Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 14:49

General

  • Target

    37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe

  • Size

    1.2MB

  • MD5

    7db296a5f3818d7d11d994f2a26cc6c3

  • SHA1

    7e56f88358d914b90ee037145b14c622a52dd47b

  • SHA256

    37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473

  • SHA512

    fb498212823d9c1b13d1179ff37bbf6fd1fe671206f3021f5418fe47814ac6ef99149cef4434c46fa438f0a73a1c73304e41bf3629c1438a7176354b0086d065

  • SSDEEP

    24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aLo2Sbly7TWEPje:qTvC/MTQYxsWR7aLo2dW

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe
    "C:\Users\Admin\AppData\Local\Temp\37f4feb433dca380113a2b4a67dc5dbf70f67e31537bd94da9396af5c63f1473.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        3⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8afc292-a5de-4a67-8d74-dc30c493f5dc} 840 "\\.\pipe\gecko-crash-server-pipe.840" gpu
          4⤵
            PID:1248
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bb2192b-44b9-4c59-a1e4-8464b6071662} 840 "\\.\pipe\gecko-crash-server-pipe.840" socket
            4⤵
              PID:3228
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 1440 -prefMapHandle 1436 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a520560-527b-4834-b994-b333bb919cd8} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
              4⤵
                PID:1256
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 3952 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4432a2fb-3a9b-4001-9b9c-c15e1171a36f} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                4⤵
                  PID:4216
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4764 -prefsLen 31165 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4064de41-aec5-4159-98cf-75b954b8e6c8} 840 "\\.\pipe\gecko-crash-server-pipe.840" utility
                  4⤵
                  • Checks processor information in registry
                  PID:3016
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -childID 3 -isForBrowser -prefsHandle 5228 -prefMapHandle 5216 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d231f23-ff9b-4f95-8c92-201d8273ab41} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                  4⤵
                    PID:5664
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 4 -isForBrowser -prefsHandle 5356 -prefMapHandle 5252 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73b2a09d-b748-4e46-89a6-23b89107fba4} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                    4⤵
                      PID:5676
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 5 -isForBrowser -prefsHandle 5568 -prefMapHandle 5572 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c81c79b8-df01-4525-a363-2aae88a784bc} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                      4⤵
                        PID:5688

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  25KB

                  MD5

                  2d98af7ee492759e8a3da3055e22cf3c

                  SHA1

                  88655b01f4b24608a68ed5bf25a0657ffdbda1c5

                  SHA256

                  7a272b578b719d4c996e7cca5889776404e4344c506440982b55702cf47d6366

                  SHA512

                  1c744c8cac57205fd4bc60ae14f7323059251197a651f645f028973a4b9987b420ec01f767e9a859e1185579fa87b692611c9bef7f1b1391e655e5c9ba0d0abb

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ehv06adt.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

                  Filesize

                  13KB

                  MD5

                  819876eb818728f1808de2a48d121065

                  SHA1

                  539172fef5cb709f5dd69051e5b427c9587d12b3

                  SHA256

                  f5d086177ae4bd3c5dcc88a692469e4d09501f6af0628d8baa2d731f83a5b651

                  SHA512

                  c23dc534421338f624ed667b0e4feb844cde463be07cee9504c24735c53d015f256e42fb818a227988a6465407db7339106031c1d303767b60b5369bcd7ed15f

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  479KB

                  MD5

                  09372174e83dbbf696ee732fd2e875bb

                  SHA1

                  ba360186ba650a769f9303f48b7200fb5eaccee1

                  SHA256

                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                  SHA512

                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  13.8MB

                  MD5

                  0a8747a2ac9ac08ae9508f36c6d75692

                  SHA1

                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                  SHA256

                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                  SHA512

                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin

                  Filesize

                  17KB

                  MD5

                  16aeff1e07b5a882bce95ac7d0ba8677

                  SHA1

                  352c7eefba254284644f649a7cd78f17a266f525

                  SHA256

                  588b4c9a3ce14029e6c8b57dc4ccbd69c1552b53a9c5a5918fc1995fdc916e46

                  SHA512

                  4f883badb53e47e2d14e987b847b4a4fd5e342bd4f1332c20e907c798e22f812a66e76c4fb037e710358016a1bccbb3a5144f41e5b7d4a53265ac866b54c738d

