Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-08-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe
Resource
win10v2004-20240802-en
General
-
Target
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe
-
Size
1.8MB
-
MD5
eaf416c90ff444ed0b55c70c423e1c0a
-
SHA1
60dddee8c051defe4e439b7106f300954eb40f5f
-
SHA256
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353
-
SHA512
bbc11d0b7ef54a28c944432e3af074d4c8a66ec0e106984ad9572e4bad971ea28eb4f92d35db3a21c21acded829ad46642150fed003c1d1dbd377e65e6a56bcc
-
SSDEEP
49152:lVeLM5MHpMXb7QsCxauNjI2cH7VVy/+VGq596GiIpv:lVeo5AMXbKxauNjITVVy/+jhie
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exea93744b8ba.exe368f1ce836.exe88cbddcf01.exeexplorti.exeexplorti.exepid process 3044 explorti.exe 3280 a93744b8ba.exe 1676 368f1ce836.exe 3580 88cbddcf01.exe 660 explorti.exe 956 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe Key opened \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\a93744b8ba.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\a93744b8ba.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4024-43-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/4024-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/4024-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exepid process 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 3044 explorti.exe 660 explorti.exe 956 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a93744b8ba.exe368f1ce836.exedescription pid process target process PID 3280 set thread context of 4024 3280 a93744b8ba.exe RegAsm.exe PID 1676 set thread context of 2772 1676 368f1ce836.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exedescription ioc process File created C:\Windows\Tasks\explorti.job 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
explorti.exea93744b8ba.exeRegAsm.exe368f1ce836.exeRegAsm.exe88cbddcf01.exe3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a93744b8ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 368f1ce836.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88cbddcf01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exeexplorti.exeexplorti.exepid process 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 3044 explorti.exe 3044 explorti.exe 660 explorti.exe 660 explorti.exe 956 explorti.exe 956 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 732 firefox.exe Token: SeDebugPrivilege 732 firefox.exe Token: SeDebugPrivilege 732 firefox.exe Token: SeDebugPrivilege 732 firefox.exe Token: SeDebugPrivilege 732 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeRegAsm.exefirefox.exepid process 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 732 firefox.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe 4024 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 732 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exeexplorti.exea93744b8ba.exe368f1ce836.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 4784 wrote to memory of 3044 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe explorti.exe PID 4784 wrote to memory of 3044 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe explorti.exe PID 4784 wrote to memory of 3044 4784 3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe explorti.exe PID 3044 wrote to memory of 3280 3044 explorti.exe a93744b8ba.exe PID 3044 wrote to memory of 3280 3044 explorti.exe a93744b8ba.exe PID 3044 wrote to memory of 3280 3044 explorti.exe a93744b8ba.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3280 wrote to memory of 4024 3280 a93744b8ba.exe RegAsm.exe PID 3044 wrote to memory of 1676 3044 explorti.exe 368f1ce836.exe PID 3044 wrote to memory of 1676 3044 explorti.exe 368f1ce836.exe PID 3044 wrote to memory of 1676 3044 explorti.exe 368f1ce836.exe PID 1676 wrote to memory of 3804 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 3804 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 3804 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 4476 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 4476 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 4476 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 4228 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 4228 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 4228 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 1676 wrote to memory of 2772 1676 368f1ce836.exe RegAsm.exe PID 3044 wrote to memory of 3580 3044 explorti.exe 88cbddcf01.exe PID 3044 wrote to memory of 3580 3044 explorti.exe 88cbddcf01.exe PID 3044 wrote to memory of 3580 3044 explorti.exe 88cbddcf01.exe PID 4024 wrote to memory of 1548 4024 RegAsm.exe firefox.exe PID 4024 wrote to memory of 1548 4024 RegAsm.