Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-08-2024 15:44
Static task
static1
Behavioral task
behavioral1
Sample
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe
Resource
win11-20240802-en
General
-
Target
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe
-
Size
1.8MB
-
MD5
861c827245b68e21c35816cb416fa6d4
-
SHA1
4c06e785acf8ea9f53e8ba470e1cc35fa540912a
-
SHA256
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767
-
SHA512
4cada1de9609b61165ad264c7bd0eec89af9889a9a9b7a00f0d3ff70562d8a6e059d08cf4ea1822e551fb9d196a23649432484e5154975c8e7323907ceb1c4c8
-
SSDEEP
49152:6IT2PAGMlNLDZf2YDJOZBVXYo+HCLnn2Vfhy:6ITY0NfVxIBVoodj
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exeexplorti.exefd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exe617aee0b32.exe45dcfe3d20.exec0e71ae5de.exeexplorti.exeexplorti.exepid process 3068 explorti.exe 2212 617aee0b32.exe 824 45dcfe3d20.exe 4564 c0e71ae5de.exe 5516 explorti.exe 2764 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key opened \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\617aee0b32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\617aee0b32.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1936-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1936-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1936-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exepid process 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 3068 explorti.exe 5516 explorti.exe 2764 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
617aee0b32.exe45dcfe3d20.exedescription pid process target process PID 2212 set thread context of 1936 2212 617aee0b32.exe RegAsm.exe PID 824 set thread context of 1660 824 45dcfe3d20.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exedescription ioc process File created C:\Windows\Tasks\explorti.job fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c0e71ae5de.exefd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exe617aee0b32.exeRegAsm.exe45dcfe3d20.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0e71ae5de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 617aee0b32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45dcfe3d20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exeexplorti.exeexplorti.exepid process 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 3068 explorti.exe 3068 explorti.exe 5516 explorti.exe 5516 explorti.exe 2764 explorti.exe 2764 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1564 firefox.exe Token: SeDebugPrivilege 1564 firefox.exe Token: SeDebugPrivilege 1564 firefox.exe Token: SeDebugPrivilege 1564 firefox.exe Token: SeDebugPrivilege 1564 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeRegAsm.exefirefox.exepid process 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1936 RegAsm.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1564 firefox.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe 1936 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 1564 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exeexplorti.exe617aee0b32.exe45dcfe3d20.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 3976 wrote to memory of 3068 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe explorti.exe PID 3976 wrote to memory of 3068 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe explorti.exe PID 3976 wrote to memory of 3068 3976 fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe explorti.exe PID 3068 wrote to memory of 2212 3068 explorti.exe 617aee0b32.exe PID 3068 wrote to memory of 2212 3068 explorti.exe 617aee0b32.exe PID 3068 wrote to memory of 2212 3068 explorti.exe 617aee0b32.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 2212 wrote to memory of 1936 2212 617aee0b32.exe RegAsm.exe PID 3068 wrote to memory of 824 3068 explorti.exe 45dcfe3d20.exe PID 3068 wrote to memory of 824 3068 explorti.exe 45dcfe3d20.exe PID 3068 wrote to memory of 824 3068 explorti.exe 45dcfe3d20.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 824 wrote to memory of 1660 824 45dcfe3d20.exe RegAsm.exe PID 3068 wrote to memory of 4564 3068 explorti.exe c0e71ae5de.exe PID 3068 wrote to memory of 4564 3068 explorti.exe c0e71ae5de.exe PID 3068 wrote to memory of 4564 3068 explorti.exe c0e71ae5de.exe PID 1936 wrote to memory of 4640 1936 RegAsm.exe firefox.exe PID 1936 wrote to memory of 4640 1936 RegAsm.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 4640 wrote to memory of 1564 4640 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe PID 1564 wrote to memory of 2244 1564 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe"C:\Users\Admin\AppData\Local\Temp\fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1000036001\617aee0b32.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\617aee0b32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1844 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {098cf50e-dcf9-4123-bc7e-00988acab511} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" gpu7⤵PID:2244
