Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-08-2024 19:09
Static task
static1
Behavioral task
behavioral1
Sample
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
Resource
win10v2004-20240802-en
General
-
Target
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe
-
Size
1.8MB
-
MD5
51f1d63e0011310e16b9cc937dff061c
-
SHA1
689bfbd2b6fc118f96bb10ab74ab486685ffa2ea
-
SHA256
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c
-
SHA512
b8a349620081882e69cdbddabf3c4add96e4397fdfc5c3c4548c678a435ae250614bae90d4e1c199c913d229e3c4fe1dba694851ee991462537b1297f03c114e
-
SSDEEP
49152:pIqkCmwbn/ZzKQMPs7CdcaogKtw2uFpkQUUz:KqkCPueCto+2KpXU
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exebbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exe9d41b70e48.exe8a48d19e10.exe0174d3c890.exeexplorti.exeexplorti.exepid process 4088 explorti.exe 4220 9d41b70e48.exe 1916 8a48d19e10.exe 1436 0174d3c890.exe 3400 explorti.exe 5300 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exebbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d41b70e48.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\9d41b70e48.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/3056-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/3056-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/3056-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exeexplorti.exeexplorti.exepid process 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe 4088 explorti.exe 3400 explorti.exe 5300 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9d41b70e48.exe8a48d19e10.exedescription pid process target process PID 4220 set thread context of 3056 4220 9d41b70e48.exe RegAsm.exe PID 1916 set thread context of 4888 1916 8a48d19e10.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exedescription ioc process File created C:\Windows\Tasks\explorti.job bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0174d3c890.exebbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exe9d41b70e48.exeRegAsm.exe8a48d19e10.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0174d3c890.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d41b70e48.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a48d19e10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exeexplorti.exeexplorti.exepid process 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe 4088 explorti.exe 4088 explorti.exe 3400 explorti.exe 3400 explorti.exe 5300 explorti.exe 5300 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1768 firefox.exe Token: SeDebugPrivilege 1768 firefox.exe Token: SeDebugPrivilege 1768 firefox.exe Token: SeDebugPrivilege 1768 firefox.exe Token: SeDebugPrivilege 1768 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeRegAsm.exefirefox.exepid process 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 1768 firefox.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe 3056 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 1768 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exeexplorti.exe9d41b70e48.exe8a48d19e10.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 564 wrote to memory of 4088 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe explorti.exe PID 564 wrote to memory of 4088 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe explorti.exe PID 564 wrote to memory of 4088 564 bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe explorti.exe PID 4088 wrote to memory of 4220 4088 explorti.exe 9d41b70e48.exe PID 4088 wrote to memory of 4220 4088 explorti.exe 9d41b70e48.exe PID 4088 wrote to memory of 4220 4088 explorti.exe 9d41b70e48.exe PID 4220 wrote to memory of 4880 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 4880 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 4880 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 4972 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 