Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 15:44
Static task
static1
Behavioral task
behavioral1
Sample
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe
Resource
win11-20240802-en
General
-
Target
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe
-
Size
1.8MB
-
MD5
861c827245b68e21c35816cb416fa6d4
-
SHA1
4c06e785acf8ea9f53e8ba470e1cc35fa540912a
-
SHA256
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767
-
SHA512
4cada1de9609b61165ad264c7bd0eec89af9889a9a9b7a00f0d3ff70562d8a6e059d08cf4ea1822e551fb9d196a23649432484e5154975c8e7323907ceb1c4c8
-
SSDEEP
49152:6IT2PAGMlNLDZf2YDJOZBVXYo+HCLnn2Vfhy:6ITY0NfVxIBVoodj
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exefd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exe4e168a7bbe.exec0165c0251.exec0e71ae5de.exeexplorti.exeexplorti.exepid process 2844 explorti.exe 732 4e168a7bbe.exe 4536 c0165c0251.exe 4376 c0e71ae5de.exe 3048 explorti.exe 376 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exeexplorti.exefd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4e168a7bbe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\4e168a7bbe.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1988-44-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/1988-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/1988-48-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exepid process 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 2844 explorti.exe 3048 explorti.exe 376 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4e168a7bbe.exec0165c0251.exedescription pid process target process PID 732 set thread context of 1988 732 4e168a7bbe.exe RegAsm.exe PID 4536 set thread context of 2128 4536 c0165c0251.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exedescription ioc process File created C:\Windows\Tasks\explorti.job fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c0e71ae5de.exefd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exe4e168a7bbe.exeRegAsm.exec0165c0251.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0e71ae5de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e168a7bbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0165c0251.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exepid process 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 2844 explorti.exe 2844 explorti.exe 3048 explorti.exe 3048 explorti.exe 376 explorti.exe 376 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe Token: SeDebugPrivilege 1952 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeRegAsm.exefirefox.exepid process 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1952 firefox.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe 1988 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 1952 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exe4e168a7bbe.exec0165c0251.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 2104 wrote to memory of 2844 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe explorti.exe PID 2104 wrote to memory of 2844 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe explorti.exe PID 2104 wrote to memory of 2844 2104 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe explorti.exe PID 2844 wrote to memory of 732 2844 explorti.exe 4e168a7bbe.exe PID 2844 wrote to memory of 732 2844 explorti.exe 4e168a7bbe.exe PID 2844 wrote to memory of 732 2844 explorti.exe 4e168a7bbe.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 732 wrote to memory of 1988 732 4e168a7bbe.exe RegAsm.exe PID 2844 wrote to memory of 4536 2844 explorti.exe c0165c0251.exe PID 2844 wrote to memory of 4536 2844 explorti.exe c0165c0251.exe PID 2844 wrote to memory of 4536 2844 explorti.exe c0165c0251.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 4536 wrote to memory of 2128 4536 c0165c0251.exe RegAsm.exe PID 2844 wrote to memory of 4376 2844 explorti.exe c0e71ae5de.exe PID 2844 wrote to memory of 4376 2844 explorti.exe c0e71ae5de.exe PID 2844 wrote to memory of 4376 2844 explorti.exe c0e71ae5de.exe PID 1988 wrote to memory of 376 1988 RegAsm.exe firefox.exe PID 1988 wrote to memory of 376 1988 RegAsm.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 376 wrote to memory of 1952 376 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe PID 1952 wrote to memory of 4548 1952 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe"C:\Users\Admin\AppData\Local\Temp\fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1000036001\4e168a7bbe.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\4e168a7bbe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e142ed86-32bb-4469-bee5-d0457de47970} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" gpu7⤵PID:4548