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0f95756-6376-499f-ba18-97d995971082} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" socket7⤵PID:1096
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3276 -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 3216 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46701919-2e54-4df6-9871-ecd084bb3b6e} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" tab7⤵PID:1172
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 3984 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9628ed7-6898-41cb-995d-c57542b246f4} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" tab7⤵PID:2760
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4860 -prefMapHandle 4840 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1caf010b-cf06-4f0d-b9c4-c9f2712bca48} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" utility7⤵
- Checks processor information in registry
PID:4296 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5708 -childID 3 -isForBrowser -prefsHandle 5688 -prefMapHandle 5684 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a754ba1-c672-4a63-bbbf-c333dc35ec6b} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" tab7⤵PID:6040
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f094ad1-ecf2-459c-9a73-867fffc1039a} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" tab7⤵PID:6048
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 5 -isForBrowser -prefsHandle 5844 -prefMapHandle 6040 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7296bec1-a4fe-4535-90df-a6c20981a226} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" tab7⤵PID:6064
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 6 -isForBrowser -prefsHandle 6320 -prefMapHandle 5656 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86513bb1-df78-4f4b-9f6b-d2407c9b8f76} 1564 "\\.\pipe\gecko-crash-server-pipe.1564" tab7⤵PID:3540
-
C:\Users\Admin\1000037002\45dcfe3d20.exe"C:\Users\Admin\1000037002\45dcfe3d20.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1000038001\c0e71ae5de.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\c0e71ae5de.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4564
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5516
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2764
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5c517a16cad16c5e0c292b87459904463
SHA1365366d46a6968858a7bf4bf647dfba0a4f86fb1
SHA256a56607fdaaa6e4d157c0217277c6fa06d9586b899991c6ce63b1fc07e65253f5
SHA5128c5a6227cc59d6427c65af65df683e928446a546f22d218711efc39f792985321a3602decd3153aa2aff3f3320db76498c1ec8b78ab66d87b418725face1763e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\activity-stream.discovery_stream.json
Filesize41KB
MD59b58ce8e1c64281c46ecce4c13ce4c67
SHA1f22b8b91eb6ca136bfb2f44f3182200b57239ccd
SHA2563629f8d259e41990da05b9d2255dca2cb515c813de6adb42e9539c8041f2b56b
SHA51291eea225d2981b9f86dbe9fb5fce6b071c47ec8575394d239610d82aa9671dced715ffc274ce5b92376eb19ca8c09a84b9cec14e57b114bd9641a91538f06c9e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5dbb32a55ad6202e615e3764ec46f4d9b
SHA1d3ab634b6e83e3e7449f604a7ee1dab8c48aba05
SHA256a8c1a42a4c7dfaa5fdff3ae44d6362142217ebf3d6d240ce366f69c570bbde8c
SHA5121cea75cdc5a46cc938d276538c825f3e0130a028e87adad7f9612085f8724fd332c2d7f434811248dcd235bf930a8d28f57c358a9123be63b6df947e113b2712
-
Filesize
1.8MB
MD5861c827245b68e21c35816cb416fa6d4
SHA14c06e785acf8ea9f53e8ba470e1cc35fa540912a
SHA256fd45934026ab8e433af36c789b7f69a333893409aa38ca6b16450e55d27c3767
SHA5124cada1de9609b61165ad264c7bd0eec89af9889a9a9b7a00f0d3ff70562d8a6e059d08cf4ea1822e551fb9d196a23649432484e5154975c8e7323907ceb1c4c8
-
Filesize
1.2MB
MD548b5ab06fc6c239042cbd781de181b76
SHA16dce492efc83af4c095f1241bcef25ab8f5325ff
SHA256b1014616377807fff543066ab856642605205444f3d983409c2acf4cf98edde8
SHA512a5ef148fe29a17cb0d30ef286f59b2b9f54952cd65a7121e2320bf61dce9e831de56f099203d128296334d9a404f8b3c611e80b7d925397655d02a0ba7137c62
