Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 07:50
Static task
static1
Behavioral task
behavioral1
Sample
d051474ba32beb9890bd6bdfd587d190N.exe
Resource
win7-20240708-en
General
-
Target
d051474ba32beb9890bd6bdfd587d190N.exe
-
Size
1.8MB
-
MD5
d051474ba32beb9890bd6bdfd587d190
-
SHA1
8a7d008fdedc8efd7ac43b071f0b1d9d4e3b2156
-
SHA256
7aaaa43f3cc9d0cf790dad8eac81af1eec005d5d04ec58e486834f0a43378593
-
SHA512
ca17f5aa86bd09cddfa2e52967f248d9f7245e66fe6018fd93d83e22f88a66c6da0558416171c3d9857776d60e15839a613ad8c23e2ffd1a904bca63731a669a
-
SSDEEP
49152:GatcTY1VPvW0gMW813PNMpGhs0PkAoox+jW:GatQ2x+YWQPW+VN4
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
explorti.exed051474ba32beb9890bd6bdfd587d190N.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d051474ba32beb9890bd6bdfd587d190N.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exed051474ba32beb9890bd6bdfd587d190N.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d051474ba32beb9890bd6bdfd587d190N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d051474ba32beb9890bd6bdfd587d190N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Executes dropped EXE 4 IoCs
Processes:
explorti.exec1d68db2a0.exe9c1186eb68.exe1848190509.exepid process 1720 explorti.exe 2916 c1d68db2a0.exe 2164 9c1186eb68.exe 1944 1848190509.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exed051474ba32beb9890bd6bdfd587d190N.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine d051474ba32beb9890bd6bdfd587d190N.exe -
Loads dropped DLL 5 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exepid process 2236 d051474ba32beb9890bd6bdfd587d190N.exe 1720 explorti.exe 1720 explorti.exe 1720 explorti.exe 1720 explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\c1d68db2a0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\c1d68db2a0.exe" explorti.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2368-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2368-51-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2368-52-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2368-48-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2368-44-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2368-54-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exepid process 2236 d051474ba32beb9890bd6bdfd587d190N.exe 1720 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c1d68db2a0.exe9c1186eb68.exedescription pid process target process PID 2916 set thread context of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2164 set thread context of 1688 2164 9c1186eb68.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exedescription ioc process File created C:\Windows\Tasks\explorti.job d051474ba32beb9890bd6bdfd587d190N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
explorti.exec1d68db2a0.exeRegAsm.exe9c1186eb68.exeRegAsm.exe1848190509.exed051474ba32beb9890bd6bdfd587d190N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1d68db2a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c1186eb68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1848190509.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d051474ba32beb9890bd6bdfd587d190N.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exepid process 2236 d051474ba32beb9890bd6bdfd587d190N.exe 1720 explorti.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2052 firefox.exe Token: SeDebugPrivilege 2052 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeRegAsm.exefirefox.exepid process 2236 d051474ba32beb9890bd6bdfd587d190N.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2052 firefox.exe 2052 firefox.exe 2052 firefox.exe 2052 firefox.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2052 firefox.exe 2052 firefox.exe 2052 firefox.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe 2368 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exec1d68db2a0.exe9c1186eb68.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 2236 wrote to memory of 1720 2236 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 2236 wrote to memory of 1720 2236 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 2236 wrote to memory of 1720 2236 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 2236 wrote to memory of 1720 2236 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 1720 wrote to memory of 2916 1720 explorti.exe c1d68db2a0.exe PID 1720 wrote to memory of 2916 1720 explorti.exe c1d68db2a0.exe PID 1720 wrote to memory of 2916 1720 explorti.exe c1d68db2a0.exe PID 1720 wrote to memory of 2916 1720 explorti.exe c1d68db2a0.