Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
Untitled attachment 00022.eml
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Untitled attachment 00022.eml
Resource
win10v2004-20240226-en
General
-
Target
Untitled attachment 00022.eml
-
Size
8KB
-
MD5
9a7d40a2e24919697a51e712cb902b52
-
SHA1
5522bce74c8b383f72c982dd5ce35aca618ec19d
-
SHA256
2b57bdc14e2d4211ee67f756c6fad5b58f96997568780f9c2bfedcd16271a0e7
-
SHA512
b1747dc7870b8842e52938df370717c0ebed55401d6a94f5594aa78d6b65801a733855126b97c495319c140fdd824fcf80d99a5ff82e8e79818b0fe49269ba6f
-
SSDEEP
192:EzTftPyLiqQZSDWFJ5BTXmniG3DIuoCdqitVXUr8ui3:E9qLvQADwJ5tXjGzInCdqi3XU4D
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d6fb51396ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31091257" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1371426916" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7D07C162-D62C-11EE-B3C6-5A176B010E55} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1365854117" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068224481a8b3d349b57460395a3447ba000000000200000000001066000000010000200000001c8f2c89634c6d282122e98acaa706b195d4b70c7d71de6c8c60accb488a3b7b000000000e80000000020000200000005822b0d3d7c1a02429af2f8106a729a93daf05b6444bc489e7918aeb5896120a2000000066389d8e81f57b2d956c3eb4087aaf0f14b616956daa9e3e307ef75b51b9f23e400000003f0e71ec8d51a90e652ea78a2cf3fac639ff28ce8b2daed4c1deb5097ed03975f34cb2cf631e7d308085d4924c8f3f856ee922b43270d88447529af9f05371d5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068224481a8b3d349b57460395a3447ba000000000200000000001066000000010000200000002a5504ef6f6607e21902e6aef98b03942b72dcc431fc08d8d5451aa28bb5e14e000000000e800000000200002000000040a9e434d4905e1b73ab5c435d4decb5e3ccda587e4e393aa20dea7245a70ff5200000008f7c0801574447c2603266f83c066366c26ef730c766d626d228d138926590c340000000e8fe9c9fc617cda2b7d6b9e2d8fa22d1ba84d2c3dd67655649ff94eeebedc1fd23252027c3c41261836256c02ea8a5df5444b5157af79b0bb5b04fa690c9f173 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31091257" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31091257" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1365854117" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415884680" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90770352396ada01 iexplore.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\Untitled attachment 00022.eml:OECustomProperty cmd.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2824 firefox.exe Token: SeDebugPrivilege 2824 firefox.exe Token: SeDebugPrivilege 2824 firefox.exe Token: SeDebugPrivilege 2824 firefox.exe Token: SeDebugPrivilege 2824 firefox.exe Token: SeDebugPrivilege 2824 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2824 firefox.exe 2824 firefox.exe 2824 firefox.exe 2824 firefox.exe 4956 iexplore.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2824 firefox.exe 2824 firefox.exe 2824 firefox.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 4864 OpenWith.exe 4864 OpenWith.exe 4864 OpenWith.exe 4864 OpenWith.exe 4864 OpenWith.exe 2824 firefox.exe 2824 firefox.exe 2824 firefox.exe 2824 firefox.exe 3600 OpenWith.exe 3600 OpenWith.exe 3600 OpenWith.exe 3600 OpenWith.exe 3600 OpenWith.exe 3600 OpenWith.exe 3600 OpenWith.exe 4956 iexplore.exe 4956 iexplore.exe 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1140 4864 OpenWith.exe 96 PID 4864 wrote to memory of 1140 4864 OpenWith.exe 96 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 1140 wrote to memory of 2824 1140 firefox.exe 98 PID 2824 wrote to memory of 3180 2824 firefox.exe 99 PID 2824 wrote to memory of 3180 2824 firefox.exe 99 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 3140 2824 firefox.exe 100 PID 2824 wrote to memory of 4556 2824 firefox.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Untitled attachment 00022.eml"1⤵
- Modifies registry class
- NTFS ADS
PID:312
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Untitled attachment 00022.eml"2⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Untitled attachment 00022.eml"3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.0.1259623009\1734827986" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {243824a1-daf6-43e5-b537-50e8c616ee09} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 1980 2a053dcce58 gpu4⤵PID:3180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.1.515102435\82647127" -parentBuildID 20221007134813 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce9c727b-2496-4629-bf4d-4b1d3eb0a0d4} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 2400 2a04006fe58 socket4⤵PID:3140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.2.1156916507\1792059546" -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3228 