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin
Filesize10KB
MD5042ed14fb1d062370e491705b58b1ba2
SHA14b8d3b43106bfa4097b008aac4fed2b267dcbc8b
SHA25640428ffc548bd3155d5eeb0af72727ec6b073e7bf741fe13be5dee1bccc26317
SHA5127108f5c11c532de083dace4fbe2d1ad1aab30e8f67752d36a86c8e615f67ed2ab167371078075b862aa78b8ccca8fc5291e7089e8dd824818d965660e51ba09b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5f546a7f65a8bfb3f22a3796a269ceffc
SHA13fb424fa72f3b6201f7d2798757d6978910c719c
SHA256dab63144a30281dccb95bff4dce92580478392063689cae11e7d10224537fcfc
SHA51229d45ad609a7dae0b91a1fa36369c699abbbc9cd0caa65c7b6c347f7735a6ed5784835f078f19879fcc76c133f6fb95628969f18629659ad4324910e27c66836
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD51bf50daf911ea224f6c50fd66573c6c2
SHA1c4922f7047bae448986d3bb4305acd95229fd936
SHA2564d33cfd3cb7b25bc3cb85afd1b10025a5f16658c9a5078a6f249d203ec46af1f
SHA51206886358ca53a1f6e7847a594221fa6d0e760b006d1012286e01ad0b6036ef2a70f466da979db28eefa7751083611f7a2a66050cac4d0e22156eadf13834df62
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5b037a434f20ee4d9b39ce5a432d4829d
SHA1c323b2981b4005b620ea2db932c7de5f4842bd5b
SHA256ac780ee31112eb11a604c7de2acc4245959031fb4c5a634d1a1d125f472136ed
SHA512427ce825ca083208246f241f1403ad428b560d6ddbf183850948c4bb1a05779eabfc0e4bd0b7c9ff8abdd4a027108c5a19bdd6b8b1a202689d06129e9e35cd64
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD56909b0441097404dd097a15fe589ed52
SHA1a6e93ec2c984ecf24e75d53fe9f39804964b0b9f
SHA256830a6f5ba9350e98eb8e1422d7a99ae7874cc1905bd91b1f89d0dcb2c50eaf88
SHA5126ee065c8c0226397d45247b85814b274a221088de51e7bf68f6ead1da59d474c88e57ea21cbeef4ad13a0f8b1057bc170d714d6a4117403a1989e50ef354d2ca
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\01c924d3-ad08-4d3b-b120-003285fc135d
Filesize25KB
MD5ba58355ea7b78cb2005426d755caf1cb
SHA1b357f61e1de1f478d6c9a59e90692985059dda45
SHA25693276b4b9bb60a37e7fefad4833b9f70b1a6f64897c948934713da6175e360d3
SHA512da1e6e128535e66bcc9b9da04d45f4c3a309aa3160d99643f33904c707adf6a643c3b2d4e8a1004023631deb85fd922d705bf8c740b7cd78bc879468bf66e3f9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\29997873-947f-49d8-9508-0b3702fa2118
Filesize671B
MD5d52ec821280f2b0cebdaf821e8d53672
SHA13724d0723ad95074aa3db6845701262f23ad9d2d
SHA2569ceed5af441198affe0e0f6dbca2e7643face033b4de3464f981cc3a1bed1318
SHA512a057c8b971dadfd5c22de324921f595161666accba00fb1ac6bf978c46340a55fcc8e75cba8f3faf0924f39df6cc837bb8f2ab203097849807f2daa847c3930a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\82f4345a-5e65-4b99-bdea-ab58ab5fa673
Filesize982B
MD58293a0018aca15b363fadaf84f65ccaa
SHA1518cf51752a6c74b07a0d1c0f41002c313b2af14
SHA2565c702310a0c9f480f72b01b7d6a40bfa677c193b94a6a425485d28fdc1c2cdea
SHA5124688f07ab35bfed124bca5608105205a785e5678a9c31e596998bc289943e3a27e1be2d698c463ab6576fbe153d6cc00efd464d8f28791470e208a8daae30903
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD5079a9bba4548da58c016f30c7d51b821
SHA109709ac6849ef260316372562661aa22b77aae3f
SHA2569c0d22ed090755aea256b28fb98f89b06f2eab20e8ee255c0dbd043d03b64743
SHA5128ec1b6e9694a76f20e6ceb1019e386bb6459fdd4dd9be59003c47c4ad49e0197c7fc5e45317482c6698fa7101922ed094fc77f6e467b5d4319a9a41eacd2cd1f
-
Filesize
16KB
MD552b45fc8ec4d2571e123c16be735c7e1
SHA1df31f8508ff064fd8145d6253edf00c2f752d603
SHA25664fc9e18f2f0bdefa6c9eaa1daad6e57bef7ff9234ce667f14255fcadb51b784
SHA512742039dba2473501f522f4dec2f17a5434d0b282976db197bddbd5447b014b570fe1922127a2c71652cc50b326df3ceb136feb23157ae4517c2c8d324156c0ff
-
Filesize
16KB
MD5a38c04c7b6c70bc3300b9020f6aee076
SHA1cf68f503b6794ee280f46d9f9da986fbb8de1b51
SHA256ffb6073ddcafec3220b846abc80217925fb2d0c1a0ab55537d5155a1806e861e
SHA512347317fca90a347e06809092ed33a26965f2f82e1b467a62060c5724047b6da20767c83e954dd4ffe6763c16f4935eb43ef88e54c7fb70f7bcd24a5e78f1046d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4
Filesize5KB
MD567b3858c640ad2fd6b50603295e0474f
SHA13c1e4299564258d1969907d80bcac485c6ecbe41
SHA256e08964244c8316c7ebc215ba65eaf0c39578a24f36008c7796915cdc6a1f2eaf
SHA51256f86090d1b9b27fb979dd6a5eaf06b8fe8c93dd83657b78ac6851feeab69289aa5bd46de5a6620a2928a5b9ec5f305be03c9a227fc105c895ba37504ce54659
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.4MB
MD5dcf5021045907a2e1161c626d6cd3b97
SHA1cc0ff618ad7f579c75d30836ca3ed8d3d720db7e
SHA2560224bc07b552d2bf63b600cb809e413e0fb857ffa3a8552dc5d38bdd45d42205
SHA512693ab13f7283f98358d0507571f7c60c90caed135de2b9277dda08e3a8424c28f6f89f02069b77d3ef8716e683de75dcb6a2f77a47fa476e75e456c9790960c7