Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 07:50
Static task
static1
Behavioral task
behavioral1
Sample
d051474ba32beb9890bd6bdfd587d190N.exe
Resource
win7-20240708-en
General
-
Target
d051474ba32beb9890bd6bdfd587d190N.exe
-
Size
1.8MB
-
MD5
d051474ba32beb9890bd6bdfd587d190
-
SHA1
8a7d008fdedc8efd7ac43b071f0b1d9d4e3b2156
-
SHA256
7aaaa43f3cc9d0cf790dad8eac81af1eec005d5d04ec58e486834f0a43378593
-
SHA512
ca17f5aa86bd09cddfa2e52967f248d9f7245e66fe6018fd93d83e22f88a66c6da0558416171c3d9857776d60e15839a613ad8c23e2ffd1a904bca63731a669a
-
SSDEEP
49152:GatcTY1VPvW0gMW813PNMpGhs0PkAoox+jW:GatQ2x+YWQPW+VN4
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d051474ba32beb9890bd6bdfd587d190N.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exed051474ba32beb9890bd6bdfd587d190N.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d051474ba32beb9890bd6bdfd587d190N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d051474ba32beb9890bd6bdfd587d190N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exed051474ba32beb9890bd6bdfd587d190N.exeexplorti.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation d051474ba32beb9890bd6bdfd587d190N.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation explorti.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exe1848190509.exeff21617840.exe2de768c3b0.exeexplorti.exeexplorti.exepid process 2124 explorti.exe 668 1848190509.exe 1964 ff21617840.exe 5096 2de768c3b0.exe 5696 explorti.exe 5572 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine d051474ba32beb9890bd6bdfd587d190N.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1848190509.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\1848190509.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1240-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1240-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1240-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exeexplorti.exeexplorti.exepid process 4856 d051474ba32beb9890bd6bdfd587d190N.exe 2124 explorti.exe 5696 explorti.exe 5572 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1848190509.exeff21617840.exedescription pid process target process PID 668 set thread context of 1240 668 1848190509.exe RegAsm.exe PID 1964 set thread context of 1812 1964 ff21617840.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exedescription ioc process File created C:\Windows\Tasks\explorti.job d051474ba32beb9890bd6bdfd587d190N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exeff21617840.exeRegAsm.exe2de768c3b0.exed051474ba32beb9890bd6bdfd587d190N.exeexplorti.exe1848190509.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff21617840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2de768c3b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d051474ba32beb9890bd6bdfd587d190N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1848190509.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exeexplorti.exeexplorti.exepid process 4856 d051474ba32beb9890bd6bdfd587d190N.exe 4856 d051474ba32beb9890bd6bdfd587d190N.exe 2124 explorti.exe 2124 explorti.exe 5696 explorti.exe 5696 explorti.exe 5572 explorti.exe 5572 explorti.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 208 firefox.exe Token: SeDebugPrivilege 208 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeRegAsm.exefirefox.exepid process 4856 d051474ba32beb9890bd6bdfd587d190N.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 208 firefox.