Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
112cf61b5fdf72b3996262baecbe9fef
-
SHA1
eb1e4b94cc3e8f6dbe425473526154802d126e8e
-
SHA256
23621d59cc4f6e323e95e9f17ad90e380b71964b28f4b669f1038289dc9f2131
-
SHA512
a093ea6ad1134509c1650faa25372f5986751d36aca5fd558a5b5958e29bd449ef78ebdacba399d01ebd22466fff64948a225c8239a795fb3e8893bd3db60b94
-
SSDEEP
49152:kO432MbH0Py+DUQDH2DJTd6P5Po4HxlRrd9MH:kOI2MbH06+Df7uJT6z7
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 230fc6e5be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 230fc6e5be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 230fc6e5be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 230fc6e5be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 230fc6e5be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 230fc6e5be.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6d450d3d5c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bf1d58d552.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 230fc6e5be.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6d450d3d5c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6d450d3d5c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bf1d58d552.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bf1d58d552.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 230fc6e5be.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 230fc6e5be.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 5 IoCs
pid Process 1580 skotes.exe 1088 6d450d3d5c.exe 2900 bf1d58d552.exe 992 a580958ccb.exe 2892 230fc6e5be.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 6d450d3d5c.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine bf1d58d552.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 230fc6e5be.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine file.exe -
Loads dropped DLL 7 IoCs
pid Process 2508 file.exe 1580 skotes.exe 1580 skotes.exe 1580 skotes.exe 1580 skotes.exe 1580 skotes.exe 1580 skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 230fc6e5be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 230fc6e5be.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\6d450d3d5c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004029001\\6d450d3d5c.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\bf1d58d552.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004030001\\bf1d58d552.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\a580958ccb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004031001\\a580958ccb.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\230fc6e5be.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004032001\\230fc6e5be.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000019238-76.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2508 file.exe 1580 skotes.exe 1088 6d450d3d5c.exe 2900 bf1d58d552.exe 2892 230fc6e5be.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230fc6e5be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf1d58d552.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a580958ccb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d450d3d5c.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 1600 taskkill.exe 2520 taskkill.exe 1720 taskkill.exe 1264 taskkill.exe 832 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2508 file.exe 1580 skotes.exe 1088 6d450d3d5c.exe 2900 bf1d58d552.exe 992 a580958ccb.exe 2892 230fc6e5be.exe 2892 230fc6e5be.exe 992 a580958ccb.exe 2892 230fc6e5be.exe 2892 230fc6e5be.