Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe
Resource
win7-20240903-en
General
-
Target
41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe
-
Size
3.1MB
-
MD5
23c7b9248f3dad496485fad4eaadd5ea
-
SHA1
76ac41eb3213710941c32bd8a07fa2e6b7ecc826
-
SHA256
41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb
-
SHA512
eebaf1961274ea345d5fbff45f1453fb89dfbf9b15f9fcb3beb6f29a133af3e3d81a8428c022f57d5c922cebbd48842559fc788b37cc70e5219356472ca6ab38
-
SSDEEP
49152:jmqDbVLbPxHuTnc4DTZDpGpEWFuWB0g7XWDh9VYwlMXY1oUATNp:qqDbVfPQTnc4DTMEWbjrWN9VYwWXEsp
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
xworm
5.0
127.0.0.1:8895
162.230.48.189:8895
ZRGtN7NDh24Vx89x
-
install_file
USB.exe
Extracted
lumma
https://founpiuer.store/api
https://navygenerayk.store/api
Signatures
-
Amadey family
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/7876-1574-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm -
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" f048cb047f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" f048cb047f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection f048cb047f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" f048cb047f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" f048cb047f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" f048cb047f.exe -
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 5916 created 3504 5916 tmpEC63.tmp.exe 56 PID 2944 created 3504 2944 tmp601C.tmp.exe 56 -
Xworm family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e8421c4fd2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f048cb047f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 01d495da8e.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 01d495da8e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f048cb047f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 01d495da8e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e8421c4fd2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e8421c4fd2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f048cb047f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation skotes.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DL.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation pmxxqk.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation tmp601C.tmp.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReturnType.vbs tmpEC63.tmp.exe -
Executes dropped EXE 11 IoCs
pid Process 1748 skotes.exe 2400 01d495da8e.exe 2900 e8421c4fd2.exe 4536 62e8f9926d.exe 5748 f048cb047f.exe 5508 DL.exe 5916 tmpEC63.tmp.exe 5064 pmxxqk.exe 2944 tmp601C.tmp.exe 6488 skotes.exe 6404 skotes.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 01d495da8e.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine e8421c4fd2.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine f048cb047f.exe Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features f048cb047f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" f048cb047f.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\62e8f9926d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003911001\\62e8f9926d.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f048cb047f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003912001\\f048cb047f.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\github_install = "C:\\Users\\Admin\\AppData\\Roaming\\github_install.exe" tmp601C.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\01d495da8e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003909001\\01d495da8e.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e8421c4fd2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003910001\\e8421c4fd2.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023c76-69.dat autoit_exe -
