Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe
Resource
win10v2004-20240802-en
General
-
Target
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe
-
Size
1.8MB
-
MD5
5193ccd3d4b697e58c680bcd4954dd6e
-
SHA1
1faafc8d8f4ae43f14523d3d9ccab85c6e79af10
-
SHA256
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189
-
SHA512
e2f53360c3e07cc56b140ffa616f4fd0e9f2e6a1df82d8f434db1ff4a0aa5d657edb8b1fb03704980fbad23b240e2196dd67c6000fd1ce8f1732783e86f19c4d
-
SSDEEP
49152:v0A0UJmzu8TD0P7mVi4onvOqYhEXze9kxQ:vJ0Jq8H0zsPU2byaCxQ
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exeexplorti.exe6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 6 IoCs
Processes:
explorti.exef53ac07f01.exe74358310d6.exe90096ffa59.exeexplorti.exeexplorti.exepid process 4972 explorti.exe 512 f53ac07f01.exe 4136 74358310d6.exe 2212 90096ffa59.exe 2312 explorti.exe 5964 explorti.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f53ac07f01.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\f53ac07f01.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/4736-45-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/4736-47-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral1/memory/4736-49-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exeexplorti.exepid process 2680 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe 4972 explorti.exe 2312 explorti.exe 5964 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f53ac07f01.exe74358310d6.exedescription pid process target process PID 512 set thread context of 4736 512 f53ac07f01.exe RegAsm.exe PID 4136 set thread context of 2508 4136 74358310d6.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exedescription ioc process File created C:\Windows\Tasks\explorti.job 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exef53ac07f01.exeRegAsm.exe74358310d6.exeRegAsm.exe90096ffa59.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f53ac07f01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74358310d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90096ffa59.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exeexplorti.exeexplorti.exepid process 2680 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe 2680 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe 4972 explorti.exe 4972 explorti.exe 2312 explorti.exe 2312 explorti.exe 5964 explorti.exe 5964 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4496 firefox.exe Token: SeDebugPrivilege 4496 firefox.exe Token: SeDebugPrivilege 4496 firefox.exe Token: SeDebugPrivilege 4496 firefox.exe Token: SeDebugPrivilege 4496 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4496 firefox.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe 4736 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4496 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exeexplorti.exef53ac07f01.exe74358310d6.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 2680 wrote to memory of 4972 2680 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe explorti.exe PID 2680 wrote to memory of 4972 2680 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe explorti.exe PID 2680 wrote to memory of 4972 2680 6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe explorti.exe PID 4972 wrote to memory of 512 4972 explorti.exe f53ac07f01.exe PID 4972 wrote to memory of 512 4972 explorti.exe f53ac07f01.exe PID 4972 wrote to memory of 512 4972 explorti.exe f53ac07f01.exe PID 512 wrote to memory of 4708 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4708 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4708 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 512 wrote to memory of 4736 512 f53ac07f01.exe RegAsm.exe PID 4972 wrote to memory of 4136 4972 explorti.exe 74358310d6.exe PID 4972 wrote to memory of 4136 4972 explorti.exe 74358310d6.exe PID 4972 wrote to memory of 4136 4972 explorti.exe 74358310d6.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4136 wrote to memory of 2508 4136 74358310d6.exe RegAsm.exe PID 4972 wrote to memory of 2212 4972 explorti.exe 90096ffa59.exe PID 4972 wrote to memory of 2212 4972 explorti.exe 90096ffa59.exe PID 4972 wrote to memory of 2212 4972 explorti.exe 90096ffa59.exe PID 4736 wrote to memory of 3476 4736 RegAsm.exe firefox.exe PID 4736 wrote to memory of 3476 4736 RegAsm.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 3476 wrote to memory of 4496 3476 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe PID 4496 wrote to memory of 2952 4496 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe"C:\Users\Admin\AppData\Local\Temp\6c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\1000036001\f53ac07f01.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\f53ac07f01.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:4708