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c101858-4bef-4bbc-8381-3f9659cbf535} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" socket7⤵PID:3464
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3148 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 1764 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7891985-f618-495f-a140-adcd23dd3760} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" tab7⤵PID:3980
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 3956 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcd3331e-0f60-4563-bdac-e4839ae322b5} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" tab7⤵PID:4540
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4756 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4872 -prefMapHandle 4868 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3f06a18-446d-4eea-94cc-ffffb900ebac} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" utility7⤵
- Checks processor information in registry
PID:5324 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5376 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {543370d0-e1d2-494b-9244-05c904dcf856} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" tab7⤵PID:5928
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5532 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0b0d430-5de1-4e3f-8493-1edeefd20ad5} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" tab7⤵PID:5940
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5708 -prefMapHandle 5712 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34bced98-f471-4555-bd59-0a731ad276d4} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" tab7⤵PID:5952
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 6 -isForBrowser -prefsHandle 6264 -prefMapHandle 6272 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20b029c3-8904-40f5-b95a-db669ae42829} 1952 "\\.\pipe\gecko-crash-server-pipe.1952" tab7⤵PID:1460
-
C:\Users\Admin\1000037002\c0165c0251.exe"C:\Users\Admin\1000037002\c0165c0251.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1000038001\c0e71ae5de.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\c0e71ae5de.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5c517a16cad16c5e0c292b87459904463
SHA1365366d46a6968858a7bf4bf647dfba0a4f86fb1
SHA256a56607fdaaa6e4d157c0217277c6fa06d9586b899991c6ce63b1fc07e65253f5
SHA5128c5a6227cc59d6427c65af65df683e928446a546f22d218711efc39f792985321a3602decd3153aa2aff3f3320db76498c1ec8b78ab66d87b418725face1763e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json.tmp
Filesize41KB
MD55aa2028e5ab41e434b91a153ada4188e
SHA1b0be7e8aa8f6ce985542fbc457485c78c8304eaa
SHA256f2b9de683e1dc746f8b3df39a6372b51ee1a7f9a1a864d35241f966096fbddef
SHA5127517d871ab315a8962c1c12e5f3b3074904b457758cad2e755e6e18772075d4d196025a9ee14797873e498aa480102326a819d217dc45ce07ca9109413350d9b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD58ce7661ce92275723e56cdc8eb3bb5ab
SHA13326d33446d236339b8ba1db935904a7b5a2f216
SHA2563d3ca1dbbd354b0132b223f3685858c72e4ac396eeedac8a4276cee9142f129b
SHA512990c1751429a5fbcd5df28c2dbf02252e49edfd8e7d75e963084551f604a6eb125d3c0a4a0ccfce93c914f645b407cc7d98a46864df77057d97fe36bf7bc9b9d
-
Filesize
1.8MB
MD5861c827245b68e21c35816cb416fa6d4
SHA14c06e785acf8ea9f53e8ba470e1cc35fa540912a
SHA256fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767
SHA5124cada1de9609b61165ad264c7bd0eec89af9889a9a9b7a00f0d3ff70562d8a6e059d08cf4ea1822e551fb9d196a23649432484e5154975c8e7323907ceb1c4c8
-
Filesize