4972 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 4972 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3632 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3632 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3632 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4220 wrote to memory of 3056 4220 9d41b70e48.exe RegAsm.exe PID 4088 wrote to memory of 1916 4088 explorti.exe 8a48d19e10.exe PID 4088 wrote to memory of 1916 4088 explorti.exe 8a48d19e10.exe PID 4088 wrote to memory of 1916 4088 explorti.exe 8a48d19e10.exe PID 1916 wrote to memory of 1812 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 1812 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 1812 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 2000 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 2000 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 2000 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 1916 wrote to memory of 4888 1916 8a48d19e10.exe RegAsm.exe PID 4088 wrote to memory of 1436 4088 explorti.exe 0174d3c890.exe PID 4088 wrote to memory of 1436 4088 explorti.exe 0174d3c890.exe PID 4088 wrote to memory of 1436 4088 explorti.exe 0174d3c890.exe PID 3056 wrote to memory of 564 3056 RegAsm.exe firefox.exe PID 3056 wrote to memory of 564 3056 RegAsm.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 564 wrote to memory of 1768 564 firefox.exe firefox.exe PID 1768 wrote to memory of 916 1768 firefox.exe firefox.exe PID 1768 wrote to memory of 916 1768 firefox.exe firefox.exe PID 1768 wrote to memory of 916 1768 firefox.exe firefox.exe PID 1768 wrote to memory of 916 1768 firefox.exe firefox.exe PID 1768 wrote to memory of 916 1768 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe"C:\Users\Admin\AppData\Local\Temp\bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\9d41b70e48.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4972
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:3632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1844 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {acc90ddd-f613-41bc-a073-1dc11983d1a4} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" gpu7⤵PID:916
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9738bf46-2548-4d20-a434-01bb573c436c} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" socket7⤵PID:2656
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3100 -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3124 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be8bc953-bcfc-4308-a7ff-8339fa3ed82f} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab7⤵PID:1096
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 1072 -prefMapHandle 3780 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dccf7bb8-7b58-4a92-81a9-9f996b4a1833} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab7⤵PID:4212
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1636 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 912 -prefMapHandle 4780 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b6051a-ee95-41c6-8dd2-0057f0cfeb33} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" utility7⤵
- Checks processor information in registry
PID:2896 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 3 -isForBrowser -prefsHandle 4284 -prefMapHandle 5612 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a279e46-08d4-4b7f-9a08-fb96371ec5bb} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab7⤵PID:4152
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 4 -isForBrowser -prefsHandle 5796 -prefMapHandle 5892 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a53c1451-3746-43bc-88f8-a4f7286230d9} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab7⤵PID:1188