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin

                  Filesize

                  8KB

                  MD5

                  1a62ccc1d0e79967694ce1eabd44619a

                  SHA1

                  99ac738f5b553974de2f408c1426bd98a7b42236

                  SHA256

                  2dcdecd2d787c6af485d25e15b1d9c5864c00e79c816ab19b28b445213885f8d

                  SHA512

                  dba4240ad163c1ef51530d485779cb9ef133ea2946994436fc84378938a7930a45f0fc86c33745ea77b6f89f78a3cac6f78835860cf6d859330a5d11b242ecd9

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\AlternateServices.bin

                  Filesize

                  12KB

                  MD5

                  2a9aa42784a01ba8ea71ad3632bcb002

                  SHA1

                  14f85f3a3991beca96cce92b36b77d1c854193c6

                  SHA256

                  f44b0faac32354193acbae92f95a23bfdf7f00989cbc1c93746bd1f16df031df

                  SHA512

                  25fa8c3906e2dfd44990d105b514fb0c3c5c47ca95d487292efaa0d9a2f1eeded3017dde0803530041d8e2733f2f53f0237fe4e2d979fd82fcb3b428f3902fac

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  5KB

                  MD5

                  d771cc8d19e365ae6f71b104dcc1225c

                  SHA1

                  7329322699ce206ea9b2c9b6f5245645c6e05294

                  SHA256

                  44ac8a121f8ecd6b6b112a2e8fdc568cee619ac2fe3a64eb99c0dd5f6b449f4c

                  SHA512

                  4aebf3beb7f5f02fd1d9e033ac48e0835962eb41da331bda48496f5c3fdf71a94895cc40619251c5f5ef5b3bd8a4fd8926bef3958a5cce42c4ba43274fe984e1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\db\data.safe.tmp

                  Filesize

                  16KB

                  MD5

                  83c83e1191795c7542e6af4c15552c22

                  SHA1

                  e97088edc22eb9b17528f672d2b37874778cfbf6

                  SHA256

                  5c962b07723e72ac1569fd3ee4c775c85752839ebc7ec5e80b301ed831b48384

                  SHA512

                  24c09399fcb923b7344533184685518c59bc6902427143b3757442b8aaca1acb9179434aa4361da034aea6eff1e183d892be16c162d7761bd409985c88373219

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\60153189-70b3-40f0-a1e1-8b479fcab8dc

                  Filesize

                  671B

                  MD5

                  2d1516a3e3eb1dcc0d4cafeabe7e9062

                  SHA1

                  9db38feb184aaf44bc62583501e9d5fdc3094ed9

                  SHA256

                  e97780f5c44ae0491920c148caffd6f7a820dfad1085fa14a6ba0c60fa3cae74

                  SHA512

                  b66fb8539fdf2495796a05c94aad3fe803495b49ecbf86b79b29796721039ab6e884fe65aa8964075be5fb265fc9174414b2bb4c2e169e6d150cc47ddf5c4d22

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\cd91c76a-a182-42dd-b824-43f4c6698a3f

                  Filesize

                  27KB

                  MD5

                  934f78972c0e1edaa472771503b64415

                  SHA1

                  776e33ef6dca42e1fca4d5a480f92046fdb17eb3

                  SHA256

                  2d68bb0ef7dafaa3e28c1670498aae7a88259bfff02013be9e0119258426f678

                  SHA512

                  35b2d85b90914eccbcb770370dfdcdc1c529c60fe1e094217d21647bf39893b4ba840149d0f57e8a5518473cc21c634153babac70fe43616935ad94ca3924996