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 2916 wrote to memory of 2368 2916 c1d68db2a0.exe RegAsm.exe PID 1720 wrote to memory of 2164 1720 explorti.exe 9c1186eb68.exe PID 1720 wrote to memory of 2164 1720 explorti.exe 9c1186eb68.exe PID 1720 wrote to memory of 2164 1720 explorti.exe 9c1186eb68.exe PID 1720 wrote to memory of 2164 1720 explorti.exe 9c1186eb68.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 2164 wrote to memory of 1688 2164 9c1186eb68.exe RegAsm.exe PID 1720 wrote to memory of 1944 1720 explorti.exe 1848190509.exe PID 1720 wrote to memory of 1944 1720 explorti.exe 1848190509.exe PID 1720 wrote to memory of 1944 1720 explorti.exe 1848190509.exe PID 1720 wrote to memory of 1944 1720 explorti.exe 1848190509.exe PID 2368 wrote to memory of 1032 2368 RegAsm.exe firefox.exe PID 2368 wrote to memory of 1032 2368 RegAsm.exe firefox.exe PID 2368 wrote to memory of 1032 2368 RegAsm.exe firefox.exe PID 2368 wrote to memory of 1032 2368 RegAsm.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 1032 wrote to memory of 2052 1032 firefox.exe firefox.exe PID 2052 wrote to memory of 1628 2052 firefox.exe firefox.exe PID 2052 wrote to memory of 1628 2052 firefox.exe firefox.exe PID 2052 wrote to memory of 1628 2052 firefox.exe firefox.exe PID 2052 wrote to memory of 2128 2052 firefox.exe firefox.exe PID 2052 wrote to memory of 2128 2052 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d051474ba32beb9890bd6bdfd587d190N.exe"C:\Users\Admin\AppData\Local\Temp\d051474ba32beb9890bd6bdfd587d190N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\1000036001\c1d68db2a0.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\c1d68db2a0.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.0.1328700268\1084139036" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1188 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35161ff5-cb76-46fc-bd92-95417f31fd65} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 1368 fceed58 gpu7⤵PID:1628
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.1.1233458885\1736123019" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea1306ee-7934-46e4-91ce-d960efb31554} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 1544 eaed358 socket7⤵PID:2128
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.2.1119926642\827854634" -childID 1 -isForBrowser -prefsHandle 2024 -prefMapHandle 1124 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b862df2-511d-48bc-8b23-54fc34584e80} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 1912 19fdae58 tab7⤵PID:2836
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.3.1622216041\430174540" -childID 2 -isForBrowser -prefsHandle 2564 -prefMapHandle 2556 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {390ca608-3fde-4764-ba24-f626912ff78f} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 2576 1c1f5858 tab7⤵PID:2240
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.4.1416224884\1595242534" -childID 3 -isForBrowser -prefsHandle 3924 -prefMapHandle 3920 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a56a828-fcd7-4a3e-9138-9f2dc7cbdaf2} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 3936 20ef6658 tab7⤵PID:776
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.5.60694515\379550003" -childID 4 -isForBrowser -prefsHandle 4048 -prefMapHandle 4052 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfc7977c-3458-49f7-b782-d326c60d13ed} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 4036 20ef4b58 tab7⤵PID:1740
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.6.1638735995\612409507" -childID 5 -isForBrowser -prefsHandle 4208 -prefMapHandle 4212 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fbbeaa8-5936-478d-b7da-f5cbd2065603} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 4128 20ef5158 tab7⤵PID:1808
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2052.7.505813574\1786568185" -childID 6 -isForBrowser -prefsHandle 4344 -prefMapHandle 4444 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 592 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2786f5f0-94a5-447b-9b44-5459e23a25b5} 2052 "\\.\pipe\gecko-crash-server-pipe.2052" 4456 1b3d0e58 tab7⤵PID:2220
-
C:\Users\Admin\1000037002\9c1186eb68.exe"C:\Users\Admin\1000037002\9c1186eb68.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1000038001\1848190509.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\1848190509.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD52c4259fdd59fc26f2f365501a0ef9da0