pid Process 6832 powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 1276 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe 1748 skotes.exe 2400 01d495da8e.exe 2900 e8421c4fd2.exe 5748 f048cb047f.exe 6488 skotes.exe 6404 skotes.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5916 set thread context of 7876 5916 tmpEC63.tmp.exe 129 PID 2944 set thread context of 7560 2944 tmp601C.tmp.exe 154 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8421c4fd2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62e8f9926d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp601C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01d495da8e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f048cb047f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pmxxqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpEC63.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 5 IoCs
pid Process 952 taskkill.exe 2464 taskkill.exe 2136 taskkill.exe 2436 taskkill.exe 444 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 7560 InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1276 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe 1276 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe 1748 skotes.exe 1748 skotes.exe 2400 01d495da8e.exe 2400 01d495da8e.exe 2900 e8421c4fd2.exe 2900 e8421c4fd2.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 5748 f048cb047f.exe 5748 f048cb047f.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 5748 f048cb047f.exe 5748 f048cb047f.exe 5748 f048cb047f.exe 5916 tmpEC63.tmp.exe 5916 tmpEC63.tmp.exe 2944 tmp601C.tmp.exe 2944 tmp601C.tmp.exe 6488 skotes.exe 6488 skotes.exe 6832 powershell.exe 6832 powershell.exe 6832 powershell.exe 6864 msedge.exe 6864 msedge.exe 1848 msedge.exe 1848 msedge.exe 2944 tmp601C.tmp.exe 2944 tmp601C.tmp.exe 2944 tmp601C.tmp.exe 216 identity_helper.exe 216 identity_helper.exe 6404 skotes.exe 6404 skotes.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 952 taskkill.exe Token: SeDebugPrivilege 2464 taskkill.exe Token: SeDebugPrivilege 2136 taskkill.exe Token: SeDebugPrivilege 2436 taskkill.exe Token: SeDebugPrivilege 444 taskkill.exe Token: SeDebugPrivilege 4612 firefox.exe Token: SeDebugPrivilege 4612 firefox.exe Token: SeDebugPrivilege 5748 f048cb047f.exe Token: SeDebugPrivilege 5508 DL.exe Token: SeDebugPrivilege 5916 tmpEC63.tmp.exe Token: SeDebugPrivilege 5916 tmpEC63.tmp.exe Token: SeDebugPrivilege 7876 InstallUtil.exe Token: SeDebugPrivilege 5064 pmxxqk.exe Token: SeDebugPrivilege 2944 tmp601C.tmp.exe Token: SeDebugPrivilege 6832 powershell.exe Token: SeDebugPrivilege 2944 tmp601C.tmp.exe Token: SeDebugPrivilege 7560 InstallUtil.exe Token: SeDebugPrivilege 4612 firefox.exe Token: SeDebugPrivilege 4612 firefox.exe Token: SeDebugPrivilege 4612 firefox.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4612 firefox.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 4536 62e8f9926d.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe 1848 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4612 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 1748 1276 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe 87 PID 1276 wrote to memory of 1748 1276 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe 87 PID 1276 wrote to memory of 1748 1276 41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe 87 PID 1748 wrote to memory of 2400 1748 skotes.exe 93 PID 1748 wrote to memory of 2400 1748 skotes.exe 93 PID 1748 wrote to memory of 2400 1748 skotes.exe 93 PID 1748 wrote to memory of 2900 1748 skotes.exe 100 PID 1748 wrote to memory of 2900 1748 skotes.exe 100 PID 1748 wrote to memory of 2900 1748 skotes.exe 100 PID 1748 wrote to memory of 4536 1748 skotes.exe 102 PID 