1.2MB
MD548b5ab06fc6c239042cbd781de181b76
SHA16dce492efc83af4c095f1241bcef25ab8f5325ff
SHA256b1014616377807fff543066ab856642605205444f3d983409c2acf4cf98edde8
SHA512a5ef148fe29a17cb0d30ef286f59b2b9f54952cd65a7121e2320bf61dce9e831de56f099203d128296334d9a404f8b3c611e80b7d925397655d02a0ba7137c62
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize10KB
MD52466da4f9fa94891c08f3b080d7d3257
SHA12a7fb0b5a749639ffe68cf62d08d3990789f34d7
SHA256d1b80d7ead7e726f70602235b6ea87327385d948087332339a32ad28c32c4b01
SHA512c13d7f6935168335dfae5e0256d837a28c77eca159eab24bdd1f289266baf23e1e2a443128d7bba26b3acae94b4348c2b86ee9471e48ecbcdac1584e8d22532c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD58fe37f928b9cae28989c1d7385531626
SHA1957023965e0d01d54b781fdd9f17ec6eb1b01ce0
SHA2563e79fb76bfdef08a5f0bcfda924a962e194ea9841bae709b04c4da47a6d16b76
SHA512d7a51d92577db32e9676f22692916465639e559dfdeb1f990e0008570a530ec0124dd8a1b503983e33a37232c7238e137646d3b3c6ffe158c528ea2755bb9b05
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD584395100df6ae2f064ac72ec65e34133
SHA101c1cf645f8b1fa6ba84523943cbc65df71708c4
SHA256a6b58e4bbdc3e0fe7e93f171894039ed14877b5ecdbba23a58852acb1daff1e9
SHA5129a40008d0f48b628ef4702774e558aa709f0d8e728f2477dfdf13dad943b370ffe74e0ab27b0752df2b3fe08c2c2d3f826a6a561c4420c038dec50817007e65e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\98737148-91a7-4565-9013-b9a7fca788e2
Filesize671B
MD57dfede37539e5961e6f503c8c3ffb6a1
SHA18f5ce2f93927e21af776c7ea316e9af85a28a93f
SHA2567d2b88030cea23e5ea2661bacca9ee7fb9500412188b0a48bfeefeead9a36799
SHA5122133ffd0bcadae2584cc31687714bdfec34bd5236cedf3f47e20da254b8ac950014285f5891e2863d62541d0fb141d025d9c77434bbafff9dd8b1877c19ccb26
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\cef6825f-4d6c-446a-ac2d-e811d44ba087
Filesize26KB
MD57e96bf7153d288ef737bbc01c4d93bc3
SHA1f6dfd856a01005937dc41174cf837a516a661be6
SHA2562d6d23b67930b1e89acd0586468fbcc9a0642d8e74536a3fb0ae62dcaae5d7e7
SHA5128edffbe3d89c15a846a8754f489adcc6158d327767c49d868c6346e6f962efd01a45a320f90240e7f4e8c5b5206d32c50cf53f038bcc1290b585fb5c47fb39c1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\e1771e71-608e-41b9-8863-1717b05870f5
Filesize982B
MD5dec6999d066c68c9ec1ff9064ad7a83f
SHA111fe254304678fd33099351f74639863d76f2024
SHA256a10a43108b1dd8a0e78c8fe205218c1735554bf25112f637666994a5f3ea0f77
SHA5126f953e3c3b70a2e5c7794f8ba3f45c3ac9aa8e0e441a88b49358815261a38f1097a84ea905caaceb2484097ac749d5395e99ab781e04e85e54296789d6ff671d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD57731323278ab3ee3c66873e43469931f
SHA19e56ce2e8b5a897081e814df56aec7bec971efff
SHA2567a3f173c4d99d04852a57040aac68c499b32426966975364c0b67e7142299415
SHA51232d80dc12fa6f0974dff77cf9319f678ca636df004133610ecd0a34708d04e28ba089f0dd08882c5493097c45e9d7f5f57677d94a211361f22d4d6b58c4efa07
-
Filesize
13KB
MD57bb21af80a734b707e20a28b34db43c8
SHA1060be88ce0e04b9ebd9131c1fcf4d6206d5b8ec2
SHA256a11506c02386f7fb6d38dcaddd3f304301844fc853e5a45f74cce013ab553a1f
SHA512fe643482d7c12786d0dba4c67f82a429e085788f245bfa1bd54dbfaaa45e98350681d6790ddcc9e4ad5d685ce31ccd2ac7229750b7f361e7873d5651e79607cc
-
Filesize
16KB
MD57b6c91699288a52261b59ce58f4c81e0
SHA1ec3cafcba799f3595cf3479d00724a99df9928e5
SHA2560fb361ab1c3948992adf97904047451f986b4736edab4e5ddfa94f397105ef06
SHA512793d9a9baaa49ccd375ca3b7b41b5fffc4ce673f99d9f04bf6c81a3325f7ff6e7b2c404091a66cb5cbc617076c3dca9d33e9c0298891d24e572c8fcfded80277
-
Filesize
11KB
MD5e11cc5aacd5127d5592012cdacf42430
SHA15bf86d3b20de67cb31381f134d3df3482e73350a
SHA2562dfde8fb08ccd9291804f224cdfe386f9ea749d997b793d1f1c9b26755ab7f0d
SHA512a103e138d221976620d13404e58ab95496415edc490b0b151d311896bc8cc5dee79a7dfc2544ac3910a7250255b480e36feab4391ad8528197e3879a91da2f54
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.3MB
MD509fff090a5a022af9b1de22ef4946598
SHA1009a57183b52b7b9a62aed3d6c72c97599104598
SHA256b067a2944ce378446047170699b55f80e982a38f0893e7f7ddf82741744b2871
SHA5122c145e987bd7f0e7e46e91b133a33bb772ae8903ed3a70a0afbd835aaf25c564bff18a5cc0f3c244dc993563da18be1fd38005a92b7d9f4c1fc787b15fd3e83f