Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-08-2024 11:11
Static task
static1
Behavioral task
behavioral1
Sample
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
Resource
win10v2004-20240802-en
General
-
Target
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe
-
Size
1.8MB
-
MD5
f557954b5982d5d5e5790159b77a006b
-
SHA1
bb1e26bd6f6c8c692e55e8af0a7bc55dc4cc8a40
-
SHA256
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4
-
SHA512
62d4bddb6cd0de21f343cb8c1a74fb2d782e42d2bea64e4b3f71ee5f669dc1bea9333d0c754b6d68a3bf6475a7d407bd4e57534cae9302f06adb3a87b9641a0f
-
SSDEEP
24576:M++7/TMrfIg/NbRR9kPROMDAqPyOOa4Zlq5PJJzAoh63c2ig8UwwQyGFL4/u0IDB:M1E7bT9AOMFyk4Zch6s2iEww9GFMMd3
Malware Config
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
stealc
nord
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Extracted
stealc
kora
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorti.exef5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe -
Executes dropped EXE 7 IoCs
Processes:
explorti.exeexplorti.exe6a6edf132c.exec6044c27ad.exe7351d56daf.exeexplorti.exeexplorti.exepid process 1012 explorti.exe 960 explorti.exe 3240 6a6edf132c.exe 3044 c6044c27ad.exe 456 7351d56daf.exe 3328 explorti.exe 5140 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine explorti.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorti.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\6a6edf132c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\6a6edf132c.exe" explorti.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1476-48-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1476-50-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe behavioral2/memory/1476-52-0x0000000000400000-0x000000000052D000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 4664 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe 1012 explorti.exe 960 explorti.exe 3328 explorti.exe 5140 explorti.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6a6edf132c.exec6044c27ad.exedescription pid process target process PID 3240 set thread context of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3044 set thread context of 3312 3044 c6044c27ad.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exedescription ioc process File created C:\Windows\Tasks\explorti.job f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exe7351d56daf.exef5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exe6a6edf132c.exeRegAsm.exec6044c27ad.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7351d56daf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a6edf132c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6044c27ad.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exepid process 4664 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe 4664 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe 1012 explorti.exe 1012 explorti.exe 960 explorti.exe 960 explorti.exe 3328 explorti.exe 3328 explorti.exe 5140 explorti.exe 5140 explorti.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1132 firefox.exe Token: SeDebugPrivilege 1132 firefox.exe Token: SeDebugPrivilege 1132 firefox.exe Token: SeDebugPrivilege 1132 firefox.exe Token: SeDebugPrivilege 1132 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
RegAsm.exefirefox.exepid process 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1132 firefox.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
RegAsm.exepid process 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe 1476 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 1132 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exeexplorti.exe6a6edf132c.exec6044c27ad.exeRegAsm.exefirefox.exefirefox.exedescription pid process target process PID 4664 wrote to memory of 1012 4664 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe explorti.exe PID 4664 wrote to memory of 1012 4664 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe explorti.exe PID 4664 wrote to memory of 1012 4664 f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe explorti.exe PID 1012 wrote to memory of 3240 1012 explorti.exe 6a6edf132c.exe PID 1012 wrote to memory of 3240 1012 explorti.exe 6a6edf132c.exe PID 1012 wrote to memory of 3240 1012 explorti.exe 6a6edf132c.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 3240 wrote to memory of 1476 3240 6a6edf132c.exe RegAsm.exe PID 1012 wrote to memory of 3044 1012 explorti.exe c6044c27ad.exe PID 1012 wrote to memory of 3044 1012 explorti.exe c6044c27ad.exe PID 1012 wrote to memory of 3044 1012 explorti.exe c6044c27ad.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 3044 wrote to memory of 3312 3044 c6044c27ad.exe RegAsm.exe PID 1012 wrote to memory of 456 1012 explorti.exe 7351d56daf.exe PID 1012 wrote to memory of 456 1012 explorti.exe 7351d56daf.exe PID 1012 wrote to memory of 456 1012 explorti.exe 7351d56daf.exe PID 1476 wrote to memory of 3568 1476 RegAsm.exe firefox.exe PID 1476 wrote to memory of 3568 1476 RegAsm.