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89708dc8-4906-4546-b3b4-1939b4361ec4} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 3092 2a057bf2758 tab4⤵PID:4556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.3.437758409\662483322" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16e14653-b968-4540-a5e5-bd80e395da9c} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 3584 2a056697458 tab4⤵PID:4912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.4.2096534686\1474511120" -childID 3 -isForBrowser -prefsHandle 5140 -prefMapHandle 5116 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f166892-58d8-48f0-92a0-3f278f20a514} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 5144 2a0583bdf58 tab4⤵PID:4432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.6.510595221\533373929" -childID 5 -isForBrowser -prefsHandle 5508 -prefMapHandle 5512 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9364e5ff-a8de-476f-9306-2e26e3a2af14} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 5500 2a05ac7fb58 tab4⤵PID:4512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2824.5.1797227024\1859235612" -childID 4 -isForBrowser -prefsHandle 5364 -prefMapHandle 5360 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef0819c8-edc9-4fc8-9f17-2cc1b345e1ce} 2824 "\\.\pipe\gecko-crash-server-pipe.2824" 5372 2a05ac7f258 tab4⤵PID:692
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3600 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\Untitled attachment 00022.eml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4956 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2436
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\E66F5AA5E3C285C270CF84BD11111C74D38F245C
Filesize13KB
MD5caf9d374f854bdb4403b0b37f11263ab
SHA173f89b485fa470fde6105a6ff17592adcadd58dd
SHA25624754ada9ad2723a912a249fa8d6804b85a28ec2f2bcd668b2485cbfac67d740
SHA5122205eef461470c0b1a82dc4d0137a954c58b5e409340ac24b8bb9924f72be34423622952ce7a3849ee5d5a381e1eec9d40471e8d8870decd838b4a27c12c3a08
-
Filesize
8KB
MD59a7d40a2e24919697a51e712cb902b52
SHA15522bce74c8b383f72c982dd5ce35aca618ec19d
SHA2562b57bdc14e2d4211ee67f756c6fad5b58f96997568780f9c2bfedcd16271a0e7
SHA512b1747dc7870b8842e52938df370717c0ebed55401d6a94f5594aa78d6b65801a733855126b97c495319c140fdd824fcf80d99a5ff82e8e79818b0fe49269ba6f
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5c1cb3176a9102aad38d994406120562c
SHA16d99c7c03c0ebf5fc67d69807996f902fcdd7bef
SHA25629174708cdf6e21ff4f64dc3fee98e7c08a113b5e3e9045173d98307c0dbc87f
SHA512111a11ef30b8461c407612d24634f9f6124aab8d2d1690d21ccf15378160bede637722a1de07959a635d1a6f407b8101a5255cdaa0ec561d5b30c5c06011323b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\1a5c2a80-53ab-4137-aa7f-2e5565a06aa2
Filesize10KB
MD5081d847b694474ba7e3ebe8ea82b1b22
SHA1177059fed333c878be539cf239944af62249adff
SHA2569e7119527c752e4ebf085a721a6e4feaaf4b99a23f402394cb2b62d4674052fc
SHA51287ef4e9095997df8edc678c04e1247058f905768fd5d7cd036048491d4212912d8d5ebb4b015e5fa6f92d5c7dc3ae5d9c0595b0aa4a899c01e0a57ac4b66d301
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\e145ae64-a479-4809-99a7-838db5966448
Filesize746B
MD53b0514c2b871d2cafdc3b0cf0c186fdb
SHA11d7c4a1e5f56e1100bb230062908832a80550216
SHA25664afcc9ac32da2f4b398fa43519bc1d306caa582bc556c95a2da2e621db7872d
SHA512ec88042973d4d68325aa5dc12f81519f4005aa40fd90ee2f6309b9c17061181ff9ce58efd91b9b28e56842fe6489fef3f803d1cb74c0cf9e6cb919738c0ec03c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD58ad523111e4b1cd2f2c7e1a0e09a47c7
SHA14548cb884c651428bbcfddcae45ca06674a8c194
SHA256440e76afa80dc0c6a0ab914063fe435a4b139202f326422f0d708562280efd08
SHA512d046af2dd6e27419af9d94a98e6b638fb1a92ba4af27061e8e383cabec24826e9bac2eaa7eac53bd0eff9cd39c9b24ed8c21cd0f45e279790bd0da76bc3bebb3
-
Filesize
6KB
MD5ae4287b14a9b3f88fec7b7d5638710ea
SHA1761b7e24b7a3ca50c9bf9e7d00970337ead54a61
SHA256b3bffb7e056b0bcb9beb7eb66f436b6b9db5e8ed726bdf731467cf911478bbb6
SHA51297dfacbb8701473e4718abfda371142813da2a839351c4a37fafdd9fa12da365e1d56526721967d60e0e054439e91973e449c03cf90b201792faa7b0dc6fd681
-
Filesize
6KB
MD5147cb6252b9afb2dec17ff2fae196572
SHA1392a1c3721930766ffbc94511ac2333ed71fec96
SHA256804ac40492c73723016cfb93bb2488564707183c02607988b3ea9f79f2cd9979
SHA5127433ae888a137b00e94f87118d9dd9bbeb55944b7c4f767ff8941046aee5c58a1b6952ab501e9afc713c0f04bc4c5d40f1c8b67be4f051f2563d71311985198b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize994B
MD5088265174ad84156a171e1aa1eaeeec7
SHA12609264fa8c4de945ae7f65d16e9545b7e332c9f
SHA256b29851b8d16109305bf3a7688a6cae70647a675a26ac99445536c29be1ef17ae
SHA51288f27aee615fc42c2ff4a6427849802333db6642cb2e03a6b959af24da8d0f568f878c29aac7d0c375cd35629f282e901f41f0799ca5b6d72d0600f1977a20c0