1748 wrote to memory of 4536 1748 skotes.exe 102 PID 1748 wrote to memory of 4536 1748 skotes.exe 102 PID 4536 wrote to memory of 952 4536 62e8f9926d.exe 103 PID 4536 wrote to memory of 952 4536 62e8f9926d.exe 103 PID 4536 wrote to memory of 952 4536 62e8f9926d.exe 103 PID 4536 wrote to memory of 2464 4536 62e8f9926d.exe 105 PID 4536 wrote to memory of 2464 4536 62e8f9926d.exe 105 PID 4536 wrote to memory of 2464 4536 62e8f9926d.exe 105 PID 4536 wrote to memory of 2136 4536 62e8f9926d.exe 107 PID 4536 wrote to memory of 2136 4536 62e8f9926d.exe 107 PID 4536 wrote to memory of 2136 4536 62e8f9926d.exe 107 PID 4536 wrote to memory of 2436 4536 62e8f9926d.exe 109 PID 4536 wrote to memory of 2436 4536 62e8f9926d.exe 109 PID 4536 wrote to memory of 2436 4536 62e8f9926d.exe 109 PID 4536 wrote to memory of 444 4536 62e8f9926d.exe 111 PID 4536 wrote to memory of 444 4536 62e8f9926d.exe 111 PID 4536 wrote to memory of 444 4536 62e8f9926d.exe 111 PID 4536 wrote to memory of 4512 4536 62e8f9926d.exe 113 PID 4536 wrote to memory of 4512 4536 62e8f9926d.exe 113 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4512 wrote to memory of 4612 4512 firefox.exe 114 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 PID 4612 wrote to memory of 4768 4612 firefox.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe"C:\Users\Admin\AppData\Local\Temp\41b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1003909001\01d495da8e.exe"C:\Users\Admin\AppData\Local\Temp\1003909001\01d495da8e.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\1003910001\e8421c4fd2.exe"C:\Users\Admin\AppData\Local\Temp\1003910001\e8421c4fd2.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\1003911001\62e8f9926d.exe"C:\Users\Admin\AppData\Local\Temp\1003911001\62e8f9926d.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking5⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bbc0f80-3268-436d-93dc-517c9f771526} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" gpu7⤵PID:4768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02cf7f6e-6175-4687-9775-80ef8340321f} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" socket7⤵PID:1380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2884 -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 1232 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8a8e682-44c9-48bc-9c66-53252958360e} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab7⤵PID:4008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -childID 2 -isForBrowser -prefsHandle 3572 -prefMapHandle 2800 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82b55423-7919-45dd-bc3e-8f34cd8cff55} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab7⤵PID:2308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 3452 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64232f9b-af2e-4edc-8e35-a7c61928afae} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" utility7⤵
- Checks processor information in registry
PID:5216
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5292 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64203793-3065-47ed-9d2a-df5c8c1c8fe9} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab7⤵PID:2184
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5608 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {896b754b-b357-4294-9907-5df252682a64} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab7⤵PID:1044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5808 -prefMapHandle 5804 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bac69d20-4464-4bc2-aacd-a9589cef82e4} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab7⤵PID:4688
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1003912001\f048cb047f.exe"C:\Users\Admin\AppData\Local\Temp\1003912001\f048cb047f.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5748