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 3568 wrote to memory of 1132 3568 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe PID 1132 wrote to memory of 4092 1132 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe"C:\Users\Admin\AppData\Local\Temp\f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\1000036001\6a6edf132c.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\6a6edf132c.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password5⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4aec3d0-c125-4bec-ac58-2c8203a547a9} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" gpu7⤵PID:4092
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2889b02f-9168-4b45-a981-2a980be1cf95} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" socket7⤵PID:2112
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3424 -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 3208 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e1502e5-d38a-400c-8941-27a854d5801d} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab7⤵PID:484
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 3416 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91002e2b-68b6-47a8-8ef3-7931c35b73b5} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab7⤵PID:712
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5020 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5012 -prefMapHandle 5008 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad7e8915-6612-4dac-a2a7-8b659b363395} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" utility7⤵
- Checks processor information in registry
PID:4216 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5548 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f335907-a7cd-4101-bd30-7a5320458182} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab7⤵PID:5720
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faa0670a-bcc8-4004-a882-7ccaeea8564b} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab7⤵PID:5732
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5884 -childID 5 -isForBrowser -prefsHandle 5892 -prefMapHandle 5896 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7de5c99c-7a2e-4bd8-8816-c274c768e2de} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab7⤵PID:5748
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 6 -isForBrowser -prefsHandle 6296 -prefMapHandle 6292 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1212 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac7514d0-f5da-4aef-aaef-44be27b3619e} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" tab7⤵PID:8
-
C:\Users\Admin\1000037002\c6044c27ad.exe"C:\Users\Admin\1000037002\c6044c27ad.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\1000038001\7351d56daf.exe"C:\Users\Admin\AppData\Local\Temp\1000038001\7351d56daf.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:456
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:960
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3328
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5140
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
330KB
MD56bfbac43f2f89b755e6834525094bd7a
SHA1ea6b15a43afffe46624aaa637fd8c797685b8a36
SHA256f5185c63dd33074e8fb99b3fc5628e4632c325c40022396544cfc792b58dd15a
SHA512f651e1a889c8fe25b54877fd22bfbe71e1f12f7db4d5b17eafb13e8981ee82a71b4b31325893defc499a053b908f15a207f938e247c9947ffafa1193887373df
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json
Filesize36KB
MD5efd2dfdd52b0a097a0edc3bf2294e896
SHA15dc3a460c98900385d3189769e3f7a7665ed502c
SHA25681aa7ac2b7504c90cb72954c4a6d7098b98cb397487b2c7fa0e092a295312c0f
SHA51253d7516cc1935fc1b246f1d5a413f11daa4f82b9c5e65226a82ed4d0a58b4e2c19a9fae52a2cf6ad60867c5c848b6a6f5d6d9e38369ef20ad6f08ef9967e9783
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5bdf2e051a8a51ba025af16cb255b394a
SHA1f6e0423234b7de2772b6948e9ff491976c5364f0
SHA256205cb80c5b8387d0584a380490f36df5d048443fee0b61648027ea8d191af402
SHA512ff17b8127d1cc520723921c6fb8de3df7b8c2652e85c810385ffcd0ec242c25229a44c681f9d7ac6ff590d7131e2c86d54e83a58cfab9b650ad3680c717c5960
-
Filesize
1.8MB
MD5f557954b5982d5d5e5790159b77a006b
SHA1bb1e26bd6f6c8c692e55e8af0a7bc55dc4cc8a40
SHA256f5d291799fa4b9a06d0a9ce3659e5a23d2af9a0078c41e647a39c717cc8a02a4
SHA51262d4bddb6cd0de21f343cb8c1a74fb2d782e42d2bea64e4b3f71ee5f669dc1bea9333d0c754b6d68a3bf6475a7d407bd4e57534cae9302f06adb3a87b9641a0f
-
Filesize
1.3MB
MD52612734765aebd090503d35763541ec8
SHA1ef79c796547bca330b8aa3cdbdee41f633dd4b11
SHA25688fdc3cf67a6103d59c7e8f5461adbf9d9b508241304dbc4e3c66c718b7cf20e
