Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 00:50
Static task
static1
Behavioral task
behavioral1
Sample
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe
Resource
win10v2004-20240709-en
General
-
Target
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe
-
Size
1.9MB
-
MD5
a7ae46b0e7a0e279a3ac3151958fef99
-
SHA1
7d3d8c2c1dea8b585f58bab81c9fa86afc7576fe
-
SHA256
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d
-
SHA512
48e59e2c32fd089a4cfcbbea546c936a004a1329bf908c4f8c2f22438d5c787416b3bd497072c4d450decabdd329b3c5ceb60f8fbd1f1531f4bc82be33e85107
-
SSDEEP
49152:07LLFqXDioAW3XMr+I/HHSbIv9OQDr41lB4er/c7upB5nzhA:cFYf3XMmbIVOQD0uR7gB3
Malware Config
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Extracted
stealc
hate
http://85.28.47.30
-
url_path
/920475a59bac849d.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeexplorti.exeAFHDAKJKFC.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AFHDAKJKFC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeAFHDAKJKFC.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AFHDAKJKFC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AFHDAKJKFC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeexplorti.exe7f0b21aa28.exe76d58db15f.execmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation 7f0b21aa28.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation 76d58db15f.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exe76d58db15f.exe7f0b21aa28.exeAFHDAKJKFC.exeexplorti.exeexplorti.exepid process 2264 explorti.exe 2260 76d58db15f.exe 3712 7f0b21aa28.exe 2284 AFHDAKJKFC.exe 5060 explorti.exe 3492 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exef9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeexplorti.exeAFHDAKJKFC.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Wine f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Wine AFHDAKJKFC.exe Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Wine explorti.exe -
Loads dropped DLL 2 IoCs
Processes:
76d58db15f.exepid process 2260 76d58db15f.exe 2260 76d58db15f.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000010001\7f0b21aa28.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeexplorti.exe76d58db15f.exeAFHDAKJKFC.exeexplorti.exeexplorti.exepid process 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe 2264 explorti.exe 2260 76d58db15f.exe 2260 76d58db15f.exe 2284 AFHDAKJKFC.exe 5060 explorti.exe 3492 explorti.exe -
Drops file in Windows directory 1 IoCs
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exedescription ioc process File created C:\Windows\Tasks\explorti.job f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
76d58db15f.exefirefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 76d58db15f.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 76d58db15f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeexplorti.exe76d58db15f.exeAFHDAKJKFC.exeexplorti.exeexplorti.exepid process 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe 2264 explorti.exe 2264 explorti.exe 2260 76d58db15f.exe 2260 76d58db15f.exe 2260 76d58db15f.exe 2260 76d58db15f.exe 2284 AFHDAKJKFC.exe 2284 AFHDAKJKFC.exe 5060 explorti.exe 5060 explorti.exe 3492 explorti.exe 3492 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 3988 firefox.exe Token: SeDebugPrivilege 3988 firefox.exe Token: SeDebugPrivilege 3988 firefox.exe Token: SeDebugPrivilege 3988 firefox.exe Token: SeDebugPrivilege 3988 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe7f0b21aa28.exefirefox.exepid process 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
7f0b21aa28.exefirefox.exepid process 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3988 firefox.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe 3712 7f0b21aa28.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
76d58db15f.exefirefox.execmd.exepid process 2260 76d58db15f.exe 3988 firefox.exe 6116 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exeexplorti.exe7f0b21aa28.exefirefox.exefirefox.exedescription pid process target process PID 3944 wrote to memory of 2264 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe explorti.exe PID 3944 wrote to memory of 2264 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe explorti.exe PID 3944 wrote to memory of 2264 3944 f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe explorti.exe PID 2264 wrote to memory of 2260 2264 explorti.exe 76d58db15f.exe PID 2264 wrote to memory of 2260 2264 explorti.exe 76d58db15f.exe PID 2264 wrote to memory of 2260 2264 explorti.exe 76d58db15f.exe PID 2264 wrote to memory of 3712 2264 explorti.exe 7f0b21aa28.exe PID 2264 wrote to memory of 3712 2264 explorti.exe 7f0b21aa28.exe PID 2264 wrote to memory of 3712 2264 explorti.exe 7f0b21aa28.exe PID 3712 wrote to memory of 3940 3712 7f0b21aa28.exe firefox.exe PID 3712 wrote to memory of 3940 3712 7f0b21aa28.