-
-
C:\Users\Admin\AppData\Local\Temp\1003913001\DL.exe"C:\Users\Admin\AppData\Local\Temp\1003913001\DL.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5916
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:7876 -
C:\Users\Admin\AppData\Local\Temp\pmxxqk.exe"C:\Users\Admin\AppData\Local\Temp\pmxxqk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\tmp601C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp601C.tmp.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "https://trashycontinuousbubbly.com/wkhy5rzh2v?key=8f87e6d0bc0d653ad051bd077c8dd5ad"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://trashycontinuousbubbly.com/wkhy5rzh2v?key=8f87e6d0bc0d653ad051bd077c8dd5ad6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff98c7e46f8,0x7ff98c7e4708,0x7ff98c7e47187⤵PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:27⤵PID:6848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
PID:6864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:87⤵PID:6900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:17⤵PID:6936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:17⤵PID:6972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:87⤵PID:7476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:17⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:17⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:17⤵PID:5948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3049003950628957979,10904142326692542838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:17⤵PID:7860
-
-
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:7560
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6488
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:7076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:7796
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6404
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
5KB
MD5987cbfecb7fcd885a2ad19d671eabc91
SHA16dded4a1df539e3952f184406330a6adcc67bbd5
SHA256303bfa572242e22007dde0cc5d4d9db3b92348dcdd716c27d5b5787b591ce71d
SHA5125e2ea6d18c9541389cfc508542454199ccb108799742791a8462bbb8262ceb1137783b9c81a2144853a906ab42f052cce21a16ed64b1db592cbb9d0996848838
-
Filesize
6KB
MD513af049f3a34805936e4ddb5b9172d8b
SHA196e44c2529906d40bf0c30cacc9f79c7010eaafd
SHA256644323c9ae7b2dee8d8fd233d7d88ad303b28841a5a56d2eab9284e725c4ccf9
SHA512a4cfc7404ccf6476f7f4acdff0e119d3176c2be504efcba5c839ec2dacc56002c87e058c3100b96106ec2bc3863dd70c1b8c388d8d3a217c0ea63327013a0a3a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ae470c27219f9bd1f21499c1eff0d1a8
SHA18af41f48450d653680de3aab0480678643cf570a
SHA2563a46ba7ca501d24f6c880e1cd6761a30830326d586b6656448b43b85e2889491
SHA512417aa5ac207d611b0db9c02ab5447262320f266a668cd3d05c7313f972b6241708954001ab935b1f4ede2ba8f46a21baee46b586c4b4b2d69bac6e7dbd8bd562
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
Filesize21KB
MD5e84ee9fe853e4a115ffa3302d6efa5d9
SHA1ccc388f08b1dd0c3b0bf8897ff6569f6b2a414c1
SHA2568bd40fdb7ddf2201d2d58af883b049c2e6ff99fa0796926715fee2d9d9c863ff
SHA5126a3f2a63620a9a216db7d8601122c1933645f9d1ab4fb93f6bd0a5cd883ec8250cb5c265375343bf0dd3f4839b3ea481d2c32e4b3a069a7e8bf9e9475a7367e7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
Filesize13KB
MD55727b6990382efd6503e8bbc74f04661
SHA1c7610dd1bc565165a2a5fefa782a379d2d2c41de
SHA25680ea717cbb673de674aa97837249a4de9fd47be82151f7b7376d05e069c40c17
SHA51269e5340af70384a34a6928086174d58f82561b93775bc950726eb84d0a813ab5561765a219027f358a4b8bedb40e267507083615b59e25be925c7c4f5eb31163
-
Filesize
2.9MB
MD594f7fd12c529bc5d28be7319b857e96b
SHA180406621106c9f98a1991449ca11c1318edcf1df
SHA2562367242ede5c10e68fdb4a893d23a8257bbe5e78347e6e24676cbe36139e25ee
