Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe
Resource
win7-20240903-en
General
-
Target
6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe
-
Size
3.1MB
-
MD5
36cde0f98ab8a93df2c3134ab9771502
-
SHA1
d778b355d36d12d05562bed3f78af22c944eb575
-
SHA256
6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261
-
SHA512
a79ef6f322657769550e03f1734b88c1a3b330ec6523f5fa444066cea7bc1dfd2df41833d9c99380209f2e25d1685c81dbc9eee948aa30678ff8a54a3b4c5d80
-
SSDEEP
49152:og8DDIyU/xbvZJzwSmaOLxmeHpEeeJxs18eM9C:ogGDIyU/xbvXzwSmBtzHp8zs8eM9C
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 2f0d602f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 2f0d602f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 2f0d602f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 2f0d602f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 2f0d602f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 2f0d602f57.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b192be87ab.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a9a8d3b953.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2f0d602f57.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2f0d602f57.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b192be87ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b192be87ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a9a8d3b953.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a9a8d3b953.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2f0d602f57.exe -
Executes dropped EXE 5 IoCs
pid Process 2808 skotes.exe 2640 b192be87ab.exe 1872 a9a8d3b953.exe 596 cee306ad30.exe 1880 2f0d602f57.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine 2f0d602f57.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine b192be87ab.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine a9a8d3b953.exe -
Loads dropped DLL 7 IoCs
pid Process 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 2808 skotes.exe 2808 skotes.exe 2808 skotes.exe 2808 skotes.exe 2808 skotes.exe 2808 skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 2f0d602f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 2f0d602f57.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\b192be87ab.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004005001\\b192be87ab.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\a9a8d3b953.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004006001\\a9a8d3b953.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\cee306ad30.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004007001\\cee306ad30.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f0d602f57.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004008001\\2f0d602f57.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000016d4e-73.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 2808 skotes.exe 2640 b192be87ab.exe 1872 a9a8d3b953.exe 1880 2f0d602f57.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f0d602f57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cee306ad30.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b192be87ab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9a8d3b953.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 2300 taskkill.exe 112 taskkill.exe 2444 taskkill.exe 1708 taskkill.exe 1584 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 2808 skotes.exe 2640 b192be87ab.exe 1872 a9a8d3b953.exe 596 cee306ad30.exe 596 cee306ad30.exe 1880 2f0d602f57.exe 1880 2f0d602f57.exe 1880 2f0d602f57.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2300 taskkill.exe Token: SeDebugPrivilege 112 taskkill.exe Token: SeDebugPrivilege 2444 taskkill.exe Token: SeDebugPrivilege 1708 taskkill.exe Token: SeDebugPrivilege 1584 taskkill.exe Token: SeDebugPrivilege 1272 firefox.exe Token: SeDebugPrivilege 1272 firefox.exe Token: SeDebugPrivilege 1880 2f0d602f57.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 1272 firefox.exe 1272 firefox.exe 1272 firefox.exe 1272 firefox.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 1272 firefox.exe 1272 firefox.exe 1272 firefox.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe 596 cee306ad30.