Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/10/2024, 15:07

General

  • Target

    https://mail.google.com/mail/u/0?ui=2&ik=acb34b308a&attid=0.1&permmsgid=msg-f:1811989058793170946&th=19257a72da42e802&view=fimg&fur=ip&sz=s0-l75-ft&attbid=ANGjdJ_AAQWhie1MIdowMh398L-kghDWMNm_KL8c768oK5RRYSIvMiCNUQjq6kBdQFIwjXO4pbkHZoOsnrM8KNzhVv4yIMz_rdxNR2Aq2nzzNCjdQbniERHIE-Uoj5I&disp=emb&realattid=ii_19257a6bdd14cff311

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mail.google.com/mail/u/0?ui=2&ik=acb34b308a&attid=0.1&permmsgid=msg-f:1811989058793170946&th=19257a72da42e802&view=fimg&fur=ip&sz=s0-l75-ft&attbid=ANGjdJ_AAQWhie1MIdowMh398L-kghDWMNm_KL8c768oK5RRYSIvMiCNUQjq6kBdQFIwjXO4pbkHZoOsnrM8KNzhVv4yIMz_rdxNR2Aq2nzzNCjdQbniERHIE-Uoj5I&disp=emb&realattid=ii_19257a6bdd14cff311"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:168
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mail.google.com/mail/u/0?ui=2&ik=acb34b308a&attid=0.1&permmsgid=msg-f:1811989058793170946&th=19257a72da42e802&view=fimg&fur=ip&sz=s0-l75-ft&attbid=ANGjdJ_AAQWhie1MIdowMh398L-kghDWMNm_KL8c768oK5RRYSIvMiCNUQjq6kBdQFIwjXO4pbkHZoOsnrM8KNzhVv4yIMz_rdxNR2Aq2nzzNCjdQbniERHIE-Uoj5I&disp=emb&realattid=ii_19257a6bdd14cff311
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.0.872839756\1695560782" -parentBuildID 20221007134813 -prefsHandle 1692 -prefMapHandle 1684 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eca469b5-1122-464a-b61d-c04604411230} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 1780 1f4ef208758 gpu
        3⤵
          PID:1888
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.1.691895380\186397324" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf994bbe-161e-46d8-a016-b4aad20e48c6} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2156 1f4edfc3558 socket
          3⤵
            PID:4800
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.2.460888899\1127516340" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51e1692a-0215-4b27-ace0-3e1b7aa67f19} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2940 1f4f2404a58 tab
            3⤵
              PID:5116
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.3.1306660482\1365549378" -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a63f2719-824b-4f8f-9ae7-47acd2359eda} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 3676 1f4f37aba58 tab
              3⤵
                PID:540
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.4.1349017216\906757650" -childID 3 -isForBrowser -prefsHandle 4680 -prefMapHandle 4644 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca21c5a5-696c-47d5-af0c-a24b2612e85b} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4684 1f4f48b2558 tab
                3⤵
                  PID:4704
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.5.56845961\1137603290" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4828 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be229028-1656-45ad-b924-1d568aeb3c34} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4816 1f4f499d558 tab
                  3⤵
                    PID:716
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.6.1141156732\31757852" -childID 5 -isForBrowser -prefsHandle 5016 -prefMapHandle 5020 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74baa843-80a6-4a8f-a62e-07ba24ed5bb9} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5008 1f4f499c658 tab
                    3⤵
                      PID:4648
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.7.1957001632\1461825222" -childID 6 -isForBrowser -prefsHandle 4876 -prefMapHandle 4836 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4676eccf-ba56-446c-b4bf-30703aa84470} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4868 1f4f6277858 tab
                      3⤵
                        PID:808
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.8.1498250382\1494880019" -parentBuildID 20221007134813 -prefsHandle 1200 -prefMapHandle 5536 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f3ec1fd-b91e-4498-a51e-db8323191625} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4300 1f4dbc5fb58 rdd
                        3⤵
                          PID:5028

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      a166f1be68b88810e0ed94ac42a4a79b

                      SHA1

                      c118dc422bf06a0b4f2af70092b17890f88cd010

                      SHA256

                      dd423371a924510932062f724423685e84a4597aeb4d0dba02d3649d9b37fc6c

                      SHA512

                      0ee98e25087b3ce55b417d5eb687a471e38418b41ab39663eeebfe286799b9a937560d7ccbd4bdf7270458ccb641e3cdbf3868d914c423f14da13cdb1d08e217

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\624352c8-9c79-4545-bfe6-8826dbee674f

                      Filesize

                      10KB

                      MD5

                      799b013e44e7a1a569623903248356d8

                      SHA1

                      ccfc4f8b38cb47d01278d12979199f99b5a7f59e

                      SHA256

                      c31e3a490c4b2318882753dbe4a283a65203c68271bb551fba23813b9ce888f4

                      SHA512

                      eb8520388a3fd80f255a4a5d0cff12f2954294c4d21558963d0b61820e86abc2af0aa71c8ae1a4ed88759a043f8e1e85daebcbc370714d420a96d22901b62d7d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\71da4de7-76e3-4b23-b05b-a880e651406f