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {859fe949-2f35-41fc-81c3-c1fa9233fabd} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" gpu7⤵PID:2952
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d0ce308-2276-45e6-9a57-ee6dac333676} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" socket7⤵PID:2184
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2744 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3028 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34cba362-2f84-427b-b0da-ded48f087e3d} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" tab7⤵PID:4984
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3608 -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 2936 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff5519eb-222b-4e7e-b698-28aa9dc84ea8} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" tab7⤵PID:2412
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4064 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4184 -prefMapHandle 4192 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39db9ac-c1f6-4bcb-92b2-dfa419beda25} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" utility7⤵
- Checks processor information in registry
PID:5408 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5444 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5137fcaf-bbcc-45b7-8f04-10f9f91f1486} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" tab7⤵PID:6004
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7725ecf2-edeb-4afd-9cdc-518f51101adc} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" tab7⤵PID:6016
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -childID 5 -isForBrowser -prefsHandle 5896 -prefMapHandle 5892 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2d8d8c0-4f19-4a81-a84a-d42173774e68} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" tab7⤵PID:6032
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6340 -childID 6 -isForBrowser -prefsHandle 6376 -prefMapHandle 6312 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0bfed21-1deb-478f-b8b7-b6c4513626d6} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" tab7⤵PID:5168
-
C:\Users\Admin\1000037002\74358310d6.exe"C:\Users\Admin\1000037002\74358310d6.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1000038001\90096ffa59.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\90096ffa59.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5964
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD5cce7286520fba2ea0ebcb5ded18c5ee7
SHA106879b8744cccd54fdd33dcb0c9309e60a416386
SHA25699a73b9c1d55b09c417d4b106a761619e8733f04569665708dfd6b7c3b03061a
SHA512f1b350449b3d6bb9f1b234868fd353cadc9a33fac368519589d3ccb24ab60ba1081fe92a363ebecafd49ad066003525cec292dfd6add3c8622bdbc4fa1c7658d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD570fa16b1a936442583cb45c086782187
SHA13db730d0aca3e860b0cc5463a5118bf5d570a526
SHA2561fecd3ae88b111f5054eb5133f11261975ef936dc4566d804f6cfec029db7cc1
SHA5120d84de40124d40170f3fec8b1e57cb245b05023e7de9b3f3529371dc0b20a3c667db02808110b6769531be98b3ae536be1423d327175699b510a1ecab55d162f
-
Filesize
1.8MB
MD55193ccd3d4b697e58c680bcd4954dd6e
SHA11faafc8d8f4ae43f14523d3d9ccab85c6e79af10
SHA2566c8216e5b24ed838e4439e825505a6a714d46b5038204a086196433fec454189
SHA512e2f53360c3e07cc56b140ffa616f4fd0e9f2e6a1df82d8f434db1ff4a0aa5d657edb8b1fb03704980fbad23b240e2196dd67c6000fd1ce8f1732783e86f19c4d
-
Filesize
1.3MB
MD5a692e9aa849f2e4ef174116c2c7ff1f4
SHA1c6a830449f364888bfdf84b93b50bd2091ceb195
SHA25668418f2dfa408b5d47bd6dd209a2c51d86d946448cdd8533e01aaf663bd37d25
SHA5120ff667c1371512f4794e97344c220bba2baa4cded3a4b6cd7d628e61f0c171fbca4b607df3c4f323e21c7329cf5bdc565ffa2a2c3bd9ae0a7bac706b7e24b335