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2808 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 28 PID 2920 wrote to memory of 2808 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 28 PID 2920 wrote to memory of 2808 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 28 PID 2920 wrote to memory of 2808 2920 6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe 28 PID 2808 wrote to memory of 2640 2808 skotes.exe 30 PID 2808 wrote to memory of 2640 2808 skotes.exe 30 PID 2808 wrote to memory of 2640 2808 skotes.exe 30 PID 2808 wrote to memory of 2640 2808 skotes.exe 30 PID 2808 wrote to memory of 1872 2808 skotes.exe 32 PID 2808 wrote to memory of 1872 2808 skotes.exe 32 PID 2808 wrote to memory of 1872 2808 skotes.exe 32 PID 2808 wrote to memory of 1872 2808 skotes.exe 32 PID 2808 wrote to memory of 596 2808 skotes.exe 33 PID 2808 wrote to memory of 596 2808 skotes.exe 33 PID 2808 wrote to memory of 596 2808 skotes.exe 33 PID 2808 wrote to memory of 596 2808 skotes.exe 33 PID 596 wrote to memory of 2300 596 cee306ad30.exe 34 PID 596 wrote to memory of 2300 596 cee306ad30.exe 34 PID 596 wrote to memory of 2300 596 cee306ad30.exe 34 PID 596 wrote to memory of 2300 596 cee306ad30.exe 34 PID 596 wrote to memory of 112 596 cee306ad30.exe 36 PID 596 wrote to memory of 112 596 cee306ad30.exe 36 PID 596 wrote to memory of 112 596 cee306ad30.exe 36 PID 596 wrote to memory of 112 596 cee306ad30.exe 36 PID 596 wrote to memory of 2444 596 cee306ad30.exe 38 PID 596 wrote to memory of 2444 596 cee306ad30.exe 38 PID 596 wrote to memory of 2444 596 cee306ad30.exe 38 PID 596 wrote to memory of 2444 596 cee306ad30.exe 38 PID 596 wrote to memory of 1708 596 cee306ad30.exe 40 PID 596 wrote to memory of 1708 596 cee306ad30.exe 40 PID 596 wrote to memory of 1708 596 cee306ad30.exe 40 PID 596 wrote to memory of 1708 596 cee306ad30.exe 40 PID 596 wrote to memory of 1584 596 cee306ad30.exe 42 PID 596 wrote to memory of 1584 596 cee306ad30.exe 42 PID 596 wrote to memory of 1584 596 cee306ad30.exe 42 PID 596 wrote to memory of 1584 596 cee306ad30.exe 42 PID 596 wrote to memory of 1028 596 cee306ad30.exe 44 PID 596 wrote to memory of 1028 596 cee306ad30.exe 44 PID 596 wrote to memory of 1028 596 cee306ad30.exe 44 PID 596 wrote to memory of 1028 596 cee306ad30.exe 44 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1028 wrote to memory of 1272 1028 firefox.exe 45 PID 1272 wrote to memory of 2992 1272 firefox.exe 46 PID 1272 wrote to memory of 2992 1272 firefox.exe 46 PID 1272 wrote to memory of 2992 1272 firefox.exe 46 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 PID 1272 wrote to memory of 1540 1272 firefox.exe 47 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe"C:\Users\Admin\AppData\Local\Temp\6d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\1004005001\b192be87ab.exe"C:\Users\Admin\AppData\Local\Temp\1004005001\b192be87ab.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\1004006001\a9a8d3b953.exe"C:\Users\Admin\AppData\Local\Temp\1004006001\a9a8d3b953.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\1004007001\cee306ad30.exe"C:\Users\Admin\AppData\Local\Temp\1004007001\cee306ad30.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.0.1921818926\1504403560" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b161b38-cfaa-4d82-93ef-6fd33ff7404b} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 1300 10dd5e58 gpu6⤵PID:2992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.1.190364141\803581870" -parentBuildID 20221007134813 -prefsHandle 1508 -prefMapHandle 1504 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61ecd302-62f8-49c8-8fb2-53b77f51527e} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 1520 e73c58 socket6⤵PID:1540
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.2.841686684\1241238333" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49acc3fe-36bb-4aa3-a8b1-5ea1ad76668b} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 2104 198ba358 tab6⤵PID:2772
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.3.1192574732\1856274840" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11a1831b-7c8a-439e-bdbc-eed94975e92d} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 2912 e6aa58 tab6⤵PID:1020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.4.1855573066\1550653194" -childID 3 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f106aee1-fd3b-45f6-affa-678a31a3ae7f} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 3716 1b12c758 tab6⤵PID:2888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.5.2091214290\294640814" -childID 4 -isForBrowser -prefsHandle 3820 -prefMapHandle 3824 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1a27d6c-9db8-4e07-96bf-152186158279} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 3808 1ea16e58 tab6⤵PID:1852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1272.6.141079508\312220288" -childID 5 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70dca7d0-bd5c-4ee8-b153-d6c91c5a55a1} 1272 "\\.\pipe\gecko-crash-server-pipe.1272" 3988 1ea18358 tab6⤵PID:1364