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1720 taskkill.exe Token: SeDebugPrivilege 1264 taskkill.exe Token: SeDebugPrivilege 832 taskkill.exe Token: SeDebugPrivilege 1600 taskkill.exe Token: SeDebugPrivilege 2520 taskkill.exe Token: SeDebugPrivilege 2292 firefox.exe Token: SeDebugPrivilege 2292 firefox.exe Token: SeDebugPrivilege 2892 230fc6e5be.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2508 file.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 2292 firefox.exe 2292 firefox.exe 2292 firefox.exe 2292 firefox.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 2292 firefox.exe 2292 firefox.exe 2292 firefox.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe 992 a580958ccb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1580 2508 file.exe 30 PID 2508 wrote to memory of 1580 2508 file.exe 30 PID 2508 wrote to memory of 1580 2508 file.exe 30 PID 2508 wrote to memory of 1580 2508 file.exe 30 PID 1580 wrote to memory of 1088 1580 skotes.exe 33 PID 1580 wrote to memory of 1088 1580 skotes.exe 33 PID 1580 wrote to memory of 1088 1580 skotes.exe 33 PID 1580 wrote to memory of 1088 1580 skotes.exe 33 PID 1580 wrote to memory of 2900 1580 skotes.exe 35 PID 1580 wrote to memory of 2900 1580 skotes.exe 35 PID 1580 wrote to memory of 2900 1580 skotes.exe 35 PID 1580 wrote to memory of 2900 1580 skotes.exe 35 PID 1580 wrote to memory of 992 1580 skotes.exe 36 PID 1580 wrote to memory of 992 1580 skotes.exe 36 PID 1580 wrote to memory of 992 1580 skotes.exe 36 PID 1580 wrote to memory of 992 1580 skotes.exe 36 PID 992 wrote to memory of 1720 992 a580958ccb.exe 37 PID 992 wrote to memory of 1720 992 a580958ccb.exe 37 PID 992 wrote to memory of 1720 992 a580958ccb.exe 37 PID 992 wrote to memory of 1720 992 a580958ccb.exe 37 PID 992 wrote to memory of 1264 992 a580958ccb.exe 39 PID 992 wrote to memory of 1264 992 a580958ccb.exe 39 PID 992 wrote to memory of 1264 992 a580958ccb.exe 39 PID 992 wrote to memory of 1264 992 a580958ccb.exe 39 PID 992 wrote to memory of 832 992 a580958ccb.exe 41 PID 992 wrote to memory of 832 992 a580958ccb.exe 41 PID 992 wrote to memory of 832 992 a580958ccb.exe 41 PID 992 wrote to memory of 832 992 a580958ccb.exe 41 PID 992 wrote to memory of 1600 992 a580958ccb.exe 43 PID 992 wrote to memory of 1600 992 a580958ccb.exe 43 PID 992 wrote to memory of 1600 992 a580958ccb.exe 43 PID 992 wrote to memory of 1600 992 a580958ccb.exe 43 PID 992 wrote to memory of 2520 992 a580958ccb.exe 45 PID 992 wrote to memory of 2520 992 a580958ccb.exe 45 PID 992 wrote to memory of 2520 992 a580958ccb.exe 45 PID 992 wrote to memory of 2520 992 a580958ccb.exe 45 PID 992 wrote to memory of 1492 992 a580958ccb.exe 47 PID 992 wrote to memory of 1492 992 a580958ccb.exe 47 PID 992 wrote to memory of 1492 992 a580958ccb.exe 47 PID 992 wrote to memory of 1492 992 a580958ccb.exe 47 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 1492 wrote to memory of 2292 1492 firefox.exe 48 PID 2292 wrote to memory of 2376 2292 firefox.exe 49 PID 2292 wrote to memory of 2376 2292 firefox.exe 49 PID 2292 wrote to memory of 2376 2292 firefox.exe 49 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 PID 2292 wrote to memory of 2992 2292 firefox.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1004029001\6d450d3d5c.exe"C:\Users\Admin\AppData\Local\Temp\1004029001\6d450d3d5c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\1004030001\bf1d58d552.exe"C:\Users\Admin\AppData\Local\Temp\1004030001\bf1d58d552.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\1004031001\a580958ccb.exe"C:\Users\Admin\AppData\Local\Temp\1004031001\a580958ccb.