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 1548 wrote to memory of 732 1548 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe PID 732 wrote to memory of 4612 732 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe"C:\Users\Admin\AppData\Local\Temp\3fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1000036001\a93744b8ba.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\a93744b8ba.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1880 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d02e36f0-fd6f-4691-9afb-b27500e91848} 732 "\\.\pipe\gecko-crash-server-pipe.732" gpu7⤵PID:4612
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2320 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a7841fa-85ad-4e2b-b5b7-2bba7e75903e} 732 "\\.\pipe\gecko-crash-server-pipe.732" socket7⤵PID:2056
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3136 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {919f499f-1321-468e-b1b6-7a00319571a6} 732 "\\.\pipe\gecko-crash-server-pipe.732" tab7⤵PID:2088
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3540 -childID 2 -isForBrowser -prefsHandle 3056 -prefMapHandle 3208 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f31e82e8-2323-477b-8ae5-ca27657a5d1b} 732 "\\.\pipe\gecko-crash-server-pipe.732" tab7⤵PID:4696
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 2552 -prefMapHandle 4396 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bf549e8-43e8-46a1-9141-ff99a5098dc4} 732 "\\.\pipe\gecko-crash-server-pipe.732" utility7⤵
- Checks processor information in registry
PID:3716 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 3 -isForBrowser -prefsHandle 5444 -prefMapHandle 5440 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18b3ab89-a810-4c03-b7be-ed9505b4f30e} 732 "\\.\pipe\gecko-crash-server-pipe.732" tab7⤵PID:4160
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 4 -isForBrowser -prefsHandle 5588 -prefMapHandle 5592 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4d57814-1288-4ac8-abea-4fc74b99776f} 732 "\\.\pipe\gecko-crash-server-pipe.732" tab7⤵PID:772
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5792 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de63836a-feda-4ed4-b689-d3161ba03ea3} 732 "\\.\pipe\gecko-crash-server-pipe.732" tab7⤵PID:1084
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 6 -isForBrowser -prefsHandle 5620 -prefMapHandle 6240 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa847535-cd97-493a-8379-3152eb05e642} 732 "\\.\pipe\gecko-crash-server-pipe.732" tab7⤵PID:2948
-
C:\Users\Admin\1000037002\368f1ce836.exe"C:\Users\Admin\1000037002\368f1ce836.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:3804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4476
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4228
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1000038001\88cbddcf01.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\88cbddcf01.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3580
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:660
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:956
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD54924d17b3246349a878b16de3e6151eb
SHA175528bddbe5f424abf64ef1b86753efc83c3dbad
SHA2563556a15b9acd978f3b51523b566b2f7cf776955ff4eba992cf14db2b8a311019
SHA512ad862b16e79c6d95d115de19cdaf8c0f8fa5a57734fbfee3e648c7360d92361ba21567ab4baaefda8f69f84bdea6933cbe0be36a164dde0bb7e28f374db49350
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json.tmp
Filesize27KB
MD5a88f982d2f74235968910a20a1ba57ac
SHA1d1d141c6a7d8e92a6f9968421bd8f5b6581a7e43
SHA2568ffc51379628f893b7ebbf5635dac57da8f44dc139dd5d456f96ef4968a96997
SHA51218840565f5c4b8ffc5d570d07484dbdd43131325caabe0c1b80c4be2b5efe3120b41c541b3a8ebbefcb79e82def3a77712bcf9a606c786e5326a2b874fafedbb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD578886dc5b7072c0d38fc50512d0585dc
SHA15c70bd9b934fe1bc0a1826e53b064f191498b2cb
SHA25639f23a95615094fba1ea5c93192eeb02b34570b9f568a55b9a7e1def2b0cf801
SHA512aac50a29d7118137a4b662280f6bbb0c8f6a1b8471ad64ff22c01f937aefb35fe731059325bdab1ed7ac46798a2d48dcd5274a35e08083af662147a03ac7bb16
-
Filesize
1.8MB