SHA5120e79e876bca1dc042cb35d6d5233b7b683e7c9bee1a933740e41c75a89bd91e0f4ff2093cef82d6771a332ec03bc64833cb6169abac23ef047dc753ec0c1582f
-
Filesize
2.1MB
MD55c4e5d818a24cb9d69fc18ce0dbbd9be
SHA1618a41b2cd9fcd1307a120f3cd78b86862b25d4c
SHA256c2295f41e3e74394823ebc9f99265d4021de67f36e3c257600d610781e2f4ffb
SHA51293dcc942a9adc63d7457106277e65d0c665c9215d47e266e3fa061ad3247e763747ae5fbe15e255995b674322a65635479eb0b6afd81e5db9f6fc997e96619a8
-
Filesize
898KB
MD512518b43b577eb06efd2228acd9242ed
SHA1a3f3a15b4322935d70129433e85ee82fe55bf3fd
SHA2569aa23f52e1217cdb6992c4ca1c7ffb1d79bab7d9112880de31c2c97fe424655a
SHA512ab32e80eacc5b3402d304f55e8f620e5c13ed9adc7397414c1f53973219d3b88eb6850d98ff0de08e453353c1a1481e9562883f400d29fdf852d1372ea741f0d
-
Filesize
2.7MB
MD53e4b74b9abf11b36e842cf2562437021
SHA1b10240f81d9b2250802f793bb44a41736130f5a0
SHA256ab45978faf4521e697cadb7f266f73167d449819ebdab39a8e57fcee8a62174e
SHA51299cc29d9da1126b4d9e432fc2729206772a1216f9f1b2def24f9e52bc888496eaec4f421acfb69eb3a14a729184b5cc20105f2f1f70eb2d078d125f9b9220fe6
-
Filesize
16KB
MD5acfdf588da4f3d02f8b4e6db8cc9e60d
SHA171bc876820b36d478f65cb9f236499d8c98a7fdd
SHA2566425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9
SHA5123698487d35e5d12d013c4f986375191e645038fa3199d7950c03370c085533aa6da2710ab2c9b7f200d5625c90b39bb5580fbf0dfced9cad6ebac86e001d83b8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.1MB
MD523c7b9248f3dad496485fad4eaadd5ea
SHA176ac41eb3213710941c32bd8a07fa2e6b7ecc826
SHA25641b79f79ef00c11cb34bad34697b984bcc7411a13dc3c276247abf07e5d607eb
SHA512eebaf1961274ea345d5fbff45f1453fb89dfbf9b15f9fcb3beb6f29a133af3e3d81a8428c022f57d5c922cebbd48842559fc788b37cc70e5219356472ca6ab38
-
Filesize
5KB
MD5a935a6bef40cd45cac42da267be89cf7
SHA13a861c7dd590ef58b5d14d0d7f614cc05d4f9446
SHA2563e2b0853a60dbe619179aca70b5c560cc81bb1bff1fb9eb18c92442ffb5f7646
SHA512facc4774bad84df1bc84e2f60531482d93496cf250979168368dcdae8f68164beaff93901776ad1da366653c9b55e686ba41db3ae85c49f08178168c65cb1ce3
-
Filesize
1.4MB
MD5d53cbe20ab628a9619459367ba42ae5c
SHA122a66b3eecf462519abc249bda2e4b28439fc639
SHA256a2405a789ade187fe954ae0e9c82fb97ccfbd306bf5b1591e2b8a29e0555ea4b
SHA512ca02bf41e682cc526aeff93d7527812b9903bc61296170ca313939fe7e7daf4ea6dffc81daeac137c6d6d651a7d98ee60408053415bcdd1b662dad4f4a11eca8
-
Filesize
1.3MB
MD5a4c1ea4b6e69e69462efa7659ff6f48c
SHA1cf71024bf28f10f63bf7cd27dba64d406c2ed97c
SHA2561abb33b881408b0341a530de14b0afdb88b96ffcd0254dd397848db3e6508803
SHA512be527013711f308bb9a0deb65b11066570e86cee896041d55556dc8566a2476bc96ab089ca155030397d95fd8d358170bc2f5b0bf97efd579dd464b1ca803507
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Filesize7KB
MD5b7e816bc123498fc707b7cc9c24391a6
SHA14c38078b72315c751aea8590fc31a6e5fc8c31bc
SHA2562107fb664929e847fecbc667f6ba5f6dd9f09b2657908de27a1f173dd1f3e5d2
SHA512a5fafb7c91c443426f8744d53a0bf9a77f6887f0a0ebfe916dd86e3b245fefbfd01c7b5e2ffc2d3fee569654f9c3932f968c054fd028d4bab9986c36aa5be673
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Filesize10KB
MD53ff69def1268d0c06a659c39a9b0c32f
SHA1510cc1720815bdf4f025ae9238f0059c708421dc
SHA25604e785c5c767a8f8a4567b9f768b4eed04cd5fbbe57afa0379bbb45c47ac6752
SHA5128346619c00d4fc11bcf66ced642ecf5e6ddfc491d802258e8f5df7341fb182b4cec7858269d773d9b7c3c2aa06ef08e264799232002e4a8eb9f97e677da6719a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
Filesize18KB
MD541d4e8fb98c459f58479c57d5ee22b11
SHA1f99c01b95d152606318545da47a23510753516cd
SHA2563b3538f1db2af4959ded9d33366f398f6e501c7533fa0c94beaa53200b9b31e6
SHA5120ab001c6aa47f054d25c14b1537fdfc1c2d6818ffdc821f2ce16d138e70f12777168dc2cb7de0d14082a453dbf4d21318bc9d89caa9c42615ecd09ce52975e11
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5b31369af1ad7042a2454150cd8b3feec
