Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 14:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.dropbox.com/l/AAAiEbuPVG45pX1l86CLXpA9X_tBF2B7qX0
Resource
win10v2004-20240802-en
General
-
Target
https://www.dropbox.com/l/AAAiEbuPVG45pX1l86CLXpA9X_tBF2B7qX0
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3680 firefox.exe Token: SeDebugPrivilege 3680 firefox.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe 3680 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3680 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 4428 wrote to memory of 3680 4428 firefox.exe 81 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4728 3680 firefox.exe 82 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 PID 3680 wrote to memory of 4516 3680 firefox.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.dropbox.com/l/AAAiEbuPVG45pX1l86CLXpA9X_tBF2B7qX0"1⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.dropbox.com/l/AAAiEbuPVG45pX1l86CLXpA9X_tBF2B7qX02⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2f92b4b-5b69-425c-9290-1a71fb1c3a80} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" gpu3⤵PID:4728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07f6b013-7ce6-4e8b-980f-e86731521e8b} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" socket3⤵PID:4516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 1 -isForBrowser -prefsHandle 1304 -prefMapHandle 1408 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {078caec0-9042-4c5e-a314-a767ec6a24b9} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab3⤵PID:2540
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3428 -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 2776 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {616b9178-7aa4-4718-bffc-2c7676d7712b} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab3⤵PID:3256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4112 -prefMapHandle 4132 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc152db1-64db-43f3-834b-66d69b1183fc} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" utility3⤵
- Checks processor information in registry
PID:4168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5264 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33ec7610-44d7-4ede-8f05-e0376903c22f} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab3⤵PID:2340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5536 -prefMapHandle 5544 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e87e07c7-e73f-4abc-9992-47957c956238} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab3⤵PID:1040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5732 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd27c84f-3b90-4682-88f1-0fadf6e29332} 3680 "\\.\pipe\gecko-crash-server-pipe.3680" tab3⤵PID:4008
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\activity-stream.discovery_stream.json
Filesize27KB
MD5f681ebaefb3752684669ea4f2479ca7b
SHA16d845f91115a11809541da50578d6080e2cba16d
SHA25623640de48a15472a83a62b86c24ce278aa4cbf04e501d03da41b83314f3f6411
SHA512ad01d084b6f902e4ffb7855ef3c0941ea7e2ad4c9ea71cf9c5447c28c4088c54b5eee85192295f9aa1761500fdf5bb2f23b54cc89ac89c241f76e338474cef0a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Filesize6KB
MD58e088c17100a1b586b53b02b669b5d9f
SHA1769bca39a33199cbad31c2055ac609c8ea160da2
SHA2562eb681665ddc6b17f8fa548498a87146477e94540d93b9fe0c01ea2263a10d36
SHA51295a58c4b5b6d7b57aa08682aaab3eff15cc82fccd49b5282b79fcddd564c09de4b4e4726142da04b1827afca341b1924747534e5a33aeba0e41b81ee60557182
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin
Filesize6KB
MD5917e44bba5e2dca9c5f5875dd6f46740
SHA13bfcf6afca7fdb5f2c00c9eeebbfff5508e8d425
SHA256d92c0fa12b1dd5083139531ee79c3f3a465b633f886aba764a84b037ea525c7a
SHA512a2271fc4db195df63bb4fd6533d328079d9425783f5b71dfc50cbf1c02283d6c453b593b771627aa32c88cb4040793f822314268e2218b26655e4c7249fd0bcc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5d83a4f3f21494cf04bff9eb47c217c32
SHA1f598b5c139e4c625ff2e7222e260c01c3e58e973
SHA256b20d431304989e62cc4896a4b96bdbd6cb9c1e42ac2dc1f689803e048d5da756
SHA5128551f12948a95d48a3e75c67f233b462538e777cf9c09a1d553b897e5ff261f636403316b68d05372b8786850db797247761827321b499c68720a50b4ecbdabd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\0d4568a2-c7a4-4d08-84d0-e48d699488ec
Filesize982B
MD5375935bfb73982a9ed0c3aeab48603e8
SHA1e6fbc0c4a43a97b0b90be80561fb967de229615d
SHA2561f7647fe4387a0f4fc0dac20dfddd233bde7c3c482c55746ecd725b57ccd403a
SHA512b4561fc71b1e5736a0e38c5481de264f2222c2eb5a60cf74213fd6db137f9686ce7de6f7b2ecf97d1de812036df7abe8249982d30751bf2e8682f2ffffd58283
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\2bc4bd67-d5ed-455b-bdfa-8c13db72537c
Filesize26KB
MD58a5f7bc676246fbc75426c19e997ea39
SHA15eb5c1d51a635738ec2a3bbaa3d355c3dfa2bc53
SHA256b0ca2b602d20eb4ed97e1850c3638c4c663f5a03a1d7460a87e8cc43dae158a6
SHA512b893e7fef7ec22c178cfb065b2854481aaf65ae1905c79134309421a4d5163e409e33f90158cae6f5c0ae3cba8e862fe2c5c873cd5ea57b49f9c5f53b02639b2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\763a2a83-b8cd-47c9-a5d4-bbaac016ea47
Filesize671B
MD587e73f85541dce1556592e8dce3453a3
SHA1041bab0b46237617d4268bad157fa63bc61e6b0c
SHA256d3bae979850f9490588891d17ad24c49c553123600d362c2523d5303fbab54d7
SHA512e26ab29f3abfb536e3d30a2a666c403b25898e4398de3d5f8814c795ae082faabed70264726a1d9a9482a328e8ad8f305b063f70b79d9b0d2dcf00847027037b
-
Filesize
11KB
MD52a63010f836749a19b73c241d28aa497
SHA1c71abebc74aa8670dccf076ebce701b86eeb059c
SHA2566f9a61c5147029ce87ca802ff2df94b9e81fe0d96a03521638dc16885fbd79dd
SHA512ff9eb0a9d2ca17938c0442c58868f816bc2b2f2bfbd564716d25e4c1eb36c508e790b3e4b42309dafa138f643c4530546e9c534838d4d2d55b27fb148c9396bb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize368KB
MD50858c817b1070f1e765c8dee383217fe
SHA19d1359e988aaa08e5d0b1cc87cc0ad096fd5670e
SHA256e5157506ce78208b60d78755e8fd5cede3673e4601e54033664dca3965b9f563
SHA512fe874a9379bc8f922fcaf877c7410f51bdccba2bef6cdfa1b65d06d35bf5d89c21a4527cb9b26dd65d07779021128c63c699f2b2e424add08b22ef25807dc815