Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe
Resource
win10v2004-20240802-en
General
-
Target
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe
-
Size
1.8MB
-
MD5
eaf416c90ff444ed0b55c70c423e1c0a
-
SHA1
60dddee8c051defe4e439b7106f300954eb40f5f
-
SHA256
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353
-
SHA512
bbc11d0b7ef54a28c944432e3af074d4c8a66ec0e106984ad9572e4bad971ea28eb4f92d35db3a21c21acded829ad46642150fed003c1d1dbd377e65e6a56bcc
-
SSDEEP
49152:lVeLM5MHpMXb7QsCxauNjI2cH7VVy/+VGq596GiIpv:lVeo5AMXbKxauNjITVVy/+jhie
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exeexplorti.exe3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exea93744b8ba.exedb7b6c0123.exe39649ec401.exeexplorti.exeexplorti.exepid process 3276 explorti.exe 2604 a93744b8ba.exe 1592 db7b6c0123.exe 2740 39649ec401.exe 5612 explorti.exe 2004 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exeexplorti.exe3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a93744b8ba.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\a93744b8ba.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2724-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2724-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/2724-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exepid process 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 3276 explorti.exe 5612 explorti.exe 2004 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a93744b8ba.exedb7b6c0123.exedescription pid process target process PID 2604 set thread context of 2724 2604 a93744b8ba.exe RegAsm.exe PID 1592 set thread context of 3292 1592 db7b6c0123.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exedescription ioc process File created C:\Windows\Tasks\explorti.job 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
explorti.exea93744b8ba.exeRegAsm.exedb7b6c0123.exeRegAsm.exe39649ec401.exe3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a93744b8ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db7b6c0123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39649ec401.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exepid process 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 3276 explorti.exe 3276 explorti.exe 5612 explorti.exe 5612 explorti.exe 2004 explorti.exe 2004 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 3484 firefox.exe Token: SeDebugPrivilege 3484 firefox.exe Token: SeDebugPrivilege 3484 firefox.exe Token: SeDebugPrivilege 3484 firefox.exe Token: SeDebugPrivilege 3484 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeRegAsm.exefirefox.exepid process 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 3484 firefox.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe 2724 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 3484 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exea93744b8ba.exedb7b6c0123.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 5048 wrote to memory of 3276 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe explorti.exe PID 5048 wrote to memory of 3276 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe explorti.exe PID 5048 wrote to memory of 3276 5048 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe explorti.exe PID 3276 wrote to memory of 2604 3276 explorti.exe a93744b8ba.exe PID 3276 wrote to memory of 2604 3276 explorti.exe a93744b8ba.exe PID 3276 wrote to memory of 2604 3276 explorti.exe a93744b8ba.