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6068 -childID 5 -isForBrowser -prefsHandle 5984 -prefMapHandle 5988 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bebc5953-9b74-4f35-9455-d78be0fec795} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab7⤵PID:1912
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6176 -childID 6 -isForBrowser -prefsHandle 6184 -prefMapHandle 6188 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ff7ac8c-52f8-49bd-acd9-a25d03ada96c} 1768 "\\.\pipe\gecko-crash-server-pipe.1768" tab7⤵PID:244
-
C:\Users\Admin\1000037002\8a48d19e10.exe"C:\Users\Admin\1000037002\8a48d19e10.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:1812
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:2000
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\1000038001\0174d3c890.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\0174d3c890.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3400
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5300
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD544f3a5221b50fd602e29fd927f8b6e23
SHA149afe6aea1fa8ce4e6340f0b2a5f9cf50e07ca63
SHA2562bc4046f376f48ec3c3456cefa45279a0f187b3d5eef73768b48eafce424b807
SHA512c50972890fd2bfcecb6774a0629d16ff55ba0f8a3006cdbcfb088e91cd538b454e23376fe29ac871590336ab54295e7d47b24f2fb67fc24ea6755f66a3316516
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json
Filesize32KB
MD53e062633c98c192f464d5d43900233d9
SHA143f1f7ea91b56d480898c60e90287421d4cea4ef
SHA256140060876bf869c1d1c68a75db82a37ef6d22a79c6e6a028eea4bf9615f6c941
SHA51292912e0cd3ee950262ad3f4e59fec9d0f23784ababb1cc8089e63f65c4122e56342c26a95685710d404f1c39f7ebc50c928e31d34dfda5e343a09fc4784adbeb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD53c42cd9ebfd99fd91c614d271d6dd1aa
SHA15362ce9cac19e3568f44bea670265cc5ac20f464
SHA25691a5dd838d21f5800a827088e0fa8667daa153d2b78b5ff6d592e88c373e6cc4
SHA512fe2349a811e565a91a0d0bc5049adc49e6d66eacf3912b793d69d785b5be30954047d34af1258024ecfe151137fe677543f884c749f585dd7d0d21524e991cd8
-
Filesize
1.8MB
MD551f1d63e0011310e16b9cc937dff061c
SHA1689bfbd2b6fc118f96bb10ab74ab486685ffa2ea
SHA256bbaa6d9a443b8d2c74ac44dc498347db9b1286a931dc0f7c900e0570352af52c
SHA512b8a349620081882e69cdbddabf3c4add96e4397fdfc5c3c4548c678a435ae250614bae90d4e1c199c913d229e3c4fe1dba694851ee991462537b1297f03c114e
-
Filesize
1.3MB
MD5f8a0a57e59145dbc07e9eea86c379910
SHA1d8f641d14b80d262f999b912a8fb1a6735913885
SHA256ba43aa294156e377ae6a0aaee5006b9af062533a1a6089ec873d5c091d706934
SHA512ec556386c343c6db714b189bb404a1db161aa8d0c75768abff2a0755e21d3ac18b6212af0237dcb141d3b61ae665005bc53dc162a5bf47d49b67fbb27e5e726c
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Filesize7KB
MD56e72a0d6ef96e902c992d8e26119089c
SHA1ea9cf2ae5739a34a23e950fee89ba2cc5221c329
SHA2561b5efcf08372bba12e58e8e61f35e12da4eed4d4bb534bbeac81f84decf7f05a
SHA5123ded838fca82101e1d70c87c0f709b389b3382534665d75d0e17a508ac6f626498427f601722ab03aaf5da6f65c3300772ce3e647ae98e838f15e6113e53b39e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Filesize10KB
MD54600b91072aff79d04bc38b00416dd63
SHA1e3f2d02b619916f730c5dc85feed10f2df60030f
SHA2565de186b5083b6beb9ec10fe60fc7f62009e0d2f81b1d48484cfa74f4016a5e1f
SHA512521d6ffeba29ca4269e7681103bbea6c6e078c01f056c9ff6fc1bc689f73472a365dc63a285720a411ffa10594aa942d98ec2de24554526de697f33ecb6d1765
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin
Filesize11KB
MD5c0f4b313fe72a4e42fdd672dd6bca387
SHA16845111d0485a814d41756e5810f83fafb1eba8a
SHA256361e1aced07a85614cf3bd0a8c1060e3411e85177d67e98aa13c04e3b92f0ac7
SHA5128d25e2f1f1171983b6ec7357e41f9eba4d0ac6d24340df18da439b1f9ee78e94819caa8de6d23ff880210a8bcadfaa59ccf0a4191d5c3646c44854a93958bdcc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD53a8da9a972ea7e8ffd15b838dad113f2
SHA15da6edc83189798fe22cdecb553383cf4ec3f3dd
SHA256afcf43ec0257cac65765543a46679f301d329b8451197b6abe1d2d3238fc99df