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004008001\2f0d602f57.exe"C:\Users\Admin\AppData\Local\Temp\1004008001\2f0d602f57.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp
Filesize28KB
MD55f8a24919345839445c58ed589a9dac9
SHA17fd251d7defa390ad96ecee67548dd8e34d3704a
SHA25672cad11657f9e3188162bb01e29d0f20e704459adf1c96316fd00da3bbeda116
SHA5123ca04826de12184f5ef052420ae2914bb60c055fbe3d0ef7015bc21eedd03c4d27f99e47870cce9655b74ef0b080e7998fadf1f4bff834ef6a7435d47ef9ac59
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize13KB
MD5f99b4984bd93547ff4ab09d35b9ed6d5
SHA173bf4d313cb094bb6ead04460da9547106794007
SHA256402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
SHA512cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
-
Filesize
2.9MB
MD5cf60ed449e8668f8ee28985018351b0d
SHA14558c970a77f0650c06992b958fcae59153aa70c
SHA25663cf66b3f95e4d1c2e5032967b691eb371046bac41ddbb9166e9b146a090421e
SHA512bfb123fc0fcfcca329d5feb416e7d55ca02f52189bbe52876de8e9d7312a2b45c6432228b194ea3bd1b1fd4a9b6df76c7c90e6f6c5e52e5e9f56abe6ae544e26
-
Filesize
2.0MB
MD53080c431ba635ab40c0bea78645be17e
SHA1e38d82e5f7d12fd180c18ddfd7cdbb5b3fcda553
SHA256dda1026bd3b7331d8bcd84d9766fb1623bf48d879905444c2809e09766729b06
SHA512740d68d68eb267c33777bf0517e856ce8b800d74f0f1a08f983ffbfd5cb015a4ea0e2793713ef3b2dbae74f588d5ff5ff4f90ce43894452b398799f5a678ba6a
-
Filesize
898KB
MD5fbc125173c935d3a74aa2a1a3908cba2
SHA150c7d961cd3ff761854439944ee304e11f0874e8
SHA2564f895492a98dbdfbb6c02c2bcded323ce363511d183e0d4fc3e9ec856445fe2f
SHA512a237225cca9330fde86e7107628642dedfa5c2ddec7226615ca8396114455129f98a4db6fd3b18198f1e3918193d965cf4ee0635a20dbd0e736931261bbf0ac3
-
Filesize
2.6MB
MD502d2fcab91e6dc7756d9be5317c9506b
SHA1a10aa93039af20fdacb0f04d2d357f4f60bcc2fa
SHA256d42846ac158ea49c2efd90ef76a56c0bceac96158a215415187d4164f4a2161a
SHA512024de5d18f13e68f273bab3e350dd035c6398ea4888ca7bb249b681400dcb4d20604fdaaddfc2b45ef111335adcc5abe630d97b7654cddd2131902390496a19c
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD5d41e9cfa6c800bc082d55a9d46602273
SHA1362fe8c0c5b5501786b390708ecf43ca3276a92c
SHA2564de0b2e52468dc6935233781b3bc03af51be0cafc05b11ff847eae82a92746d4
SHA51223633961cb79ba2207960d3eb1eaa37a9af94ca4a34511d79ad07a77da7817f632674c1adc11ac8c6c56c4e5f1186ba1391b342d0d4ffc607b93f77dcbbc1db2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\96cac254-31bd-4338-86f4-fb841d688f2f
Filesize733B
MD502a8f61b2746f578eac1329b0179d18b
SHA1aad3e5546419eb509b81678d728a11452ceaa90c
SHA256b9a40c15ea4c09ad85d50122fbf3a158f896c4384ef8c92a85b124ad4f3707d0
SHA512315e82b5cd4d4aa1a9d0cadfbf5012f5f0c5e06cf34955017b466e2a93aecddf982a3b053375b9a5449a28e34326b683b16764376a0fa5a67fe18a628532644d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5f839c2e1c2053d10899427f6ae8cf9b9
SHA164e1e6921cb0da332d511edabae07ce49f784da9
SHA2566102c5bd7ef0bd4de3c298608808e528ef3ab3c9f8276c88f3b6c36f38889d19
SHA512b59b43ce421644b34aa33c8b6192ec6651f1f31d61c9c9454f855e55c60fc100cbcc326184a135616054f0795df853695e58bcaa045e3117d407005d5781b949
-
Filesize
7KB
MD53ff9469ef5916ef98e0b7043fa9f6537
SHA1409e39915dd30ecc52271be6f9bd81e3062d3658
SHA256facff248fe0c9a305481a33edda1dc3986c8706ce9a5f62e0b8cc39e5c971244
SHA512098bf7acd096eafab734864c0293e803f829a4c10986e7b437abd0a3c538f067238e3447aaac3ec4ea11e363793e2e5065e73285d65df975f8ed4a8683b12248
-
Filesize
7KB
MD5ed353232e8c85037343732dec34f9dde
SHA1a73fd360c3d101dcbcd15b2cd69ffdb9464589f4
SHA2560452c1bdc5bd539e46b36306ea987193cca10ce135cc83ffccf341a0c290f693
SHA5123b5f46996c28e8c604fc8dcf4e3f97dcfda29c1ecf002bd400e9e6cf496e949966b0ac1aa1dae25ee62272cbeab22e07ccdbe3944c7987dbb2ab95c0ae58e19a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5eac5e95433c4a8532afe86ace62395f4
SHA174ab94b76da12a1e2445b25d1fa8f8ec04f3ef63
SHA256506d8c2c01e544fcbe9974ff42e4632e05057d6c425af254a8e1fdfcdc66b95d
SHA5123fd7bc05fcb659d323d2165e3f5664a6e4062f38cfd3ec4354cc8bc851e2bc3d9c279e5270c6471e39c3ae5f1b86f60012c33c45bcbf865d152815868d4a6298
-
Filesize
3.1MB
MD536cde0f98ab8a93df2c3134ab9771502
SHA1d778b355d36d12d05562bed3f78af22c944eb575
SHA2566d466d1d251413c12eea858fb6632f05321720d64212b98b92b68a7190627261
SHA512a79ef6f322657769550e03f1734b88c1a3b330ec6523f5fa444066cea7bc1dfd2df41833d9c99380209f2e25d1685c81dbc9eee948aa30678ff8a54a3b4c5d80