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 2604 wrote to memory of 2724 2604 a93744b8ba.exe RegAsm.exe PID 3276 wrote to memory of 1592 3276 explorti.exe db7b6c0123.exe PID 3276 wrote to memory of 1592 3276 explorti.exe db7b6c0123.exe PID 3276 wrote to memory of 1592 3276 explorti.exe db7b6c0123.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 1592 wrote to memory of 3292 1592 db7b6c0123.exe RegAsm.exe PID 3276 wrote to memory of 2740 3276 explorti.exe 39649ec401.exe PID 3276 wrote to memory of 2740 3276 explorti.exe 39649ec401.exe PID 3276 wrote to memory of 2740 3276 explorti.exe 39649ec401.exe PID 2724 wrote to memory of 1708 2724 RegAsm.exe firefox.exe PID 2724 wrote to memory of 1708 2724 RegAsm.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 1708 wrote to memory of 3484 1708 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 4376 3484 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe"C:\Users\Admin\AppData\Local\Temp\3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\1000036001\a93744b8ba.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\a93744b8ba.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13b350ec-e338-4876-ad7d-603442e418b1} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" gpu7⤵PID:4376
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24522 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59af31df-7b58-4b5e-b1cd-966b0c62cf68} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" socket7⤵PID:212
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2824 -prefsLen 22590 -prefMapSize 244628 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8c9d5ce-f572-4ac2-9127-ebc5ff43b86f} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" tab7⤵PID:3524
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3756 -childID 2 -isForBrowser -prefsHandle 3744 -prefMapHandle 3740 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9530be52-47cc-478a-9340-b0a61e4127cb} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" tab7⤵PID:2800
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4744 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4680 -prefMapHandle 4704 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {440aecd3-7983-41d1-9a42-881c349d48da} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" utility7⤵
- Checks processor information in registry
PID:5320 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 3 -isForBrowser -prefsHandle 5420 -prefMapHandle 5416 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da0c101f-028c-43d8-81a4-999b728f3e33} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" tab7⤵PID:5812
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 4 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9bec3c6-4503-40a9-982a-bd4d514c815b} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" tab7⤵PID:5824
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5768 -childID 5 -isForBrowser -prefsHandle 5844 -prefMapHandle 5840 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a5ff6b8-17c4-47c7-abf9-786f81e73baa} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" tab7⤵PID:5836
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6280 -childID 6 -isForBrowser -prefsHandle 5592 -prefMapHandle 6312 -prefsLen 27039 -prefMapSize 244628 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {692c79e8-d903-4d5b-9276-bba96d16224b} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" tab7⤵PID:3980
-
C:\Users\Admin\1000037002\db7b6c0123.exe"C:\Users\Admin\1000037002\db7b6c0123.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1000038001\39649ec401.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\39649ec401.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5612