SHA512c0d3fb9434e725226669b343c7a3f2342286daaf9b099fe07fc5c37788dba470d8984ed9bff773d2e7339a1da9ae3b3a1972c3704c403fec92a0deb101df2b7a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD56c6c516ff566f0a7246ced9b49c279e4
SHA1fee7da7f4673c4db535bd4a466663dc74ddf1d41
SHA256ce12bd050aef792f975620b06c10c15cf4b6e0f3bc1cb3a7df55ec8450382827
SHA512dbaf0e442b138dbcb792b937daca821b57a25a51557f28ee13fd2bacc76585a6807981f11b2f8a5f3fb2a62eaf1b0b896fffd36c7a49b4e5b956e6d04e3e7515
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD57d3f1d5b31947cf6c882b4907d6182a7
SHA141723d956cfbb6e818642e65201ba673a10b1141
SHA256bb2a9230db595b0572f46593ebf8a19e543b7814713ab14a0bfe22d28ab40c98
SHA5126c42b4be37dbe87159a0674a86060b6d74c9d5a743229bb4a9ba3c1ef8679ccf6afb0f74928ad6025d6ede913d0e552a5c6dd3eec501b3bf479bd6c6d48d462b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\50bb0c3b-41d6-44fd-bcc7-ffcd3c156d0d
Filesize671B
MD5cb8fa63e4d8faf20a6adf43128fec7d1
SHA16b3ab6201378961576d3a3f225c57473a7675b8f
SHA256b3f0b72df54d51a379aa04d53402fca8a1adae66f19f8d14d188e857c30ad229
SHA512d0877393dd3320fb46a5ed4575368cf63d405d2200677a663057fe960d280df3ae47aaa5d57a61c53fe94877d94cd278f10975d1c4dba7f82dc1f4d0679550a4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\58be3d75-b62d-4a0e-9a7b-b4adcdf811ba
Filesize24KB
MD573575e4b2dfa85066bea5ff13c9a9920
SHA1fd886bedb1a20da3260a01cf09927ebb83d7ac16
SHA2565d34e2efda7757fc6ff4cbb8d390d89989764a1225f889ef2684e4db513d7d20
SHA5120dfc8f1ba65b85b4d647dc87131229423a92784dff12bc8456bae563fbb09f03682a6ebe7d05eedf6f3d4378d701ea6bda07ce0391778ba0d16442aa71df842d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\625860f3-1fe6-4480-99d1-4bec930cea02
Filesize982B
MD54d0222a0d61ce501326070a191805a5e
SHA103bde5ca46f947801378795e981c349be4164f24
SHA2563b71de74bf9c8d737a6546b3e9de352a8d1ec9ba27d90cda714a937e91fea6af
SHA5124cb9add0468e72610489f0fa11e3557d58e337c540e494e1d375b9c67d2f7feefe51c2a1b952f4fd83e8c3c34af379c2112493fd2bb7c68df6e5cbbc962dbb97
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
16KB
MD5a4e93ba85d8458617ad3130ea25c7a5f
SHA1c558a7965e71cad9c12e798435ac5d66816875bf
SHA256561a71065d008aee6510e6b5e4f70f71b37912d20a548049fcbfd3548d676b48
SHA5121915b29bfcaf4bdf3893641a95fb3f003f1fd9c8072622db568737f564af6924d2af6d00479dcf449a0b8c20fb629e5978716e065703c887c28ccd290ae5202a
-
Filesize
12KB
MD5aa9e06cb26ab82569b38467097de53ea
SHA116ef57a040a0b2d4648a8def8ee28d42517fa3fe
SHA2566ae6a0c2b1fe762a7206e7e97a0befe45e280797dc615d2d4c86bef3abba658b
SHA5128551e792e33ffb974bf2e1eb8a947fd28ea247ad98bc1e07f7b842eb68721ec877bd45c18e6c21cc18215fc661468a14f749a290a9305626321371f36890ff5b
-
Filesize
11KB
MD563497fefaecf5ddc6ec83a39fdfcdff8
SHA14f3d2f363af3156faa2baf7cdb5064aba71fcdb8
SHA2565513b7e2f6b3111e173350d8dfc8d6f86ebedef35af73c399f48bd84fef88ae8
SHA5124250a5f042b601bff45156d33d2652fad6d29ff2ba0135d8fd01116d226e5253518189af45e6b5a94eaeaedec7b97bc22cb90f9f7852d66dde64a372f191907d
-
Filesize
11KB
MD5a42dbbf3d4e99ddc7285f21fcb6015e3
SHA1422236b61f96096f43e903f53f0e9f66a427b4e7
SHA2569e062074c00bd444837f0680d8247f3c2e3f16f9a00645f4750ed39d1e00db24
SHA512aeb95cdeb26aac6e099bfb9ea10437ffec9775a6a5f6bb6d1b1bb3546723b7d8f7e3e41d1b09738fb76b5fbe0547514cf6df9e494ab796d62b516f9224f9c5b8
-
Filesize
11KB
MD5d859b0d0178c9cddb8bd0fb18fc39c29
SHA1800202f1c546372f3392c368598560a9c118241c
SHA25683597ced29a8c7eab843464ea1f320c8057e808f76a08127416d21ac982bdcf2
SHA512c2cd3bf4de6b29b1883f7b9526073545570ca2756e50188861816c4442abc93f904f2b30de2e4974dcf368aff2c4ca96b048a7d6d23cfb28fdb0d97dc9f29e1d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.0MB
MD5d63f4cd8eb44f01fd33e2c61846dd924
SHA1e07c3cce5a677ac464736cd9fbec134e01a94892
SHA2562482a65c9086f7b9a96c7f6467c347673f3330662fba353ace051abe221b69f4
SHA5125fdfc50d2dac15fd69a010cb4ea9eceb962856cc1d458278d625fd252e7411e75545cc065a944e1680f7a4bac4b25f92e05537198a74167a86197ff4ec99de75