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe 1240 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 208 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d051474ba32beb9890bd6bdfd587d190N.exeexplorti.exe1848190509.exeff21617840.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 4856 wrote to memory of 2124 4856 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 4856 wrote to memory of 2124 4856 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 4856 wrote to memory of 2124 4856 d051474ba32beb9890bd6bdfd587d190N.exe explorti.exe PID 2124 wrote to memory of 668 2124 explorti.exe 1848190509.exe PID 2124 wrote to memory of 668 2124 explorti.exe 1848190509.exe PID 2124 wrote to memory of 668 2124 explorti.exe 1848190509.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 668 wrote to memory of 1240 668 1848190509.exe RegAsm.exe PID 2124 wrote to memory of 1964 2124 explorti.exe ff21617840.exe PID 2124 wrote to memory of 1964 2124 explorti.exe ff21617840.exe PID 2124 wrote to memory of 1964 2124 explorti.exe ff21617840.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 1964 wrote to memory of 1812 1964 ff21617840.exe RegAsm.exe PID 2124 wrote to memory of 5096 2124 explorti.exe 2de768c3b0.exe PID 2124 wrote to memory of 5096 2124 explorti.exe 2de768c3b0.exe PID 2124 wrote to memory of 5096 2124 explorti.exe 2de768c3b0.exe PID 1240 wrote to memory of 3452 1240 RegAsm.exe firefox.exe PID 1240 wrote to memory of 3452 1240 RegAsm.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 3452 wrote to memory of 208 3452 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe PID 208 wrote to memory of 4628 208 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d051474ba32beb9890bd6bdfd587d190N.exe"C:\Users\Admin\AppData\Local\Temp\d051474ba32beb9890bd6bdfd587d190N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\1000036001\1848190509.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\1848190509.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d82de824-9f71-4a24-8c49-ae5431fc2aeb} 208 "\\.\pipe\gecko-crash-server-pipe.208" gpu7⤵PID:4628
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7361c6b-4b5d-483a-9c44-499532a4b8ba} 208 "\\.\pipe\gecko-crash-server-pipe.208" socket7⤵PID:4876
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2996 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {839c0ae8-1547-48fa-8d8f-c7cfbba979c0} 208 "\\.\pipe\gecko-crash-server-pipe.208" tab7⤵PID:4816
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4000 -childID 2 -isForBrowser -prefsHandle 3992 -prefMapHandle 3988 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {280a9bbf-6ad0-4492-ba6e-5721084dc74f} 208 "\\.\pipe\gecko-crash-server-pipe.208" tab7⤵PID:2368
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4816 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4804 -prefMapHandle 4796 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99e79f77-df30-4e48-845a-6aaeab8e1958} 208 "\\.\pipe\gecko-crash-server-pipe.208" utility7⤵
- Checks processor information in registry
PID:2748 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 3 -isForBrowser -prefsHandle 5288 -prefMapHandle 5276 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22f10e89-a39a-4e0d-84e5-59e1b66d38d7} 208 "\\.\pipe\gecko-crash-server-pipe.208" tab7⤵PID:5748
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5500 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7175bb2e-1eb2-4430-b905-7495ddbd450b} 208 "\\.\pipe\gecko-crash-server-pipe.208" tab7⤵PID:5764
