Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-08-2024 10:21
Static task
static1
Behavioral task
behavioral1
Sample
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe
Resource
win10v2004-20240802-en
General
-
Target
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe
-
Size
1.8MB
-
MD5
eb08ca426c0d2123f37fc72dd629dfb7
-
SHA1
a0e3043f563d7c1786c2abc250f32bac065ba94a
-
SHA256
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0
-
SHA512
de957c52cf7b51efd2be72361978b4222285c7a69b013ec85e9766839b076581581bcbd2e198b2a2e3cc85d833b9c48b0ab09b221c291d069c89231f3429ca8f
-
SSDEEP
24576:3/sjMo3GYnO4WErKws4PflE44n2UAy8fiignIvY32HOzx/MbXM9KSK0ZBWEnxkQG:Pe9n1LW4PfC44n2Vhc30cKZ0nr0xs03
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exeexplorti.exe094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Executes dropped EXE 7 IoCs
Processes:
explorti.exee510a07eb4.exe6d36ec8513.exe79632d75dd.exeexplorti.exeexplorti.exeexplorti.exepid process 4784 explorti.exe 4564 e510a07eb4.exe 1592 6d36ec8513.exe 5196 79632d75dd.exe 2848 explorti.exe 2512 explorti.exe 244 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorti.exeexplorti.exe094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\e510a07eb4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\e510a07eb4.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1100-42-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1100-46-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1100-44-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe 4784 explorti.exe 2848 explorti.exe 2512 explorti.exe 244 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e510a07eb4.exe6d36ec8513.exedescription pid process target process PID 4564 set thread context of 1100 4564 e510a07eb4.exe RegAsm.exe PID 1592 set thread context of 5988 1592 6d36ec8513.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exedescription ioc process File created C:\Windows\Tasks\explorti.job 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
e510a07eb4.exeRegAsm.exe6d36ec8513.exeRegAsm.exe79632d75dd.exe094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e510a07eb4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d36ec8513.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79632d75dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe 4784 explorti.exe 4784 explorti.exe 2848 explorti.exe 2848 explorti.exe 2512 explorti.exe 2512 explorti.exe 244 explorti.exe 244 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 5912 firefox.exe Token: SeDebugPrivilege 5912 firefox.exe Token: SeDebugPrivilege 5912 firefox.exe Token: SeDebugPrivilege 5912 firefox.exe Token: SeDebugPrivilege 5912 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeRegAsm.exefirefox.exepid process 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 5912 firefox.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe 1100 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 5912 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exeexplorti.exee510a07eb4.exe6d36ec8513.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 5600 wrote to memory of 4784 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe explorti.exe PID 5600 wrote to memory of 4784 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe explorti.exe PID 5600 wrote to memory of 4784 5600 094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe explorti.exe PID 4784 wrote to memory of 4564 4784 explorti.exe e510a07eb4.exe PID 4784 wrote to memory of 4564 4784 explorti.exe e510a07eb4.exe PID 4784 wrote to memory of 4564 4784 explorti.exe e510a07eb4.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4564 wrote to memory of 1100 4564 e510a07eb4.exe RegAsm.exe PID 4784 wrote to memory of 1592 4784 explorti.exe 6d36ec8513.exe PID 4784 wrote to memory of 1592 4784 explorti.exe 6d36ec8513.exe PID 4784 wrote to memory of 1592 4784 explorti.exe 6d36ec8513.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 1592 wrote to memory of 5988 1592 6d36ec8513.exe RegAsm.exe PID 4784 wrote to memory of 5196 4784 explorti.exe 79632d75dd.exe PID 4784 wrote to memory of 5196 4784 explorti.exe 79632d75dd.exe PID 4784 wrote to memory of 5196 4784 explorti.exe 79632d75dd.exe PID 1100 wrote to memory of 5332 1100 RegAsm.exe firefox.exe PID 1100 wrote to memory of 5332 1100 RegAsm.