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.0.1846328277\957903375" -parentBuildID 20221007134813 -prefsHandle 1200 -prefMapHandle 1192 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c31e69d8-b7d0-4340-910d-a32653e578e6} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 1280 113b6858 gpu6⤵PID:2376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.1.366066999\1325393153" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1c76bdf-e1eb-4971-8319-279701414df5} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 1480 e71b58 socket6⤵PID:2992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.2.93897403\1144188439" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c24d1b9-acbe-4195-a4c6-b4b20f4c47aa} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 2108 e67658 tab6⤵PID:1100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.3.524066063\1082910045" -childID 2 -isForBrowser -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37b3e5c1-67f4-459b-803f-320e3d1676da} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 2908 1d5f6d58 tab6⤵PID:1496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.4.77552803\666985049" -childID 3 -isForBrowser -prefsHandle 3740 -prefMapHandle 3696 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {351e2907-b640-479c-8886-35f538f8c9e0} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3752 1c210b58 tab6⤵PID:896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.5.722469777\1049477358" -childID 4 -isForBrowser -prefsHandle 3924 -prefMapHandle 3928 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90f61b69-a737-4dc2-8f3c-a80920690ecf} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 3912 214cbb58 tab6⤵PID:2176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.6.1247056749\299304741" -childID 5 -isForBrowser -prefsHandle 4104 -prefMapHandle 4108 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2db7f4b-2483-4a81-82b5-f0a19107afa2} 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 4088 214c9458 tab6⤵PID:108
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004032001\230fc6e5be.exe"C:\Users\Admin\AppData\Local\Temp\1004032001\230fc6e5be.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\activity-stream.discovery_stream.json.tmp
Filesize29KB
MD52e4b25f6e3e4cf4cce83454a7ec8afdf
SHA179189697b9a8396e5e22e4099dd783c91eb4faee
SHA2563f2a3f508f6db4a14374e3abf22d0c6e6922d5c981d8b4b7348ae7f15c36805b
SHA5125e8def2b943849d4ee5fbbe7c90c5ba739fc903eef5488cf8b45e503686c331cf1202ae7973674c3db060849980f55fb20e0864f8bf7810fd1bb8d54971a2d93
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize13KB
MD5f99b4984bd93547ff4ab09d35b9ed6d5
SHA173bf4d313cb094bb6ead04460da9547106794007
SHA256402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
SHA512cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
-
Filesize
2.8MB
MD5fa9cb3030ba1bc095ac7f84ece81159d
SHA1178a344a4e41bb66d1441bc1a70f6444defe8c3c
SHA2564e456175bc7e71209b47ba72449f2ec31719cbd9e64387b77d0f5d819747b68f
SHA5125dc0888468ee7a4b92205eb2fec33fe39b9913d375ed358fa01e72d2161e4f43783aadcda79ce0eb577a86b2306dbb6c31b541dbd0dbaa4fc069cae439973894
-
Filesize
2.0MB
MD5649b30a03ce978366e6c5189a1f3ce1c
SHA10815ec58e255ac4659fc5cc62438ef009955b6e9
SHA256935236bed1b5f179782f75b32cf4a7e66fafba9b9e3b4be4bacd2f1ad2cef8ad
SHA5127381db1186e171e294e3449f3478b43e2f96706565b4ebfb2e224441259388382d114d225147d44a7fd9036926e54ffdc7d905d163dc06dc4fd8ab98bb1b774b
-
Filesize
898KB
MD58ca4b0a008e0bb5cb6530bfadacc876c
SHA1b2c906d580a640acafe788265afb4ec6c8d50ddf