SHA14130b6eae50911aace2012c680405c34c2215d1d
SHA256842995c43e27912ed57b0dc4e37124025146650b3dd58edd12e0b2790fa06774
SHA5120d8223d4cc7d089a464e449847b9c44dbba6cde72faa71015efa075d2051c1208c2071d0459ba449ffc6b5d6383025a1b26ffdb50e0216859773b582ddd7ce52
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD5b36cf78634d74eb4e71409b31f7e5ec4
SHA12459db68616ebf4da3f07ad8939e3f09c1aa1b4a
SHA25654cb3997446de0390bfc91f0c5ceb08e297267f2e3355060f5aeff390701f0a9
SHA5123b48822ad01e71ca3fe624b5009305f45b89cbc7fb2372fa03e359895145b36acdca90c2b87a8db301f34593f8d2abd8403415cfdedd11fb736fcefcaaf8114e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD55fae02a10f7faf43d515fb088e4c405d
SHA1efa80bb952bc5180118d8be444b6d8809d7435c8
SHA256822d85e1bee64e8a9ce50f68e57f7b394d8216d5466f7c91ccc8680f5493cc60
SHA512c171d959fe9144f34efcddfd72883f0bb1840cf219bf2d55dab8799fe4c193e27ae48f10a85db47599390f4249dca116c5e45665c372eea679c5437de9997a62
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\3950d96a-5981-4b9c-a454-40ad235260b4
Filesize26KB
MD5fdb001a7e7bbe54763e559d4aa388ac4
SHA13797e44644fcec230cba7762200d24c6a5dc40eb
SHA256182fc36acae9e053fda25d336adf511e2d71dc25138be9221617c9504455bcbd
SHA5121693f78aa70ab739914eb455548169fd290f827900663383fbc814ff0e0683429c7ece4bc99b9bbca601f92da4951c52936e1c32a87519cd6c6edfa4e7aa9888
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\6e972637-6c7b-48a9-a73c-8d744cb9ad2c
Filesize671B
MD51ef94dff8cdb37cdc5328d7b192003c9
SHA191fbdde25d693d150c5519702ceb2aeb83bc7500
SHA256f9928b45af1f8f14c2624cc7c684d742e2d139e69463ab52ad163b7b4d8bcf23
SHA5129bd6b433d268aa6427c7937a1b83e0867a9c522a32a56b499a3c7d45ab9224a88f35a7b0b547dcbcfb61f0bd153d980f5485bc77810c4c4c2fad31f6bfd123b1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\8106088e-7540-4eae-bbd7-24f34013eec3
Filesize982B
MD5b3bce3592ba4c110f7528d09887d5177
SHA1f3dbd50f07fadff06b9adabe0908b8b3522bd6b9
SHA256385aeff0303812b1db78c52655ca136987c76263f1ba4325657f1d0c5e10d4e0
SHA5120b36cc064aafadf357b39ad3def22396fb34ed163127a424e4a340b9971e4fabac89ca58a8dc28392249f24fd40d9c63b17722deacd337032b78560b3c58f007
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
15KB
MD50c7d9cacbbab4557147af23874386363
SHA1336de73b19121d85f80a2bde833e4c4d7babbe67
SHA2561010fab4a57780e0bee7d8f0f9f76c5a69379a7c22e4a7ac0e96740ca6abebe1
SHA5127b19ccd89179bdbdbe16aee9d0037bf829b69c33f91eb01f26b877c5c0aa5e54c6ab01cb5ae9c56a09c3d518618957008cea442f5faca424c4f6e7449f996348
-
Filesize
10KB
MD54628c6a09388f141ed1fd03f7611aa3f
SHA1c83731b7a64b4db4f07dc55465c80f753dff7beb
SHA2569b0335c554a413e874356a5b66fd19c98a9916bdd4eb25c0d81fecd1d02a6628
SHA512f3b0f8f9119f5badb1203279b0c54b6ea62677a540df226de004970376aa57b43e9512d423e41f6b103ce12dda3b9019d72e3ba3682a4d4910041807791dd6a9
-
Filesize
10KB
MD5b90d451f672c961bdec269fb56b68507
SHA143202a153d7b9905b5ca5df0ce1f86496a2999c0
SHA25659972e59c9c18bc44acdadc7ea91fe81001613da714afffb13f9ca0dabfaaefd
SHA51253d0efecca73c876f0b61ec9e15316fd6cfc2f152010957990d1785792acaae71f9374f496ab00fd5fb6eda6691f40131076cf26b162326d61961d6659f38161
-
Filesize
12KB
MD5c543b59f0a99b0c1c04cd7308d860ee6
SHA18af9d719ecdb5242b747ac109d475ee1af177236
SHA256f92b8633258db4f8b504f27572bfe2ebf4df5f41bb4617130dbfc2a09fd22540
SHA512379a6dce98bf953635437805f0799d2845d565676b42ce91fa32666f63897d202d23914e1eca237b31d56e1ff986bbd1f76b9d89cbf1155ac8d8af6f8846c346
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.2MB
MD5a3cee6a746055b2ab9822b766cc96b2c
SHA1138c5b53e5929358f5bd610c636d916c9e09d814
SHA25687f9d9ff7a3777b25fc51d0090d4bee00b090168aa2a97a51bbd6731fa930453
SHA5129e303bef1e79259c41f5b46d4d659209b4e3b13f83937e9096df660e54e429fb8d0d2a746d36d8b264cad3fb121639130b0017d85287f3d8b877cba0fed753c9