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 5 -isForBrowser -prefsHandle 5624 -prefMapHandle 5260 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca1ce26e-d076-41de-808d-cb4004b7e779} 208 "\\.\pipe\gecko-crash-server-pipe.208" tab7⤵PID:5812
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6192 -childID 6 -isForBrowser -prefsHandle 6168 -prefMapHandle 6172 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b97b3548-a7a6-4c70-a98b-80a270aea2c2} 208 "\\.\pipe\gecko-crash-server-pipe.208" tab7⤵PID:3620
-
C:\Users\Admin\1000037002\ff21617840.exe"C:\Users\Admin\1000037002\ff21617840.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1000038001\2de768c3b0.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\2de768c3b0.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5096
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5696
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5572
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD52c4259fdd59fc26f2f365501a0ef9da0
SHA133773ad2bcf65c0caa9b9ecac510f72313ebe285
SHA2566080c330d14f3a0b896ae3eed7e44b63f632bdb8d96e39dce5a179be2f06d362
SHA512295e85660ca4139456b884d30907a4cb4ff44ba07980472db3eaec70b8998ca1b956f91717e98f860507eb2e15286f4b188a5744e1be73cada50b6c51a55acf9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json
Filesize41KB
MD529c44804d1a160c589c1019097fa41ba
SHA10c4eeef03bca8de481c7658a4289b25302f204a5
SHA256f1854c6e4fc57146aa81387dfbeddda2f4311651e247872d747d0518d502bc45
SHA5123f85e3511b7a2649e1327c0223bbc31a82fc0b092c1506baa9d36d7991c5cc0f617d32fdd6b9a212338e44b9fb90512b7ce331d39aca9012bcc7031bd74a7c29
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5cc27b182efd20a20d141cc3266be586f
SHA1ed13c6861af9484ab1a076e012c0e05061d398f2
SHA256f684b0c1c6e8cf55a04e4f5117c74d58b204619544b040c117bb6a8f39979be3
SHA512e0e7f3b1f41e4d11be9a701fd38958b7cfc8e9fd508526bba31481b83348845eaca1d2b8008c8691c2edc8ffeb1d3d53ff97474a4227fe3ec936c09b7733461e
-
Filesize
1.8MB
MD5d051474ba32beb9890bd6bdfd587d190
SHA18a7d008fdedc8efd7ac43b071f0b1d9d4e3b2156
SHA2567aaaa43f3cc9d0cf790dad8eac81af1eec005d5d04ec58e486834f0a43378593
SHA512ca17f5aa86bd09cddfa2e52967f248d9f7245e66fe6018fd93d83e22f88a66c6da0558416171c3d9857776d60e15839a613ad8c23e2ffd1a904bca63731a669a
-
Filesize
1.2MB
MD575a2d87eafbefb74dc8bab6fec16cac1
SHA1c3decd95d7e19c4dbd1d7b9e409eeb4861c6f369
SHA2560027e27dcdc31f32e1159f82034ce00169ec7e3b487999d95997c519e0e7d40a
SHA5121b6c9ad97b74f639d26fd6d3af7c218f04ef08b77f6d6a67c05350c2965941472592fc6cc9c878644e686532295a20cc23d95ca5db4b62a86ec440000079c5f4
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
Filesize8KB
MD5555f478b885cfd2dd35c005888062519
SHA18a5f2d69458025191f79f1e08a23c88a00e62356
SHA25655f9defba4c651c72fab20ae5bcfb96c3fd19253dd9c58e0f077bb816a253e11
SHA5121e5693bc58ee08905ea0e159580c8f5a4ecbeb648471186c33e7acf0c81a71734112c59b3d4849854314f77f7150e78110dde53a19d5d4e5d5faca436364722f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize4KB
MD50bea0485ae4f385a62fd283d23ac72df
SHA1f38d9afec0d18e52c6300013060fe9e02882f965
SHA25633bec790e512ef14da50e7dd43310e5fbce1283d15c7989e079cfc7480683c1c
SHA51208fae0c992f78292a863a46f4129283b8f4a3dde8a62de10b8ff9b25fe0b727bca32fab417b9e65e26eba59163504ac7b68a39324189a3b08a399d8c7ccd3977
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5c3da2d59a2daaaf042e9df048af83076
SHA1c744fdd12a9e99ee89c8f402d46ca530a2875998
SHA2565b8131f16f2a0ef358c8d0b05afc75c7ebbdca1d77eeb22b0e21dc606348a62e
SHA5120b9315327ba47d2f7864368e094847f981a6e9f010fccbfe08f4e71d8cf1f886260ef409300e6b1b173bb7b7c2d54d739c8f39643b3b2bd4cb4043dbee400037