MD5eaf416c90ff444ed0b55c70c423e1c0a
SHA160dddee8c051defe4e439b7106f300954eb40f5f
SHA2563fbd0ba89609ebbd34e91506cbff650b7a000ed9fd4566c4903c548df2355353
SHA512bbc11d0b7ef54a28c944432e3af074d4c8a66ec0e106984ad9572e4bad971ea28eb4f92d35db3a21c21acded829ad46642150fed003c1d1dbd377e65e6a56bcc
-
Filesize
1.3MB
MD51455ca37b9ee12a77d965f4d0014ae26
SHA1a72c4c98e24103c7457a00f7ad4d570bded52312
SHA2568eea3916c8ec653b4062907cfd2b75c603c702d7aec9c5c6f24e3938e9c7a1f2
SHA5127ef355d4cdc2c43615d1dbd109ac82242cb4df17893fd3fd7badbb3c0db2880363f61c224fbf7a6fbbacb08a93c3094a564446a68513c5ccb1d19c429586b82e
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin
Filesize8KB
MD54f88ba0560e884acf29604b1e9b536d2
SHA1dfda57ba48beec3953378662a522dde7c1c4050f
SHA2564e65ca7061fd4452fab51f0b1196357ad572158f5d35b869d1bb2bbee558f401
SHA512c8e0e4e6d08f668df5c288d8c93de559bcb4249ce33bc2a2a3212db04984f39c69ef84c64ea041824ee44ebb03454953f72d1272c43111cff898cd8b265ff2e7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin
Filesize10KB
MD5e027195db7c00555def7391f229d3caf
SHA19b7871a864965b06b6bdfb18e867d446da708c7f
SHA256632f9ca895a757bce497e07d24c239fa3071a0a09bf620f181be3fa0452a6ae3
SHA512afd060a805337f1a85f46de53e6f32b8c1d130cbbb1ad65c56601561cba59eba0169ff34014770ab763b5317b391059ce5d72deba0e63625a13e366be5e5779b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5fd2389cf1482670067dd1a094011af47
SHA17dd04329353b10fbba9b889df191892b36583206
SHA256480b17f74ccec78bf16a48b6ce91cb5d842a2c2135771ba293275f547b95a665
SHA512b85c34d6dd094d49083903b0f3a4ac2435f4642d37851e25a38b976ea888dbb7387c4c79a8e46ada93490d78f585ccd8e9b648fe1625ea8ebddbc656072e95b3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD520046602db0806a1a7ca7556bdebbf5a
SHA124f642c8eead54ebcd6cb4e7da46020238678e75
SHA2564d84dd585382689b257195ce6d6ee1463a2f13d00aa90697f4fcab7102347d69
SHA512b19ea81f5dcbac31d354984123804bba2a2697150a2fec85e90ef7136ba1ff00e61eb578292c899d455afd23d0e34789349e8a2ef190351ff99095a681cbb9fb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5b86c8f92b51287985e97a7142eb30a86
SHA19cd294a390a00a6f8d06859d3d6d72b1c1319f77
SHA256af4527044f6307c3c68187cc669399bd07d0d3dfdd41c459cb0764a4a36193ce
SHA5129080c5a9f5a1237b4655d60dfd385757aa0f066d2fe634b18c23279cdc3c8781f65604e39e5f2759178ae2cdce2ac0b5fc3f44e7c30bb321269289e479a69091
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\2524afbd-1565-40ed-af87-6a464be82d20
Filesize27KB
MD5b3d03bcaae7299dfecd3a9274745f972
SHA13b09245ff2a6181628ad7329eaea062273d6c04e
SHA2564ebb7a15ab46f03a3a5b8588d7a1d322c0fdb9e16ad9e7bdd42dda6978688c8c
SHA5127698d5800138c9e699cc93307b1da24107a8a4a9a23ceca99752fcf463f404ea61127d3f2e2aa2084831e7dca72566de1371a3801321edc8e94a6a7ba930ced0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\48d18167-d001-4d65-8949-075e21caed10
Filesize982B
MD59a1ddf5448417f14103bc158d842b649
SHA10142e6e5eb82146f8a0d2afa2aaae384c9ec3564
SHA256b7fd82dd93ac11fcece89829830b0708649d385e3b2c3eb4ef4c6250612e73fe
SHA512c0beccd9e1cb3b7e1b70babb6a2049f8c186a286ddd131e50b2f0323a5f09c4ae455a0413a804b0afe35ac5eec511a4287533c87c9c8477b4d081aeaccde3ffc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\e9446234-9fa6-498a-b65f-f72e8ece205b
Filesize671B
MD59f76d6530c651ba1ffbf8cd90a8625bf
SHA1e438bbc1cdc2b97d7848787ee70cd680d16fc5e9
SHA2560d92bc7b028e9df3c55f63a37c1b06d9286127cdf2cc3d6e131b21b4aa009e67
SHA5123b6c84777fb87554de2c0fcdb4153bde9810a2a58b792fe033174669237cd3f30c4d692d2246c38e4f03bebed5178ad327d4c45a851b0647e2a1cfb044c8413f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD56bd6f572157cf03d61932b795fa3d91b
SHA1d5376d2cbb5967956183b364a28135f85c9ff522
SHA256cafc794c3ec6f9344bc1c7bc32ec2f9991e085fce3a5821680b3e41e29a8b20c
SHA512aafea6ea55e1af0c8b0ec4626e4b25b12e9fd5f8f3d72935d35888ecea62845f977fb1b8c3dc32b47a7532eb998e4048a00221cfef04c1abe5eb61377e23d126
-
Filesize
11KB
MD5dcb173e344259b5dd2ed28166569a50b
SHA166d00a4b7bcdc2dc3777a15fba1447e30dec3aa9
SHA25619f91d7f249dc460425a0ea4411122e462bcae0c3b085f8b15fea1b30fc260c5
SHA51229a6dc84d4ff3471a7602e6c939f1299eea1fa843ab7b2d51bacd2acb68863543b416c457b327f3b7556f3f8bdca5c91c03468aa19bdd6138410b0dea5b4b269
-
Filesize
10KB
MD51476864439f8bebfee81b21d50da9474
SHA1cf10a6fbb23d4a52ab8f726661b77e8fad2ae7a5
SHA256cee69f3346188395bd74d9d2f13d4c6a0e1bdbdeab7387161398e698eecdd201
SHA512f75e4ec188e175f25842c9de911077d1abdb70b46c27703e7c41698efac03136f5f60a8b2463f8db27ae76fa44e375b470449ea920c38a15c1b44a513697100a