Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe
Resource
win10v2004-20240802-en
General
-
Target
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe
-
Size
1.8MB
-
MD5
5b496c08c6603286a74edf4f17a1f7e5
-
SHA1
343311b9d583bde7ed9039731036fe7fd31cc701
-
SHA256
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5
-
SHA512
b2f80db9884dafc865f351bcbba774a342e10127ff3d720691d4f347a73ed1edab6e76d76f10e0b99e0d2a667675f5a2f5cb756b8d4240f21c75ed9ba1aa9c93
-
SSDEEP
49152:Z1/YQEbR60x6+yuS8I5FF/Yb8hsS0VDu7Q0L4XcjOk5Q0EGDYF:ZCz16iyupAFhY4hZ030LtjZN
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explorti.exeRegAsm.execcc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exef9defb1475.exe01da7b0673.exe6fcf1e4b28.exeexplorti.exeexplorti.exepid process 5028 explorti.exe 376 f9defb1475.exe 4040 01da7b0673.exe 1428 6fcf1e4b28.exe 3352 explorti.exe 4948 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f9defb1475.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\f9defb1475.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4568-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/4568-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/4568-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exeexplorti.exeexplorti.exepid process 4428 ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe 5028 explorti.exe 3352 explorti.exe 4948 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f9defb1475.exe01da7b0673.exedescription pid process target process PID 376 set thread context of 4568 376 f9defb1475.exe RegAsm.exe PID 4040 set thread context of 4896 4040 01da7b0673.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exedescription ioc process File created C:\Windows\Tasks\explorti.job ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
f9defb1475.exeRegAsm.exe01da7b0673.exeRegAsm.exe6fcf1e4b28.execcc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9defb1475.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01da7b0673.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fcf1e4b28.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exeexplorti.exeexplorti.exepid process 4428 ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe 4428 ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe 5028 explorti.exe 5028 explorti.exe 3352 explorti.exe 3352 explorti.exe 4948 explorti.exe 4948 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 808 firefox.exe Token: SeDebugPrivilege 808 firefox.exe Token: SeDebugPrivilege 808 firefox.exe Token: SeDebugPrivilege 808 firefox.exe Token: SeDebugPrivilege 808 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 808 firefox.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe 4568 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 808 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exeexplorti.exef9defb1475.exe01da7b0673.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 4428 wrote to memory of 5028 4428 ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe explorti.exe PID 4428 wrote to memory of 5028 4428 ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe explorti.exe PID 4428 wrote to memory of 5028 4428 ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe explorti.exe PID 5028 wrote to memory of 376 5028 explorti.exe f9defb1475.exe PID 5028 wrote to memory of 376 5028 explorti.exe f9defb1475.exe PID 5028 wrote to memory of 376 5028 explorti.exe f9defb1475.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 376 wrote to memory of 4568 376 f9defb1475.exe RegAsm.exe PID 5028 wrote to memory of 4040 5028 explorti.exe 01da7b0673.exe PID 5028 wrote to memory of 4040 5028 explorti.exe 01da7b0673.exe PID 5028 wrote to memory of 4040 5028 explorti.exe 01da7b0673.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 4040 wrote to memory of 4896 4040 01da7b0673.exe RegAsm.exe PID 5028 wrote to memory of 1428 5028 explorti.exe 6fcf1e4b28.exe PID 5028 wrote to memory of 1428 5028 explorti.exe 6fcf1e4b28.exe PID 5028 wrote to memory of 1428 5028 explorti.exe 6fcf1e4b28.exe PID 4568 wrote to memory of 5092 4568 RegAsm.exe firefox.exe PID 4568 wrote to memory of 5092 4568 RegAsm.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 5092 wrote to memory of 808 5092 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe PID 808 wrote to memory of 2188 808 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe"C:\Users\Admin\AppData\Local\Temp\ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\1000036001\f9defb1475.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\f9defb1475.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07bacd7a-5292-4c96-b202-313d0e54b7d2} 808 "\\.\pipe\gecko-crash-server-pipe.808" gpu7⤵PID:2188