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin
Filesize10KB
MD5b6d61ff91f43cfc056b1e17642243a31
SHA1e4c53858a539935e898a1aee13ed26f8e4408537
SHA25673821a105a9a91b8f8cbbca9d0f9da3614c1f8682dd6a7b65d2b3ae271e8dd8a
SHA5122944684bce325ec4ae71a840f3297c813646b5ea9f12e3f7595265ec72513ec7fabe19f93758ddd28058aafe2c0a7410eb40bac42ae3fd367fd3a06d08de57ae
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD51b686a3e1096ac3b35133dec1974327f
SHA161fd18d8c5985ba4f3fe1de869a09007443698c9
SHA256caa4372cbe918bfe7254c4529ec5f607fc3c79ac1c2ddfa610030fbc827cc241
SHA51276b998f4a8a85f1099ae14f3389486767d22d2c39af858c4a90a9d4f4c7f6e154078cbf4322634f688b46a5e7c9a58a36953c74e5d7d8c3ebc97ac428078e9f4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD50a5b675be05c530a4fd89ca95e53e1e2
SHA175caa3ac31968cd1048011cade3da0978165caa6
SHA2564b1a280d6809af1286fbb33b74c2a63fb628bd0be8216b2ff1c3d81d1b9b341e
SHA51218b22ba2f868dac9708ebca1e9906eec6a059bf92ae6c817eb07624b715a2a5931f8bc8dc4ecaa3583ba53662ad3934f0327c18cb297bf1db6c714cdd24d0494
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp
Filesize31KB
MD52e79cc0e1d934da97b1d3bc1bd24a02f
SHA12655319bb07d115db212df870252d357c238abc8
SHA2563e3274a909e82a7c8a1e6bc74f499e66e377e2ccb6be1c4080c34f22cedbb659
SHA512676284a261bb023553ecfd5c3577025178ab715c48eeed75a835b104b0c7897a6d63bf399fe61c07d17432e0456c61f5dff6cb141cb37c36a9b0dfda3ae348dd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp
Filesize31KB
MD54379a4ac884553bd44c6299a93b14c35
SHA109279bbce601801290f91138b7112d993e4444d1
SHA256b053f59843673744f8b80ce1e0e3b3d8e169dbb0bb83575269ce83da1dab7c15
SHA5126ba71c6027d8f06543aea8b659821836f0919ac3c9adf2efe800338cc17c7dbb1dd22d967f4a463c621c2a922dc689ba60c6eb9e12895d48dfe3c0f05f7f36c7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\4579740f-844d-4925-b63b-4a34811818df
Filesize26KB
MD5ff3783f5ecbc7e361e9c98c9ac1b6b2b
SHA1e015421b1254f7e401d005b909ad653a4c466962
SHA256205f4e7bd93917fcbab61540a422a901b60a9c58174f9053ac10ccc3d0fb66c3
SHA512718516b0c0e738fc0707c9132d40f1662283aca050fb2aeec4e13ff32ec498e959baa8cd0847dc67172d569c661c006ed099db23ade218f2f83efef2af2fff61
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\89ea0787-38e7-49d7-8bd6-21254868cbf9
Filesize671B
MD508f848d2222d1d596f88573e09dabd16
SHA164e14cb9486d7aefc28fb284637596057f24465b
SHA25669942b1a4634dbe1dea922a41bbd122e1199d08f7fce9235db99c740ecc6f621
SHA5127f6c66af1f822945792c56280e21760d8e60119765b1e7c67647972f1280366b20b8676c8c137dcb703c170f2d9450f830ffbe086225e5927efb36e107af87f0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\cf74ca61-5223-4bf4-bacd-c67f950949ae
Filesize982B
MD5dbbe7eb75495697443e4f45c10faf524
SHA1bb8c52f933fe63507ca761afd64d62ce3ac4fff6
SHA25647fa670a5b22d7b59eb1b3dd4350431fad723a13dba6202b5f292307dbb82004
SHA512735c814c83b73c401d1faf3dcb0ad04ef1dd3f2713af5c6c8eb06d92effea5398afc54bb1a347789a91d7dde87c320dbd25585912a5d64872835edde433a8289
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD5c3f2d871c44db34b7178a9cdf6d27523
SHA1a830ff801cb580f6a127f5f3365eb30e505841d0
SHA256cde52f925c4ec27c09311a169e93203edca7ae9f0e7610118dec2093e17d7876
SHA51268b7b262483973bd82034603b3573dc4bf9b9a5ec03da7d67239a0f2fb92ed490310d606b9aad03afd982a25b1e10a16fc494057f6549d08d4379fb829a7c4a8
-
Filesize
16KB
MD51b148df9f75edf9e24d1e8786b95b935
SHA11f24ce6f2d4a86fe252597777d2c0c591bdf255f
SHA25699f9ca5c7a53f01ab5693dd87cfff0e40ffb542f565b9d84225862e47e6a7683
SHA51266bb07709ecd8565afaece6f389dc700f5b1f8a697de1ab711f5945e729c8df87395258071a08f9b61897f1d5d92365f77f47d36ddf00d70d36f9adfff04e636
-
Filesize
11KB
MD5d2046c08ddc1ccfec9a1c2304cfe9872
SHA1cc52ef70046a5a92357c2cf04c76a6826d7596d5
SHA2569664e72a78f81e96ee17886dd905f2fc20201c22bc1c5f89aa53674602071129
SHA5129d1f7e77a8ad19bc571f7c8a6a11f758e5e9a1776b780e4304fa6427cb3a982a98c52518cec61120fdf347698c71a93d2ca043a694c81410b399bc0a2d8bb2b9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize960KB
MD53caa66e84182382f6c048bd44e3578cc
SHA1c794b8edceef4ada60e55a2fb71b41305529af2a
SHA256965f03a78b538ea4f90711c154edc4e5e11ce864789dce10729284f0a1d80a07
SHA5129fe7992ea19f726bc1579004d3e21e50326e150f564d87f19f70e66d0167025d89cdc0cb622669a718958f5767c694ceff6b5862a8be37062e4b855849db4875