SHA2564046e003425711a55d624a7a89eccbe7354ae09e580754f3b0444bb822e4964a
SHA5120d77e6ce39a0ba185c64d28c92607ef37fd3842e7fd06b7ff2e7ee29a822eecc09c6f367a918f4ea73a69681394316258cfefe4f03736c8bd5ce86f28a4ef29e
-
Filesize
2.7MB
MD55af3ca07cc3dbc6744663fbf0e653a8d
SHA17e0d1b266e3e1bd2f511d466ca5f00338e9b6332
SHA2565862865799f158dce084650d09013e4070d89fdc3e3c01ddb6e6213124a76ef4
SHA5125af1146bfc9b7f2b8b3cdd37d0b676b22c0ad3c9fb3eb88c9d60350ffebcda18fb1b5ccfae2616d235ff1e09ff5ea5e10c44919e71f84e131d2c2525808a974a
-
Filesize
3.1MB
MD5112cf61b5fdf72b3996262baecbe9fef
SHA1eb1e4b94cc3e8f6dbe425473526154802d126e8e
SHA25623621d59cc4f6e323e95e9f17ad90e380b71964b28f4b669f1038289dc9f2131
SHA512a093ea6ad1134509c1650faa25372f5986751d36aca5fd558a5b5958e29bd449ef78ebdacba399d01ebd22466fff64948a225c8239a795fb3e8893bd3db60b94
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5540c5be400407bb59f63c1e921656643
SHA18091db1ff560636462bef77b47723861db964e9a
SHA25666c01ba87c044b5e0ceb48877331590c251ae015386a403908edfd24956a8b6c
SHA512bf54ef8513ee198c107f1941d33b2677478ed31da1661f03aff1a51a682e785e9bf960f19d8e7f9b237c05b08b4f46976018cdb60a6fe5d2d0b92a0ad2be4960
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\af3d9e50-3422-438e-ba08-45e62cc342ac
Filesize12KB
MD5fdbc0ead48ae898eb5732ede13331e21
SHA1b8fc1793f9876554563bc86f73c0a5af08ef5286
SHA256c7291f6bcd47af39f1ac81efbe5ca9c4b2d0d9973d3f46c0bdcdc9411c864ace
SHA512ef35237ccaa70609603e381acd2e904f5346c6587cf700e9b40e5426e3554237fa783a9682f9476e799897e4824426dc40754bf14c706e36ac20fedd8514a840
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\ddb1de54-e494-4704-8d08-5c3a45d5fce5
Filesize745B
MD5b6567937ac6204ec12428b5698e71d29
SHA1b9edc3e64c62243d758825667b8eb7983bf187f4
SHA25651d4679f5597a179200af91fc10fb8b57e037810431008c8c0ff69c6cffae8ac
SHA5123f0151b99d38ea28d53c261efe97ccb5355ad51656d90836a7c4579d833394e0ddcc5f755d64eb79ac412e1b115038d67d3d1f29cb97a48627dc998bc48464ef
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD537c979ec84868ec96096bc6851c03c4b
SHA13ee5ff511499db96f84f553106f116d6562c6cff
SHA25666b6d51ec71011226375e41514ebb8245401e796632aa3ace20e7aaa28fe29a9
SHA512970e054ac744a48d5771865fc68df8d7f7e4eb9a217e87415c35a643ef1e2a24a59cc646603b5dc9ecb1839ce348369038dac7342f9666fff873d7ce57662ecd
-
Filesize
7KB
MD5a2f8b26ede6c604115e455bb65bfc208
SHA171c8c4a8a45a2c8e154520909001d63ddef7af1e
SHA2561d7374dc7950ac43f7d9b950fec3b34a36d8af4340990f09a4927b8ba733bf1b
SHA512dc3d01efb88eb691b3f9dad486189bc126ab80305d622034766a248f157a162071935a86752c8430d867a6d8b8cbf2a6ea40cc392ea97f192728f877cdbd8073
-
Filesize
7KB
MD54cd174a4a89a2b0d037c53bbc6c42149
SHA1803077f467fa86641e7dab0ac90423d2e9816062
SHA256882b3ae64a26261e9817029a068055f76b2940578adaed9083cce4bb5771ea89
SHA512f7efaa642d9870b1843fe364d3f7f42134b54800fe0a0262a2b17715c84d649c263b7bcd837ec86f699d4de13d1ddedb90527e42df0afedc68bc06c10da78f77
-
Filesize
6KB
MD5425c6d3389c7034feb1009e263467c19
SHA1c53ede36b1d0ef9c3909ab6c85d923c34360c4e3
SHA25611dd6ee66780f0b577ef8ce59793d19301ab679ce7209bff85ad9d9b7184cc35
SHA5122a20c269bc1efb716b5f9f1f3e74099a51c0995d81b54d7419fadc1d11ab28aa683487549dbaba026acd1a3a529daadd75721501e7d411cf5181e88af4c652a9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5ed739eea6d6e876c6f43e9c068f5e12c
SHA18c5c576d14e9db490021ba0d724283454f104da9
SHA256ae2f1098d7da4c417c9b0e616f808ad6a642027d7f778478a4e1e0cf7ba961ae
SHA512bd3c2d7d59ed5f72ea5271075bc475711a026418ae49fdaad2e20929ca09a15771fe7442337800d7dd2561928c5306cfec7fdae4be62f3e686671a1435e3142b