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6013234-b3e9-45b2-920a-c965108f2a88} 808 "\\.\pipe\gecko-crash-server-pipe.808" socket7⤵PID:2024
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3136 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {503ea86e-9037-4db7-89b3-6ae270dbd487} 808 "\\.\pipe\gecko-crash-server-pipe.808" tab7⤵PID:4272
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3696 -childID 2 -isForBrowser -prefsHandle 2784 -prefMapHandle 3584 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b30d143-0318-449f-86cb-96000f06c0ec} 808 "\\.\pipe\gecko-crash-server-pipe.808" tab7⤵PID:4260
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4808 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4800 -prefMapHandle 4796 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cce64222-f80b-4a13-be54-a808592b26fd} 808 "\\.\pipe\gecko-crash-server-pipe.808" utility7⤵
- Checks processor information in registry
PID:5200 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 3 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fae2cd61-9320-461d-af94-2b5d9e929c50} 808 "\\.\pipe\gecko-crash-server-pipe.808" tab7⤵PID:4412
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 4 -isForBrowser -prefsHandle 5884 -prefMapHandle 5888 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c6f41f3-f0c4-40db-aa38-c504e970f5e4} 808 "\\.\pipe\gecko-crash-server-pipe.808" tab7⤵PID:5012
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 6044 -prefMapHandle 6048 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50dbf68a-96b4-486d-ae21-6cafe46dae30} 808 "\\.\pipe\gecko-crash-server-pipe.808" tab7⤵PID:4484
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6236 -childID 6 -isForBrowser -prefsHandle 6320 -prefMapHandle 6316 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f41edf4-685b-4d5b-bc69-97a2a5cc8c56} 808 "\\.\pipe\gecko-crash-server-pipe.808" tab7⤵PID:4720
-
C:\Users\Admin\1000037002\01da7b0673.exe"C:\Users\Admin\1000037002\01da7b0673.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\1000038001\6fcf1e4b28.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\6fcf1e4b28.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1428
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4948
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5c05fd08043fd1dc414300a92bc73e1fc
SHA19d3c8c2a2bd2881606dc2a826aad65f63a332853
SHA256531cbb2c4dbaaea781ad6798ce36c7ce254c8f88a892dc42ee0aaed205e1a73d
SHA51243f00dbf42c84002b4ab46b907953c1236407cdb55001d01ac193a87e3fab9ecacdf4bbac7d2a02297a41f4e62a2a37b93c2e8b559e791c5484791f2faa1d065
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json
Filesize45KB
MD5708625531a2a744ab76a823dd2a78981
SHA154ffcb48e3cba5ad1f3463bd932f658d49b15bf1
SHA2563b115591712f3bf68a6f665be0d29ca6ae08834b8982ddfed39da4c907896dcf
SHA512d6a93e51448c0c582e9d2fbbb3e096bdaf935141e006d6f2a29eea8b04ea93fbcf3820c0d4004b429a835ac9f7607f06eb40648c1da4db1af847cdf9385b7af2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD55c1d9994155b61528d59658503268b43
SHA19bfa2b8c83b374c09a89e26cacf0bdb38a13b41c
SHA2563fe7667933240b178fa3380f07e613ba58f36e40ce5d98c92fb34963ad57606e
SHA5129209f410ce9ca8506b12d6b82ed9e78fd67e4dd94dd373b9b9aaedcac66f8e4ffa10ab3f19fd556af676c311d044f41a23a3d77e5f195905b91a786be1c8b41a
-
Filesize
1.8MB
MD55b496c08c6603286a74edf4f17a1f7e5
SHA1343311b9d583bde7ed9039731036fe7fd31cc701
SHA256ccc2a60072b214515b1ba5af3838f7c41d5c15531a2047f812588429f8264ee5
SHA512b2f80db9884dafc865f351bcbba774a342e10127ff3d720691d4f347a73ed1edab6e76d76f10e0b99e0d2a667675f5a2f5cb756b8d4240f21c75ed9ba1aa9c93
-
Filesize
1.2MB
MD5f5f1e8f743ec3d40dbe97e0e67e14861
SHA114b889a8602eb0d8c05f4bd415977c99fce99b90
SHA256a3c814c3833951d016c68679e2f8902cc1ba30d8acbb14a64aa3a58e3f23d51d
SHA512cc23bf8b3588fc68e2641c813c2ce1eaa7aa8d123071def3f88fc679abaaffed0d22fdb7e36e3d782170b69e62f0e4585a30f591d328d5c83039b997d8a30732
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize7KB
MD5f879acf8daf0c3161656e243edb85707
SHA167ea1291d6de577440bf1186b386b3a5519db5e8