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5332 wrote to memory of 5912 5332 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe PID 5912 wrote to memory of 232 5912 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe"C:\Users\Admin\AppData\Local\Temp\094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\1000036001\e510a07eb4.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\e510a07eb4.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a894e17-31b7-4387-a925-68d4f762a1ff} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" gpu7⤵PID:232
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f97d830-1c50-43df-8bde-584333a0f520} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" socket7⤵PID:5528
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 1 -isForBrowser -prefsHandle 2876 -prefMapHandle 2764 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5b597ca-85fa-46a1-af61-a40dd73aa3cd} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" tab7⤵PID:5104
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4008 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe264ce7-193c-4875-b1d3-79f6c0eee48b} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" tab7⤵PID:5232
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4576 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4620 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46863e36-c83b-414c-878e-ca9a867339ab} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" utility7⤵
- Checks processor information in registry
PID:6124 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 3 -isForBrowser -prefsHandle 4624 -prefMapHandle 5624 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e9b0883-e387-4a28-b88c-ee733cc9f998} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" tab7⤵PID:1532
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 4 -isForBrowser -prefsHandle 5780 -prefMapHandle 5776 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b8b3723-c9e4-4227-b3e3-0c7129c96245} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" tab7⤵PID:2244
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5860 -childID 5 -isForBrowser -prefsHandle 5348 -prefMapHandle 5360 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02da0a5a-efb6-4c95-88c2-b5189215187b} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" tab7⤵PID:1576
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6208 -childID 6 -isForBrowser -prefsHandle 6220 -prefMapHandle 6188 -prefsLen 27129 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b94cf3f0-27a4-4da3-8db3-a758330fed3b} 5912 "\\.\pipe\gecko-crash-server-pipe.5912" tab7⤵PID:4876
-
C:\Users\Admin\1000037002\6d36ec8513.exe"C:\Users\Admin\1000037002\6d36ec8513.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\1000038001\79632d75dd.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\79632d75dd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5196
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2848
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:244
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD542252158d16167520a95adeab3eb15f4
SHA1cf1786aa94bf1de5b0157a50d6d102847144960d
SHA256d6f650af3380f2f251bb9b008939c070c9af647dd0b5ecb08e1f585142efe092
SHA51246efad99f2bc8b4f08cf8c86fdff9d8b973e06c01ca14e822e3720760dc8622d75411b566efec18387ca9c7b8ddf7dff43dffeaa1318f4e8b92ef28914d40897
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6o52671h.default-release\activity-stream.discovery_stream.json
Filesize36KB
MD5e6eb0f43e661516e7421aeaa53a8ed68
SHA157ba20128213d999a475e3d0aaea857a548fabca
SHA256315a5d648f2604f2e906a07fe1aca86af562394a232b8b90f8422f9cf208a4af
SHA512ebaf50b6a6e114c1498a4d5ecc4316144cebfcd7793815f61da9d11361602777d1964dce13881e8393b65649fb78bfb965c9271b121ea28ebdfbce85e3ba7c30
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6o52671h.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5c7972a3c17b3d3fba42ba0b709e66a64
SHA1d5ec28986a3b27e2be9f7b2cf2266a8b80cb1002