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5587839e97c0cd15dbe2b11e38c85349c
SHA160b0e1fbe7e93229c219c4f151f7f0e59f04cb85
SHA256cd5553537ee5d95540eb367e57287851c5180c20901a6c002b7131625c0a0f7a
SHA512cc78f61a1cf7c43da6424c89c53c448a386cbc73e819f6b0226c52fccddd2a769fdd8695eae540bd51c61224b62ff0137795d25d94e923c2d721d9920519bed1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5434d6a5c911a1708687427cea5ab8add
SHA1b3d81e8acf0f9b37b9c1021defa69970a897910e
SHA25621bb1dbb73d12c902e5530657d6052f74354ad880adfa8c5875df28a9ba8ca31
SHA512962b4e62fcac4181b7f79a021e958722945f0de589f055861c7012525eb253dc52dc3a647178cf28c12a89b1bf1b4cbefa52a23c02887b9ebe6d15897b4fd9af
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5c1da63efb21c158f5547273591c2b919
SHA11b2ff6e5d76b742e29956b48b61fd11b9f9d511a
SHA256913bb79adaf8f33443ff866d8460e1fa8b468bd56b4476b0c6b4a3a59621c8ca
SHA51297d14d0bc109000384037b61b6ad9148348674cb47c379ec56544734f8805c31b3ec83ffaf589cfefbe60e3b71fd6105b6f68a3c5cf2890fa98bbbbfe95480ef
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\3c0517b4-82e3-4f63-826c-ec64fd7a5185
Filesize671B
MD59a9f136021b92378ad3f63f9bd798569
SHA1fc1b5b62ccf08e64d4de2aaee6fd69a91ee92ec5
SHA25638cba3f66d5e38e2f5b4af85c120844ddc6c962d77c7ed2ead68dbe272569fb6
SHA512914412e24a940cc7b3dd5a8d5294c2b4830b60ca41ea37cf31207c5b843335c1e225e0f089310007efdb6a76c9295cd2042851aa1afeed96ea0639d2d1447b45
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\8a37fe27-1704-426a-af72-e69a3a21675b
Filesize26KB
MD57991e57a86567a64b6e1ad8893e739f6
SHA14169aa24c91ab17139ad5bf7186e96c51df8b2f6
SHA2569c4bd9591e59c8154409f82d1735fcb431ce7e225913171afc51efdb9b54c0f2
SHA512af2d8dfd2e6de04d32802a8b965beb87ad69b62b052cd047e57104bbeca9e7d6e780da0716e02ce706eb017eeed3ca42d2c87cea5f4e44c31b2cbc737c768168
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\c34d13ba-08a1-4f7e-a25d-066fe58c0a4b
Filesize982B
MD5a84d8b2ed501dc49e035fa2bbb6517c9
SHA1d8b2311507fb359f35bd04fa5f81397fa3c18515
SHA2563cae1a049aa300c46d09bc458b313b495372a66c5108dbaa43965187ce753592
SHA5123736cc73a4dbffb31c6854764d2483fba66b76239dc971c0782e771abba0951c3a4276bb7526259032e0ff11d060d271708d8d7bcf19d47a2aa1b66301219c68
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
15KB
MD5f8a4c24b1b6a8c6c6031743ccdec8a16
SHA1ef1aa54e79f366c3045b097094ddf342dbe71448
SHA2569ec04aba5aacef03f1e413075dbb61569dd990697c5f1e3776d15020fd55dfe6
SHA512d5e7e17c036f58f56e7cfac9da591fec4b39f22ff915fd287f560a300a3f795213583c945aa48632efdb32a33cd5c6dce65a6820aa82142e10903382cbda47dc
-
Filesize
12KB
MD52d355db19309ce2b613d0a91a797f3a8
SHA106e5d606c3e0b192799072e67318a9842193eaf1
SHA25698d094baa6fab16b16e6072e5e464baf61bc2deab213b3bdf6a5378c9f7d4b49
SHA51201ad507749f2a8db8cd61fe68078a8c33f8964df93807b8294a64360004fd45c77ef1f6533089c71535a97ddb463b96e2074dfa21da04ca361f51b37ddb6b92d
-
Filesize
11KB
MD5655e4ea198b8854d210e7d2b57435497
SHA1a6dd377a18ed3c5206b11387e0cfc28ec9b63b18
SHA25655faa436e32509097e5ca26f08cd3bf407ebcb8462ba934694b064397ca93b4b
SHA5128e4916dd3c0dd98f5a5fbc5d2c2a46ac5b74b73565fc3a14d75c59d6aa3644d6fff5c4529f492ef4ce981b084369d889bfac76b88a193ba4c7050f465b083e36
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.6MB
MD548baee34abdc24812ce42735764288f0
SHA17f228d6a452d5a8c929fe5f6ab1fc33aaf5b106a
SHA256d4ab0a53780797a72093b33ee44f4a81aeb1663ee2fc624ac85d63de553c28de
SHA512e38e5432a29fc7d9c817b2c3e4eade705e3f7c0ecf0c27e5d5c774f90677bc988df48c909a4d3d9f916ce4a542a9c397debddaee0e50a5ad7712b79ba799bc0e