SHA25676a6d4754f849194308b787deec411901fe33a412d3c86b5d0209d98fd90d8db
SHA512e3437e47aec4559e1c4700f571347287744ecb95b341d4cbbc69faebf456da87344e970478af2cbb53e636f1c87b9040c1a065352ab5069785931bce0c26ead0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize10KB
MD5b7e47328c798c291c52721280829e306
SHA13cf5ad37a480d170fe15bc55b5563288783a53e0
SHA25629d1bb36415c69a02e31e5236d82830a001eb677d3e8447cd84fce7904c1b78a
SHA5129ccd705c1dbcb7aa227706423a6513bea690042f8655be8d773eb355399efee5f3e6b1ce5843b21c7ca10620c66f08b26501a74d3548c32d283942adca4620f0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5d5ddbd710c697caaae9dc1b658204184
SHA1ce05257a0690c332a6cc93bff26cbe48e7a6aa56
SHA256ed350167c827f3f7c5526a8d77cda2a7d092171202f6ebd3bf338d7aa5741d93
SHA51227e9eb27d831956eb363fa1bbff58d9ca25fe79b6a4fe92faa78bee8557400b1188e4f0d46792c0a77e090a265f682472fb0acef0c52e8ed9cc5a34389a65d3b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize4KB
MD518498e063db7a3c6241c0adbf1b5b95a
SHA1222f5921f29bef977e932d4b5a550c4c47685457
SHA256b68ec6d5ec518dc3bd5511250eed9299c9026ee319980df8ca5fd039649c651c
SHA51293ad71c0ff6ea21e2fe9221b7a5417824fdede0a1b7971f53942e10592ab624d5dc43d29d98bc4534adb8a870185db43f5e7ff1af58a2563ac647717d5e6ddc9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5d43793d22cbc45c8186ec2ffd76b6e26
SHA1a1d2f2744af9314050fe74d9833a813a7b7cff8b
SHA2569fbed9db921836ad092531c400e1e0c98ce08c4f9cd13d295930164e273a76c2
SHA5123cdf0ff39dce14920ed23f3afaa5128a4b2bbd0002d9c0240ce7d2382b77cce995c59a46d21ee2bfb3326a55a7910f4205a4b307e4880b597091e574003bf806
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\1da7ece1-6c84-4faa-a201-6b4a54774249
Filesize982B
MD5fd5bcd50c3e70c67899becbf2c7367e1
SHA160c061f1cdc9a3895a7315db8b30dd9ec01e8f41
SHA256cb1714a4ee0a957915b07c988cc43de424b34cb53e78bcd0057da331d66e72b3
SHA5129c26c7b629a22ca224e73b6b28e72aec7aabd88872df8e6399d1ffc56f16f2b479b49355dccadf5acdb0538e9d9067e252c46a52050715e315331f6a1bffd5d1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\8c7803c3-dbcd-4411-aef1-9939f160141f
Filesize671B
MD563ef424b4cce729a25c0aa36165a4227
SHA1f7e650ce058cd470415538178e91ffe3c0996b6d
SHA256bf742a937f6ead1f9fb87212756f4b85691644d3f49da675f1413b1597b7be5a
SHA5121697cb8a666cd9f9e927678b0a50e4def0920a7d2d0eb8db23dd9b8014f0a5efaeddd392f2f2bf613df8df287ece33b4368bef1d7846bc03dbb8a0284fb8c39b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\c5fe5fb7-6da4-41c9-b221-ccc4a209cc63
Filesize26KB
MD55f4897a69082c7e92a0579873350c083
SHA133a9b563e9f20a44f7bee0cac874983144bdfa35
SHA2564d6a60769dd7d008edc805a6bc0cc48d59719cdee44c090615747bb3032d531f
SHA51298cb5ce621b6b260a6aeec2f5d4575236288fe1e75688a96b755a308688ad3e047ab2be60f71f4205634eb2d767adfa23bbda4bfa03ccc5e3e92b5a3598ddf2d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD596bd465a6871bc461ae1e9ad492342cf
SHA15d6d3889b0e7f972a38a171f7695dd89924646c4
SHA25698852fdfb3e6465fcb322a38182a4521caa6e321088b7ecf35287c0d2e611b2c
SHA5120318ecf718fe24ebe5b2f16f9bc095f22cb8727a731a8f51cde539b7f024bc111aa6105d9f1c4a29920d2058c0a23f9b666690dd7d791e991e5426b8a8d1f974
-
Filesize
16KB
MD5050fe7d49a732f6c3e9939eb5536efb0
SHA1427e18360eea0323b15e8dcc8ee61ec163d83b9c
SHA2568eb32a6525519b1b2d2564209081a48bb201f4d639e019db0b12c5ed650a4b74
SHA5125c24445b6557ba7799845786d5b07b3feb9ec7dacc9333b8e7eb9efb096af8edebd6de5b6f566e9d2d8a0a619c55039e47368f6ad07d88adeb8064308b631b87
-
Filesize
11KB
MD52c89812ab60aded00907dd34b15b85d4
SHA1cf4b8195d7192db432b846518960238a7aded9ef
SHA2565722083432f2f97f813e12ad9b78ff57fcd01d148e729a51e8ce9ad6728d1e63
SHA5123fa293908bf7acf516276d83cb187e6a4cecf436480d3b3e5177842c3b39ae12c7423722cc79d3b96acdd0177dd1d4c57f81b5b0a18efa10b2932467658142f7
-
Filesize
11KB
MD55e7280702b9b737b27b7c6aeafb1de26
SHA16b2582749afa64cc6953cf057eaa81d03cf24483
SHA25679d61b23f0581d94b39e2c1b9b57f4b87c56a089017ea9e19d651b9c09ae2a47
SHA512079df78652825edfc4663df200f274314a4667ac8c9df381e25b420972f2021c0a9d60550f0451ae48e91870e7f36eaa550cf59321881c0b37309f6c990def24
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.3MB
MD509fff090a5a022af9b1de22ef4946598
SHA1009a57183b52b7b9a62aed3d6c72c97599104598
SHA256b067a2944ce378446047170699b55f80e982a38f0893e7f7ddf82741744b2871
SHA5122c145e987bd7f0e7e46e91b133a33bb772ae8903ed3a70a0afbd835aaf25c564bff18a5cc0f3c244dc993563da18be1fd38005a92b7d9f4c1fc787b15fd3e83f