SHA133773ad2bcf65c0caa9b9ecac510f72313ebe285
SHA2566080c330d14f3a0b896ae3eed7e44b63f632bdb8d96e39dce5a179be2f06d362
SHA512295e85660ca4139456b884d30907a4cb4ff44ba07980472db3eaec70b8998ca1b956f91717e98f860507eb2e15286f4b188a5744e1be73cada50b6c51a55acf9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\39ptzwfm.default-release\activity-stream.discovery_stream.json.tmp
Filesize46KB
MD5c0b080e39c9bbcd602488d852f4baf6d
SHA114e31ff394ad8880e772a22fe9fa39a009c12501
SHA256ebd19fcac49b31a897be2b0f86f8c3ef99e3384893f266f00df4c90133ed7b5f
SHA512f6e11fd7d96f3f53860ab2f45ca7470cd5b6f5190726f0611fc0416308ef495901e936ed7b6c051503e737af68ce2f92202d31ede7b1564c1c77785cac7e90b4
-
Filesize
1.2MB
MD575a2d87eafbefb74dc8bab6fec16cac1
SHA1c3decd95d7e19c4dbd1d7b9e409eeb4861c6f369
SHA2560027e27dcdc31f32e1159f82034ce00169ec7e3b487999d95997c519e0e7d40a
SHA5121b6c9ad97b74f639d26fd6d3af7c218f04ef08b77f6d6a67c05350c2965941472592fc6cc9c878644e686532295a20cc23d95ca5db4b62a86ec440000079c5f4
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD592d4357da2d94314458ccd1e444d5c92
SHA1c1f69fe0d5b4f5b264a40fa2450cff18759a8abe
SHA256267ac139103186ab0f79a5b8b06d3b4e1abba86e24fcfe523d043caef2e2190a
SHA512d19f0089d782fb9ae41347d0b6251eea476b7320026e1311e41e547a7b1ffe89c94db9f401c4f00fbd3dc612879bc444ca3961ea941ee553c1510cbd087cef55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\datareporting\glean\pending_pings\8609d5e0-135f-4d48-b691-65073278339b
Filesize745B
MD5e21b16f9ff32bdfc7a9c183ade6082ce
SHA1adb83d034020748b1748d22df55d5290eda37ce2
SHA256f9302d53b1a3b82b9172f4df4bd0053ebb1d3d36ae9c9dcf93cdb66e010f97ba
SHA512bb365c524ee1f9773253785a272c516d20aaa21ad491f2d07eea7d64fa2b8eadc714d16210f60ccc5dc7317e4fb5e6931e9a98bf9336d433e6f3bbf54d2bc6fe
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\datareporting\glean\pending_pings\979317eb-0345-40c1-9cd8-631a81910dd4
Filesize11KB
MD5a0ea04288a9e79ce21270a23975be429
SHA14ced4876b29ae163e5b7523702685466e877fe3b
SHA2560406cf1213b524ca571d44d98864d3cef7bbc47ed0b5a01bdd1b45d070a9d55b
SHA5121c91b8cf471eacd90e436f28cdd0a3ccc70379bf91e09295a23b17b85f30778dc7bbe32fa02301d2ba100f361fce947836bda9934f092bff986ba7ea8e4741e1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5934d7ecd0d57153981d425c3d6e07eda
SHA1d2bbb71d65f97756c3453a3d281e479a944d0011
SHA2569110fc15f03e55d0a4c48c97db8ae6b59463a27de8a08b7a7fccaf6e53aee80e
SHA5122b19f5939a6b60d7e43be555ae084c301b56725a62f853a4fa661c052cfa13cfb461af538bddf769698c66f3eb3c5633097d48f24173f9acc2150cbd26b4470f
-
Filesize
7KB
MD5dc4edf29c641896a9317fd1f7320b715
SHA162e90bcea5065895c18828da3b0b92e32ed2d7e0
SHA256522dc4250e41e99fa76a4db594bb14cfb51ad1143e59fadb2ae873972f753999
SHA5121bb0f432e884bc1c2ac86f21dce90194ef6c2dc97850f433491f38adda44ee853dbbc0e19d4069224d0d9d7acdec5cbba27d0a06dc9bf8be42f87fea90a242c0
-
Filesize
7KB
MD5be6ff666fb6478d671ea04096ea65c66
SHA1cbbbd7405d7f0dd13af4c1561c02a6637c52e244
SHA2560a8f3750927df311474641a4395ad63d103f3b0d585e3da400ecb97a8ab8cc3b
SHA5124c1ca4963547b3d1900029ea2fcd939667f9578f76dbbd0e8625ca7f1a290bf5b18ba83f0584989aabd9b474733fe15b685bea268757d7d3c3fd37492b8c74ea
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5d5ca37c939f562a3dd1d5c0f5c1f5884
SHA1b4032b1a1c9c3ff124c6bf5b8a375daa0a11eeb0
SHA25683377f45c29b09b225ff65914dbbdafa3c30d3862772fd9cc33f1e93704c994b
SHA512b3c289dc65c76551e8697c66895e1f94a915699f7b24d0218cd44ab80f3db632ad76b88efe18315f6596007428c109dbe7ef987d63ac9fda5602276f85f5fc3e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD59f725cdb08f02bb356030d2a037d7de9
SHA17a82f277b77ce4dd7314cd78149f13a4b474e0c0
SHA25645e742b612e8ec8acc59a2c4bfb8579cdcb557add103b1e7e92a25280bab6257
SHA5129176059bd9809424591a9eb735d9b4d009cc6b123813075183bc4023c9b2ecdf4068fd0ba9fb2f9f2784c75ca3b69e5fbd994cf66c706e91865ec2d9d69770f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD51d87633c899ebb45778026c301d420f3
SHA17931aa594a96450488f4bd2d2be9b60a93dce5e5
SHA256b1f10b1b2b49f98c914ff552a5421c04140ecad4b2f14c41477b6bf060a73893
SHA5123f33d00cd23f32a089e283adec5233d802142d256b1ba810c466c379cbdb2b6decb20068256a30bcdca66d731670d135cfc4984dc4cb6791c3653c91915438f2
-
Filesize
1.8MB
MD5d051474ba32beb9890bd6bdfd587d190
SHA18a7d008fdedc8efd7ac43b071f0b1d9d4e3b2156
SHA2567aaaa43f3cc9d0cf790dad8eac81af1eec005d5d04ec58e486834f0a43378593
SHA512ca17f5aa86bd09cddfa2e52967f248d9f7245e66fe6018fd93d83e22f88a66c6da0558416171c3d9857776d60e15839a613ad8c23e2ffd1a904bca63731a669a