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2004
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD54924d17b3246349a878b16de3e6151eb
SHA175528bddbe5f424abf64ef1b86753efc83c3dbad
SHA2563556a15b9acd978f3b51523b566b2f7cf776955ff4eba992cf14db2b8a311019
SHA512ad862b16e79c6d95d115de19cdaf8c0f8fa5a57734fbfee3e648c7360d92361ba21567ab4baaefda8f69f84bdea6933cbe0be36a164dde0bb7e28f374db49350
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\activity-stream.discovery_stream.json
Filesize27KB
MD565e4269dca258fbb2c928eb010c7d4af
SHA17fac1a320756c61b8a735d08df62ecd7cd86bec8
SHA25682ed03644813509af87772b7b7c7165100920e45aec4e469fb02c725f4db9210
SHA512322ecf2a59ca2cab8f49a9dae3d9262750d4f10ce88fdd1de8021a20e2f46397cb9f8562122eb9f504fb7d1a59b19a30dea2b55aef58c3d57d8751cf0a49a4ae
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5a05c8d3c97e673e9d7c4f933f029eb77
SHA1a02a7ace28d6e2f7d677c5eb382fdac53127e58c
SHA2560d17755b17c4cf8deb2828ab207a9d345668b808a0736509e008e8f136eacdbb
SHA512ec2873834feb729716496dac794315735f505af5fb33fed8d20a3d0b5feff2ea0071b6f2c6ce7fc88435b0bdd7c3a852df4329b8f550e7ce036490b28fc09e14
-
Filesize
1.8MB
MD5eaf416c90ff444ed0b55c70c423e1c0a
SHA160dddee8c051defe4e439b7106f300954eb40f5f
SHA2563fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353
SHA512bbc11d0b7ef54a28c944432e3af074d4c8a66ec0e106984ad9572e4bad971ea28eb4f92d35db3a21c21acded829ad46642150fed003c1d1dbd377e65e6a56bcc
-
Filesize
1.3MB
MD51455ca37b9ee12a77d965f4d0014ae26
SHA1a72c4c98e24103c7457a00f7ad4d570bded52312
SHA2568eea3916c8ec653b4062907cfd2b75c603c702d7aec9c5c6f24e3938e9c7a1f2
SHA5127ef355d4cdc2c43615d1dbd109ac82242cb4df17893fd3fd7badbb3c0db2880363f61c224fbf7a6fbbacb08a93c3094a564446a68513c5ccb1d19c429586b82e
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\AlternateServices.bin
Filesize10KB
MD5568a590aa4fa2487fb9a7be96ae7a7f7
SHA191756d1e01b81855382496b93f2bbf14a9ef5f6e
SHA25664724ab62330cfe15abe453a0aa6cf9509f73ceca1f81d32ba5a1bd0f1c2925c
SHA5127e5091d8deffc4b1abc217afa181cbb790a813d2c537e80998a39a0d789e8c801fa7597ac26c72e9a50f6c7feefb97f12d0468af7a348410e4315cfe1d65fe91
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD52f3db92ad8f0234fc99e630b181b0cd7
SHA1b2a7eaae6ab06b1ba9e83b309744a52e2035d9a8
SHA25680a8c90802cdd1d0e672cca1b82e1ab3af2c7d7b3bded49dfe7166768569dca7
SHA51209cab7195e5064b0a3b2e5c9762b08978f59bdf4bb1e9bb1633bbdb359bdd67d939280e84784613f4ace471ebec428e7464701129836ac0ef6f6af091d4e70ce
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5431abcc8602d33febbda30da88d19b18
SHA15b0f72d42813d0292249d19dbfa317df623f5a66
SHA2568a1c61dbc98ed709ce0ea85bbd4841f24ba223a701507eea9a44072fda0b58c9
SHA51259ef5ef9ee9eb9c6fe7dd99d46a34c07e8ce1870b3f99e13b2f39db38359f4a7607ec00d87ca4dddeabd533ec4c661b3f998a67d0cde0287fbd15e7165c1eed0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5d1587951f66db6d0f976d7e045772aae
SHA13444cf46678d21e00a658fc9aa646c998d41bc78
SHA256bbc567b7210dec2b2f2cec8230854b24fe8eebf4231d048ad37b3566acfed055
SHA5121ffe84bf20818b43317f7c3177baa222ba2dc8f04527f2e70ea9833418a5a9a69e26efc0ea49d5fdb8c5bf412385ea1a9e4c148c803bb210ae9a85e62324d242
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5c231227de80a9bcdb6a1303fcbb3f4e5
SHA1e734db93eb0f2c831821d21de8a5d4c13c5ce3fe
SHA25602a41269cd6d7b928e18372df213d2fa9ab20cf786aa79032f6476b52d913505
SHA5123168b5d25baa95d57acc50c57336e46d31a12b5e163ca39c075668bc6faf19d5cb1034d57a3c0eb59c021f4bf01705eb3be3a10b510761b69676a4bb2b904a31
