHA256

                          1a4d7cf4dc4e3f99e5878252f4aa2300f0a260f48f503bda069e5f77b2153760

                          SHA512

                          8b2cde6a670f0d3c2dc2c61a64c81b883113d96f9fa7198f39df8046ccd61d40126322314a78be8159d8d2a31b544ac66b79d107ef12652f51fdf86442842e17

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          2KB

                          MD5

                          6dc6ad37794ecde84529280f23fdcc96

                          SHA1

                          abdf819a637adea34b67f1c43afff6c0a6c29f59

                          SHA256

                          c9aea96c75759cfc2e27bd79298422e37f788dbf6de1d8ab332316aec4d02e41

                          SHA512

                          77cf8d90cd856923e2ba954a6b5172a1d67a6938010a76aa3229efc2aa005f136b6a494e20a201fc82c2a93822910d9c7709c1b77ade172a23425418a84615e2

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\default\https+++www.youtube.com\cache\morgue\145\{3fe95482-502c-4119-a810-fd5f78885591}.final

                          Filesize

                          192B

                          MD5

                          2a252393b98be6348c4ba18003cc3471

                          SHA1

                          40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

                          SHA256

                          04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

                          SHA512

                          07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite

                          Filesize

                          48KB

                          MD5

                          fadae8c12230b7236b038530f3d0e68f

                          SHA1

                          d7ea34a112b3f15b7cac51f4df6f6594ca6b87ac

                          SHA256

                          cfcc8d3b5cfb2cc8d37e95b47d0576fe847017dcb33feb35f9cb247cacbe1234

                          SHA512

                          ba359521eb658bd1a11aa850de9d9d6b4139424001ec8bb6a717946c30ff56e4c2b67c6cc1fc55df6b6a086070c8fc001130e9d0634aab8ad7bcf4b1e9c785e7

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mlil8stk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                          Filesize

                          184KB

                          MD5

                          03453e5754db2c433d108d72954d0fb1

                          SHA1

                          f518556c329a8b0437100507745e800c29c588c7

                          SHA256

                          1b89a0aaa36aae19cffb747bb77803b0c923b9021d05cebe3317afe0921f3b86

                          SHA512

                          c590e3527c64aeca468874dc50dc31d3466d95dacf9cdf7f98ac151a622186f2a470d9d62c4499beed98dc1886fd51dca24272b49b1a185dc955e507065df36d