                      Filesize

                      746B

                      MD5

                      809cef1715effa12e099fd8c20161b15

                      SHA1

                      9e4fd9d0fa4cf7ce6e09fe07de2c5dcad1b0d986

                      SHA256

                      5b28c97cf6f4d25f1812a3a976909534452f3b28f71cb2ec3a794686f8d3533f

                      SHA512

                      139e7bcaada923d90ecb6992bbd935af95e5f3aa189cc6e4bd30c8ea150bcdb78f49ebe189f85126c59caa467998adc8aa6215b9d4a4a7e0a82b1f520e65e49d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      d78543b1136dc1e74950cc52a68716d2

                      SHA1

                      912858cd4943d761dec343b356aabf477c0289b7

                      SHA256

                      72310521a67544b6223468ea377cb739cf347a5e6d0cfaf48515a2aeaab6b409

                      SHA512

                      c5c08d8a2aa4ed356c03d0d8d00605cfeb69cdb8c550c4e0ba1df6fda26758215ab51943f71ff9ec10028e2dd2d18d56527637ac18415d82fa5622b3714b806e

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

                      Filesize

                      7KB

                      MD5

                      ce549ddb41739355aef5feb4875f5f2a

                      SHA1

                      e7b2033370335f38c0cf8ec7f2e693b2eab928c3

                      SHA256

                      da747f96eda48ff121cbca49e476815247701a2d74897b0dc27d26e93e099ba1

                      SHA512

                      46c77dc385bac7db82587e17fcff6d734899a17bf00d8ca6de8e02be356e530287dffa65b376db8c7583819f3ae3bd2f50ec20ed5ed06aefeb0fa98ed7e2fcaa

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      be3a443854d1807be254387bb3a88780

                      SHA1

                      41a666fcef6c27ae68d177ba11f2d8cdd15eef25

                      SHA256

                      fbfcd278f77015ce7fd2a4351c5926d707f982547a301ae9188e2b57ce85718e

                      SHA512

                      27988ad6be8993aa542bd75c9190d0d0d129a18bce2e2e4cf8ade46ea22063bbbc54d88e6ac9a51e28e76f12f5f3b69ffef24519ef1178fbfaeb80fc2cd16938

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      6KB

                      MD5

                      94764e398d816db4953d961c1f47b57a

                      SHA1

                      43863b46f4021e5b81518c108349c24c4cc180cc

                      SHA256

                      41d5648428b62ecae5411ad032fbf712dfa1fb8553031d78cbb33098dc0a0186

                      SHA512

                      a0fd104e6a8004bc2558dc32ed28139357170b980d81797062f06f06130c68d35e1bf1c5bd353fb576e3c8f170951aa7b0f6b88229d9d998ea957fef115ec9ae

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      7KB

                      MD5

                      e7eb74e250c06727a707cd15897d6c34

                      SHA1

                      c0d3ff8e7ed4d87ff0af4b201d766dc1fcc27dde

                      SHA256

                      10042ba78a2296442ebd27ae9361d03595485294e39b9e28e576f202185d30c1

                      SHA512

                      82eacb8c32c46ebc11cdb18d4f310a96f51909e2bedd7fce16bd3a0390f44856256c3eca8cac3a8a55b09ebd246adc2fb53c8d37d093aae76263f05cc8f6f43d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      6KB

                      MD5

                      3c67cf2865b836be4637c1bf712ac646

                      SHA1

                      93e49f02b0d0062e4704d04ffaba798dafbc0935

                      SHA256

                      5ccc298761c03e8520538051cc6493f357920e9e2eaadefaebea5a859c5866fc

                      SHA512

                      bc7081818b7f45a66660e82a154fb21b5a3dface94eb06a32e6802bac1312bd0e98d7a7f1c8d9a86960356c4012eaf67b9e6b5652b184b78e321d301fb1997fa

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      25KB

                      MD5

                      e49d2d79c468c0ee78cf1de118096eb7

                      SHA1

                      aedac1104b022e029bd84a36ac1389fe5b3cfa6f

                      SHA256

                      0d725da30f44aa40441ce42124c76b936443c2f2ea19d934498d81fa1a377340

                      SHA512

                      0b81865f7ae7bb1c7ea3f368054a22a3b277adaa0f373d4290b04ce445c4f859afcdcbb59cf6b8f2a27533ad569b1d662720e9bc42b84a34d1766ad9bff28e20

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      184KB

                      MD5

                      3fce64c3cf23f070dbe67b544cebc92b

                      SHA1

                      84d5104a0aedcb8c73e2ce79598ae97d8190fb8e

                      SHA256

                      21679f659e81fa16d78fb675003b34c8cba5d361da34399b1938ab1a86e4590f

                      SHA512

                      8f99e44cbc39b256ae6087d962cdc1a31dc674ea3542eb48e55dbcd2ff8c3602ea8940373d8429036e86b2340e3d1cb267dee7bd97890c861601f212f6dde2b3