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\22f6e404-1ba6-42f9-a593-27d328872678
Filesize27KB
MD506866308455811e737a996f317cefee2
SHA1a7cca78405346b4d589aba40c96bd421a4a439eb
SHA256e6739eb32b80684c5b3ed5d7011bf945b74d735715f75f602505acd39463c2ed
SHA512446b9f0cb2bc7530fc3e085e2557869dd7e8c3901eee0351a8f5ffe9349087197c2514efbf955240f29b2d4371e030fe8c8589d5e17b453702efac0354330d17
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\897f45f5-deed-4029-9906-39614b2ea128
Filesize982B
MD54ae918a3ee4999b26439011f597fdcdb
SHA18b41efca91d41c1d2937023673c894d206691294
SHA256bf4315adfc360b821db91c1b31a9b47e8eac03222e51db95129f35d2634310bf
SHA512632597f128138b89d4a17013219488378678254f4440648ad020416c2ed30eb347ba2cfcf42bd9f54b1f4f7a928c73bf99b7dc0889efb48c16ed09e858996ff5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\datareporting\glean\pending_pings\967b52e1-d67f-4d64-bbdb-5cef85757f32
Filesize671B
MD58828bc97c194e817e80157a38b6e6f28
SHA1495f6851f097432cb3e64ff3a1b2b5fd9ea8e8ce
SHA2565f1dba693dae8206b850fbaf9db9c5d1f2ab2a340e189e7cdffd20b2dd370500
SHA5124206cec6724e4c7cfce3d3da99275a58fc7af94d7c9982968e641a05e19add5b0079e7761268492988ac59a250382b2cba7ffe391362b1ce1ee131ebbe51fbd3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD522e1e778970357f89551dd8197fb2cb0
SHA17ca9a34416d9a5f9453950912f6d8bc16b73d5f6
SHA256b8277bb7608bd76255a34bf47bb52482c65cd95645bde39437770bd2b3f9213b
SHA5127133ee66d1217c0023536f617f19a936faa0ccb3a5b9a8fc478bf0ba21d66dd82cb7a8e07ff29256312b25fd6e8b1c686897cb383c8a451f9c569be997cca0b6
-
Filesize
11KB
MD58738df1ebfef505d8328feac334bf2c2
SHA131719fef0ca3788c904c4a9fa31eedd283ba0f32
SHA256bbda6e495d93559a0ed2211d06d615e98526efef33b758bce5779807ec753229
SHA5123901f8f1568706695fb84c768afc1f26e04bba0b9e7879f6a2c74b2a2997155b6cf250d56f347ca09ce109814d98f02daf05fe63c2ae6134685b971b3eafe812
-
Filesize
11KB
MD5c29e4849c845161225632723b0b79f9b
SHA1030cc9d69e14c6b0a136e1c0cabc9f235f587453
SHA25618b208903cc04535072bbf8ae10d7b49159034729cf900a877cc55de5d33522d
SHA512211347291c16694167e1a72ce8b27453dcd419b8779c043690c33b61038cce089fc813350528c3e61bc28e663a1f8b909c74ff095970dd8f641a5a2f3094eb49
-
Filesize
12KB
MD55c424ffc63ca962898eb0ef482cb2679
SHA1bc79b5ee949bfb58cd76fca3da53f9e7c8b211f9
SHA25608ec6fe5c0d9422b47b91d1592c7ec99dc3f88efaae02c4a6814ebf2a27ba1e8
SHA512bf312821f56e9112aa0501bfbe91894cc7810ed21cc83d69ef381a0dc9ffe01086746b2c97dd5c557c3f85ea0b515dd5336d69b6ca005fd0e105172486585a4d
-
Filesize
16KB
MD50832ac709c3bca7d9c91ee34f0b240c1
SHA1997a25520ee9b4efc3a6d9ebe2cd9c30051817b0
SHA25615b5afab1fd7f3cc08948b7b614f84a9d438d0e23a59c6363fa2f3acb10d4de9
SHA5128a523217c448eb8a3ee7e1ea7e2dec93055f221a9b58a2c3396dd32249dfcbb1db4b93718afae379797ffed0d21a8bcd4fd5c70fae256211ae6120903edc4245
-
Filesize
16KB
MD569d18c893b3b652c18a9c277eaa41acf
SHA152b778aa7f7a654f50205c4d5aa3e0c34fbfc161
SHA256f5be4072e9d8df5095f51629c43e858b182d969a4da8edb1eb12040e33d46988
SHA5123df88421435396301aee182aebc63d57c3aea3e40cc9663e4b471f347c6e6ffdab42ac76a1f8ab32af48f37fedce552cc9b08b1120b92957358ef4635f45ddeb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5dqhm7h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.6MB
MD52238ebedc61179caf8266f70fc575873
SHA1f63804ba14187ce2215bbdeacb05c27a8f39d4ee
SHA256656133fc85af6e0fcdecf8cfe0538cd32eacbca153c1ee7c4c5291fcc28667f9
SHA5120d55387add41fc1296c990fe6c422ece533afc207fd8502dc4aeb5b768b7e0081d2df4c46d697619ae24262fd4029ee8fc0d50b9633061cee46420ca19dc2c1f