SHA512f6e17c16b5a39d38f41dc4510765e35d041ba298e92a3eb38f450d55fb5d64a3d671008cff5b922b7417c9c3584d4352f669d20cb8ad07102cfe84e51a2966c8
-
Filesize
187KB
MD5278ee1426274818874556aa18fd02e3a
SHA1185a2761330024dec52134df2c8388c461451acb
SHA25637257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
SHA51207ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin
Filesize10KB
MD54926f5699bc6ddc5bbb4209a09590af7
SHA10ca3070c56e6e1c2b86ca507d3fe45b69060e2f6
SHA256c45322a8154f0330de4457237171af8bc9941c8122795fd5d91eed67b77a36e8
SHA51207170ab07f6aa99d1b443a735cbd6b0aff7a70c0bb30f46b2803591428bb40fcfcb110d3ed87d709b76b4e90be2447e8db7873cf60b9151b5477554e5acefe37
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD578d3b24a6d8e9d524a4f1e634eca527d
SHA1b736fb1fd5ab55216ea33a550c524ede0fc42525
SHA256c460abe534e90a84552d31783dbab3170d1fba98501ed93bf304e397ceaa2e94
SHA512ccf22f1c135bf7e8676c06f7577529faaf78fe68e1d1e0e704384be3e74c12f86538aa0804b485c38733e967d70f0714851e79d52c0f086481a670210e599673
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD547c155e5e07e9a9777216ecb4fd49aef
SHA1294e5331eb5548443daf8fa45845048ae3b755f9
SHA25616ed51caa19a5dedf9b6dc8d4db1105889c0dc0b9216048260854beb26584c91
SHA512a40ec645fb2a2b57454d0cd2a65c488911437fcf971c2abaef2c150d6dfb6a4781c4f95dbd142982740ae63b37ff519d6838e2adcdcab5975706da68c1f855ad
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize4KB
MD59774072afbb928604838374cb5ba73cf
SHA1695dc9374e3615ef6f4bc70bcf511c046248d8cc
SHA256909459e9f77a097541a3daf63fbca9d8e5426e18f151656fceca8ef9c4e0a2d0
SHA5128513b6b23991c425123dcf2c573f6aa39faa002f0f5017b953ea063cacdf09e936be59bf8788335ea6c24cecfb026b9780dd4da4455011fad98faa4221c3e733
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5e1251969e23c35acfea9730b2b002d9b
SHA127166dcc7d72978b64218a2f774d4e135b44bd74
SHA25674212d2b319518597ab84c8c5550727df35397c629dcd622c9fa92758792875a
SHA5120b2721195c6b206fbcfe73b13d18b5f6bff40f6df149335dd109b6458d0c746ef156cac327d1c4064730490f42128aeebfa6778b63069ce3d2264f986f3e03f4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD571634da0e1a4578089a12bd39485e872
SHA128fd7d55ff5da644dbf0cb9fd5c6dae68aa38926
SHA256a9bbdc2348690a79825acd18e53651bc205f140bde142e3c881af88015cfaffe
SHA512012f7c511de63c8cd0c7d463fea76bd4a102fbdc3fdf729073f792a402c8be81a922e9d2d800f5a790dded96a3df56dcabd218ad948a008f64505114f1a71dda
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\252e25b6-7e13-4d06-9d72-e27f327f750f
Filesize24KB
MD5c2c1f615a41154eb37afc396182e959a
SHA1b13285815b8fa4369fced1243ae799dab1022071
SHA256fe63f13d8e833b6b07242c8c20d3d7cac4a7ea9a5d245f12249d7ce981030be0
SHA5124641f822c00376a4dd0dc4d006ea1bb143496fdd53008379fbefe13148782e3ba24d16b5fe22289fe0773bb3db42231c61508ec8d6795c84bf5bbb007d9f8ab0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\3c29d7b7-416f-44f6-8e24-d58c72eb05a6
Filesize671B
MD55590f17b4535fae9761e89ccbd5c845a
SHA131956564f1f8b5425ff442c591100f5fd72a15a6
SHA25622a0c658889a5769e8bd3362703d9e8502c102c4c56ff1279601c0e6cc8aefad
SHA51274494e512a10d934d04df5b87aab4002a9b4b411261941faec855b03f742b3ec5ed82627cabdcae2e11f0acc82552e169c11abd3b91e4f3345b86faae7a5e1b8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\5273773f-cd69-4f6c-84c4-083115c3c641
Filesize982B
MD558b536988514655989826ce45bb5529a
SHA154402d73201e9d034f66e55dca7e6314298a4f53
SHA256d1f0605679b05d5924adbd99b7de0834ad3b1973d91f33bffb423ad86216e034
SHA5129d832bfde58cffe510405bd9dd82026d3c5bc3221bc3414e5a872e0a738fa89b916fc010e1131407e4db1a0499479c69e70a6ae96088371b9cf0b1043b318409
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
16KB
MD5bc2a4af7eb83ea9c15e6d79b39287698
SHA14936795723fb2fd45ba1b6c408fab7f13129c9a5
SHA2569e5e932650c5aecdd19cab5c06e6a5103fb44f018aa549d91b1a448fb81c7fcb
SHA5125a6e028a65968d87cc8fad2706a116d299efefc48cfa82d9288d75d8b168430aa8077447529a9b3a294de71f61060d3fa506676bd0e0d8a1150e90e1d2d4a931
-
Filesize
12KB
MD5b6ec562cb65be66bb1cb74ebe56cfedc
SHA1afc5b64e399e6845f399b6d6579464797844bd1e
SHA256032a6b6109e589698a4c4bfe807fa59de970dbd83372421f6ae4644be42815fd
SHA51244bd34af164e6cdf63a84e178716fc215db430784bb1ff9065b5b7ec5c1e48e14cbbf6c20cef02184dc2a748f60f315b2ee3373efa6a9a3863af87390ec0189b
-
Filesize
11KB
MD5dbd0215967bc8faf83920642663f4f77
SHA1ec4d3ebcc1f77c0e3eb458b869238a083dda5f88
SHA256b1e96b1872e6bccdb28a6cfdaa5ac29716db36e9bace6073db9a3e02d006b162
SHA5126c5eaa727ab375d6aa3e2d359f4d262b6f3768c25337794ecd21b6431566c6742351736d0d52c64937041ae60ca8d412787dfd87da22bffaf89e2e9efa62ea99
-
Filesize
10KB
MD5d4e095eaad4b030132d5aefcb38145d2
SHA1e696bde88b09ac56238ed89ea10afc951398b534
SHA256f0692ef09c4c5ee569d67db7b0af5136dacbdf57051a807fd90504f1f0e4758d
SHA5122b5283605c6d3b53a9843c9fc9b2bddb79e1d8a3e4fa99b6fa2eb1238f86acedadcc2f9e7f07416d9a4ae4162ad723af5e4476ce2f5e5821075dacf0c3c4daf9