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3940 wrote to memory of 3988 3940 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe PID 3988 wrote to memory of 1708 3988 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe"C:\Users\Admin\AppData\Local\Temp\f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\1000006001\76d58db15f.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\76d58db15f.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2260 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AFHDAKJKFC.exe"4⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\AFHDAKJKFC.exe"C:\Users\Admin\AppData\Local\Temp\AFHDAKJKFC.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2284 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JDBGDHIIDA.exe"4⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\1000010001\7f0b21aa28.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\7f0b21aa28.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account4⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f38df7fb-df01-411d-b497-c58be6b65405} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" gpu6⤵PID:1708
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93693ae8-850a-4053-9969-e062dd29324e} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" socket6⤵PID:4672
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3012 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3000 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc1cdaa0-b3c5-4441-bafb-50086098da88} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" tab6⤵PID:4976
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3684 -childID 2 -isForBrowser -prefsHandle 2992 -prefMapHandle 3672 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {548c8703-d7c7-4140-8f92-fde0518adaeb} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" tab6⤵PID:1184
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4872 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4836 -prefMapHandle 4828 -prefsLen 31272 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28bd9b4d-6577-4b0a-932d-11d3ebcefde1} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" utility6⤵
- Checks processor information in registry
PID:5252 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -childID 3 -isForBrowser -prefsHandle 5396 -prefMapHandle 5392 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7c17736-4aeb-4df3-b51b-196b0b4aa502} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" tab6⤵PID:5836
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5620 -prefMapHandle 5616 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {233260d2-b7ac-456a-badf-9e593764bbe9} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" tab6⤵PID:5848
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 5 -isForBrowser -prefsHandle 5812 -prefMapHandle 5808 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1224 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {618d5df9-f719-45e8-9e38-d32b7f3b7dad} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" tab6⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\activity-stream.discovery_stream.json.tmp
Filesize18KB
MD5040309352dcaed3d439253cb74a7db5c
SHA154a1db87028e690bd374b64c2a495713768a4216
SHA256f285037d0b7c812cd65db5d6820112d6cbe32044d07edc774796fa2756de81af
SHA51269ccc819d810ca6f062e55d7ca77c6ee6ecee38d0d4c9a5fbe19404887603f2168c94320cda7f6e01f0e8cfdc4877744b909b0f6a38dca423aff279bb3e0f74e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vvc8bff9.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Filesize13KB
MD50e3b9d4b2a856c251c0188d0b2392cd0
SHA1c8ee129b88d2b591c1274cdc26c6a12b1f6b73e6
SHA2562128627299c6c689c0a74d0ee7b1fb5543034c0b2ad702ef6ecbbdbdfa118837
SHA5127cc8b80240c27825387ae5d1dad259e0431600873f8965b7579df033462ecc662291bbc4a8ce38f1d7e99119fce674d692d082e18a14876359745a9d16b57973
-
Filesize
2.4MB
MD51552573045f153aa7269a30d3a1dd151
SHA1d07f6a1ffcc0bd98a80ba1d5574425a2bd1d3d23
SHA256d87490fe72c11df8476414b03d613fff99a59894193c25121bde71c745b91c5d
SHA5128301e552f8d1019bfc9e85d6249e329b767b95b7092d537129665d96ba62427b7a806c97b97ce0f314cd34a7675852b3f553519b03304bd12831eafeac446460
-
Filesize
1.2MB
MD5bea6ed281b600eae06be252f581721c1
SHA125fae547b4ad0a74bcc0bdf7e819f2c56d8be05d
SHA256d18bbfa83202881061743177527c4f1ea0681c658028dd7dd0468f9a8a39e7cf
SHA512746a1bcae568caaf399ec8ca393250d6846235296088e22a2c8d80ce290e13d5845d79d7848b4f46adce2dad147b91c3731059b44ce7370f26072c999758bb42
-
Filesize
1.9MB
MD5a7ae46b0e7a0e279a3ac3151958fef99
SHA17d3d8c2c1dea8b585f58bab81c9fa86afc7576fe
SHA256f9e7ee889ee40ba497d750182ff74e3a6ad4d9a54710785548d1f47f24239a7d