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\datareporting\glean\pending_pings\ffbebe69-1ed6-47d9-b3eb-4be82b155a83

                  Filesize

                  982B

                  MD5

                  dd383115e77ebada9600b2a14836cde4

                  SHA1

                  4ec155b4c2a33f5e7958b0f29fbf29edc2158fa3

                  SHA256

                  1a1e286e34d11e50eba9b8438abdba25559c5ca44e4c407201822fedecfee434

                  SHA512

                  9a34e613929bdc3cf484992af65694b5528a68b91b277ad2dfb2310bb55e12d9dbf9cd2e657a1c879a2b460cb20f649bc6240b9e5c657699663a372f4d0f6c38

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                  Filesize

                  1.1MB

                  MD5

                  842039753bf41fa5e11b3a1383061a87

                  SHA1

                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                  SHA256

                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                  SHA512

                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  2a461e9eb87fd1955cea740a3444ee7a

                  SHA1

                  b10755914c713f5a4677494dbe8a686ed458c3c5

                  SHA256

                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                  SHA512

                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                  Filesize

                  372B

                  MD5

                  bf957ad58b55f64219ab3f793e374316

                  SHA1

                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                  SHA256

                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                  SHA512

                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                  Filesize

                  17.8MB

                  MD5

                  daf7ef3acccab478aaa7d6dc1c60f865

                  SHA1

                  f8246162b97ce4a945feced27b6ea114366ff2ad

                  SHA256

                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                  SHA512

                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs-1.js

                  Filesize

                  11KB

                  MD5

                  5267e1ebfea5777a0a1ccd53eab21b2d

                  SHA1

                  421f526ac463fce1f8fbb398c926252ac8071573

                  SHA256

                  8b8b9bc0a8c4ecefed6520e1fd327a11e34f77e8e7255d5940f8b78ad36db4f8

                  SHA512

                  d467dab88cbbf840c43557aa5b971e2b7df910dcb6aebfaf496ea12a5f143c09c1f1b9e7d19a110efa6c7b6031dab7930d912134235039465cf475bfcb247f1f

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs-1.js

                  Filesize

                  12KB

                  MD5

                  17f21ead54703a1170ba1341e34e9afc

                  SHA1

                  f415b89a311115968ec8be782217a5e8f0d52cd8

                  SHA256

                  a9ede3f803d37586c7bcf969b4ed380857bf88d9c30dcad4b312b2d2e61923b3

                  SHA512

                  9448bbba8c3101efc45c66052b78c092b10cf4cf5f6e2ce623a861454d1678f678e4b3f7af9cf1ffac17a322ff51fd66fe7bb195974fba03fee68e5abc0dfd02

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs-1.js

                  Filesize

                  16KB

                  MD5

                  7d74fa6001b01c51a94f8e4e4dc1609e

                  SHA1

                  fc5c92f62e23f83aaaf8c519179f3c5af415ab39

                  SHA256

                  23455514957d549e6129fefa807224ac5ca32cbd1f85cd1a0e7836d74e19bdf4

                  SHA512

                  23d78aca485209cd03beb4278ad0623e13c5f7bb780473c4ee7283ecc6004d4aa68ea3f22061e847038fdc994cae5938058ec07c59d306d26cef49428243fbd6

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ehv06adt.default-release\prefs.js

                  Filesize

                  8KB

                  MD5

                  8d20a4dc42321b2485af2bf12ee7d41e

                  SHA1

                  f035ff75092bd6c8b9346e9f881dbe1150c816be

                  SHA256

                  e5f32fb8242ecf19aa33aaaa957be17ab6c328857477416d4795230ac13f6a9c

                  SHA512

                  7116611aab51b12ef6d5c17f16cca54d706dd0421b644f92b16932f8cacca178b9b2c140f15012250f4902204da76cfcf4794beb6e4024af785eab9431597674