SHA2568a44c535463434b4eb202360949466a65994092caf20b874ca7d4e9ba7af9ba6
SHA5122a71e8b2c7fe23da6ab63052063ecef7019e7144d6700143602be70be5a168f764343857a991fc87693591852bdcf447d7679b8d6ee0d69b6f0c6b9d2ff62248
-
Filesize
1.8MB
MD5eb08ca426c0d2123f37fc72dd629dfb7
SHA1a0e3043f563d7c1786c2abc250f32bac065ba94a
SHA256094d41c0784a2aa7ace63455cf6b884667277855d6dd3c4cf9efdff3c5fab5c0
SHA512de957c52cf7b51efd2be72361978b4222285c7a69b013ec85e9766839b076581581bcbd2e198b2a2e3cc85d833b9c48b0ab09b221c291d069c89231f3429ca8f
-
Filesize
1.3MB
MD52028fc2da0953fc19cceaf906d78edf5
SHA1c1f5339f185dfa30385c0bb16a4a4a0a90e1d436
SHA25689356f70821a7561ebd4c88c6d3c4610591154fd07804ac903e53ef3817887e4
SHA5128e993895e854c302594a2246beaf87c9418ba174bfaba2b03834d56af71f32b53d65c55dbe11fb1acd660c551eaf1f17d6a8585d5892f4a83aca308ee5084399
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\AlternateServices.bin
Filesize10KB
MD50552f2fd9e01cf0568d165760523f2a3
SHA1abe7b348e04241965f3743e2d3fc15891c3668a5
SHA256b62b35e605f82ee5583955d1a2ab622e78b325312e23a0d3e4a70d9bc72de392
SHA512a01418e51360368bd9d282ff671d377ac310ff68a1675187366ed8c08a375a7b30a2db540b4cd89738544e8793fbde3e1833e352b7029d72ed59daaffe25c259
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5afe026919868b525bdfa2201bcc1827f
SHA1cd0a930468d11d5850957f98d1cb1a97b06db3d0
SHA2563c3c45222d69fc417909bd31b6d84a4ebe8dae14b1db13f856beb15aea709d5a
SHA5121a53997023fa196b7b2e6b014245bf4a0d9d28bda8737f0cb7be566181f451ac195132a085c309313550f5cc972e803b7279da6f14692dee8fd3279df7b184de
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5a53bb1da515b197e07a233085955a602
SHA1e03546ea3bf33928046d76df0ff69002ff149922
SHA2565ceca4077497f16fa9b99af8013cff6d5ea3b962f57f72d75e3494d634b08d86
SHA5128c8a69aaeabbb306c5af1f23d8a03c926f284c45c19624d2fe26f32d5a3f16904a0de5d46e72bda80d8a4827797bec46612176f4e7ac553111566da7ff07f09f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\pending_pings\3396e9d3-e7dc-4c73-92c1-87ceb872d959
Filesize26KB
MD576ff20bac844c06ce35d9b8126cf2298
SHA15615b10d7e9ef4a76b8e388f505a840728dbb32e
SHA25682252bf767ca23cd3962f5355bbcb2565b8998473086dbbb16073a7f856df7b7
SHA512b09642fca49c97584fd630c967662e4e44fbd33b5f17f3e1f922aca010d1e51293cd15fa508102a3f99711f6a339efd1dd6e76aab9a74174153bb6cd871cdcb8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\pending_pings\5646e9be-bdc3-4084-bfe1-c3f338f17b3c
Filesize671B
MD5979b79bb1ab026d29b60d0b1cf28b20e
SHA1d24c001a25befcc3ca0a7c06a4c7e504fad8d922
SHA25642f0edf183d8e536cdbe97b0f3f5dd20a805a01518fa527343da676884542608
SHA512c1881ea0960368f019745d1cd78f5b122de887c3a3bb2babb7e9290f5a7edac21fca548b806166cf9fcfaba01432db3dc03d74fb1e08214dd4caf53672bbd0bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\datareporting\glean\pending_pings\8dc05ea5-6eb4-444e-a7eb-6553fc13725e
Filesize982B
MD59e58e802606122a17ef33e330c4e83e8
SHA1c7da8c01302617aec45b03a06f532c182d241b4a
SHA2565270983a67e4d7feb867932d6d2f91a46ce20fc5f45a385b4685e72430d688ea
SHA5126bc45dfd5373e2c1c313d27af744e5b05baa68cfb283de98bc9c57a648dae4a1c731a303bd42e12ed9791ad1decffaf8db982165e5ec8172c7823c60ccaca856
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
12KB
MD50c2278b4d28bc165af1d00d791bb4372
SHA17b7db0dad122647fd77743075ce0d729c6783017
SHA25625307d1b5782ca0f254c8515e83bde041542b75d9d572c5dbd499804cf4b9d29
SHA5121640a947b525f3e581aea3e044378b11df9701be150aeded3ae12b4c007e6074922620b0838810b386d26b53d0bd37c129a6e40156fabc5d080f7ded2eceb227
-
Filesize
16KB
MD5edbc75fc479b168c3c76d8242e14fd96
SHA1e1354b9b6bd5e20ff307f0be79b113b52a79d173
SHA256ef938f79b22042ef7241df876f7aa0e24dbf2b670c943f0f816360d6115d9545
SHA5122cf5c4d07b1e0e7dee0db38cc00e272c77e23c4f76de3e40c4a16ffc62524ed3b12bea99491d153404a4cf6edd69819d1f287ef43e8b0f14a403a682ee026bd5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6o52671h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize968KB
MD59dd252fbd2142c6c4460aafe16dc7b85
SHA1342cea49a4ccd06f5b46e62d9e28ad20a16c4689
SHA256b48e4b563102e8316a5b6b2964993a32bbab62857348eb221cdb8c2f6406ff78
SHA51221ac3dac1b73d9aaab305a469872fb11d6a264122b3aed27b984908e987a69dc0d76c9d0132b585145a3a2ed1df0451b8ec93f3854d0646cc0608e5739979963