SHA51248e59e2c32fd089a4cfcbbea546c936a004a1329bf908c4f8c2f22438d5c787416b3bd497072c4d450decabdd329b3c5ceb60f8fbd1f1531f4bc82be33e85107
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\AlternateServices.bin
Filesize12KB
MD5663bf32091c9f7f0e939951c9fea4655
SHA189982d06e6c59cb3aca92cf23c78a315ad6a2b89
SHA256dc9dac7ddc031cbf6c705d261cfc675fe5febd17099b8591c1651c60abf2552a
SHA512b1bec646d0b5455d55061a162b3ce876dcd283e814599fc98bf1ad0fc7cc756fe3c03b6fa6bb873500b06a39fabb779a60893f7a2748d3262c04899bd3261ac2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5f24afb4b908ce74d088f57c0c6f4574e
SHA103d69db356cc186ba9fc30d403b37052191616ab
SHA256cff9721e5ae9556d54d8e0d2d35e7482cf8f73f4574d75659bd0e39c8bae0837
SHA512e45d8a7de9984d31345e4151bf9e3bb0f46c9a4d175f508c4b0d33a80b180884d6fad37c692d05964eb1d0c580fa6500ca84c4350eedce287cfb183856b897c3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
Filesize36KB
MD53285e461d0f414114af093ea5c7561fe
SHA1347317d57a490c0e589fe98c09e452fc13b8c15c
SHA2568e139e5eec4316b549eef8d0b45b0d4bd9a19f47c10f0c244194f4b95137ac96
SHA512026c37cf2948da62e5bff6175b51d9f451d67da624981e5b081b27149834e47d77ab3b36a3d93dd0812bb75ef9a45c6e6b7d9ae5a5f3237d12ee6f09e424a89b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5b61655546f16deec9d1f3d11eaf48f5b
SHA1c010c764fd11f29b8f4e33d3d0549ca77b00fdaa
SHA256537699b76e7f7577f673f45ad9db831e344287f0a16bfdced24fa7c1c883e2d0
SHA5125fb6710df3a560df9793aca7308b580464cd65aa377f1d08e7f8e73326e2413a24ee808ee2e020e51a6bf7abe0f4f624f0e9c1d236b5530681f5ac137641eb96
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
Filesize25KB
MD5a78dad805075ed4ea5a9cd1b61e73a16
SHA161998a471ff048db5b2005b6c77a1d077b2294ab
SHA256213fbc3cbc6ecf8a2656a5cf007936b0bf1d9a188ba37e2226f48aaf46a02f79
SHA5121ba98050ab93f622294e99c36730935d2a621c5bbe3914a474bbd8d0fab986fa182837f96b763243561469747959cb22268fb4b607722c72de93be769100a5fe
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5c83ba097335615e590e791717112d880
SHA1fb930a18258b080579ae62dfe6b5b7e396da6b06
SHA2568ec76dba4328ec055ab39c041f35386a0db46cf5d29a6fc82c75ec9384c1e74a
SHA5126de8bec1f1cac96cd1336c965a446027951b8a430bcac35d3f74f1d6a25d8a18d84cb7796c7883955a52dcfc11ed65b0bdef568112d1b24aabc1ed7d271f9e19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\921b8916-478a-404f-aedd-70f50e5541ef
Filesize982B
MD586cd3053f0c7b77b30e704180ec2c3c3
SHA11d418f152599562bdeacebac669901a58c869634
SHA256510d4c7eb53be1b88e380129c04c27498ce4d674b2270fe95e6197a2479277b9
SHA512380186c496ad841ee681fdc609b77394cb7b9ba6f52760cf5590b4c82e57b8208321c0e4e4d2df3a2e97395f8d7bb0406a4c3787ea563bdbeb2bb95dc8d720e2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\datareporting\glean\pending_pings\e1b57eb5-0157-44a6-babf-3df9bf4d1a57
Filesize659B
MD52e37dab325d0961287221d63fd65918f
SHA12f66656d1e061963928283dbd54530aa6f7653ac
SHA2569499492f43ccc7859961552fbadc36ea3187eb23774b9a98a577c40075b895ae
SHA512d9c2f4e50ea0d7bc86503b9f1d993ce9b1b11a60c06c5cf3c7bb746addb602660f0e7f24e437aad9aa457f0e571eee11e3c6d3e6bce7443cc211cbc8b68a6204
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD5b6ddcc66dbbf6f545a3ca7d377a10a08
SHA10688f8a7f021263b76f1e77082718154957f5edc
SHA256e8d8eed09d49e8a15ddf055060385767278e4967f929041b07aef1cc06d44daf
SHA51278a88d5a9d3a49cbc0beb547e92f4153c9739bc4dbd683f8f921c0c24864dab8ca17272908aa71c5e1d184b58fe692e298882c7f48f40e8a882f23a641ceb01d
-
Filesize
13KB
MD50b3900103612e3edaab2787a78ecb62c
SHA1f906ad697e7e6ea4e0324dd6e696ada6291118d7
SHA256f2add1a5013b8de384fbd3a4c5465e547c7dd1401bc1f818fb8c07fb55938b21
SHA5127ab87041b35f544b273955c032479cbbd9aa098a7968410c49c859aaefe108f3452c43cb598d6d54bec902eae05775ad85b14bb5b7638fc1988ee058b9853a3c
-
Filesize
8KB
MD59652fa16769724f3a6724dd96fc36db7
SHA10a11923f38f2d1fab5ef74c08a3b6b1fd6025210
SHA2569c99e71c288b276e4281aa8bbaf6f8d8a607f3fd623dbb0bd0377a4f933ee807
SHA51275cfb6711e13bfc399a67d52a9459e63f20e903ff607d028367688657e4b1ee2e73e3cb106e8e43a3e2693b6da95be03bb90de123242540fdc37240987538d64
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.1MB
MD5a805667237630c370a61f6b6030d0418
SHA18b4f224f0a87318549dcdec8b0ff16261c942edf
SHA2565a416a2a6676bcd7c9e4410316fbbe3e23b541a735fd11216b4be9cd345972d9
SHA512ea771baf15754c9995ae9f5effda0896e2615d9f188a63c0f7e80d023633a96dd09b5ba89f6026f8e717747ec915b26053547b547a60fd9c1b4d68e36b00da86
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vvc8bff9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize2.7MB
MD533337ae55eaaa81aa3adcda3c8ebf8c8
SHA186bc21e3b04190231b9893533ea87e8966d86647
SHA25695c08c216595e166758ef31d639f89742d4fb934027e75d4c16911793b93e4bc
SHA5125c56a0f7e2c4cc2a39fb7d359df31c5fa0d18b0dac7a24f09651ce875e1822b24be6bec5eb67514b380107e243c6168223e970daefc20e1239a73c8f4d8ee932