Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240729-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
5c87bc7b86c06bb8cd470891009473f0
-
SHA1
5206f5d15901d89f85e8eaffb3c769c157b0718f
-
SHA256
0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363
-
SHA512
c4d9f94f58f19c3cadfa0eff7651dcf0c6ef3278848b53a4bb4b5aee19c8442248f233d22256eaf5f1f5e107d635623f8eb5598f3e8bdd3c209b9b6f27d6365a
-
SSDEEP
49152:uOYlNL4bhn1aqOU0y3xLYSFNo822Vy8cFGmrt0uU:8Nsbhn5OUh3xLYSD20y7B
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Lumma family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f13b260116.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b9eb31a7d7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 3 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1924 chrome.exe 2356 chrome.exe 2896 chrome.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f13b260116.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f13b260116.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b9eb31a7d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b9eb31a7d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe -
Executes dropped EXE 4 IoCs
pid Process 2872 skotes.exe 2484 f13b260116.exe 1380 b9eb31a7d7.exe 344 30671e2514.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine f13b260116.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine b9eb31a7d7.exe -
Loads dropped DLL 10 IoCs
pid Process 2464 file.exe 2872 skotes.exe 2872 skotes.exe 2872 skotes.exe 2872 skotes.exe 1380 b9eb31a7d7.exe 2872 skotes.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\f13b260116.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004133001\\f13b260116.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9eb31a7d7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004134001\\b9eb31a7d7.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\30671e2514.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004135001\\30671e2514.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000019667-88.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2464 file.exe 2872 skotes.exe 2484 f13b260116.exe 1380 b9eb31a7d7.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\debug.log chrome.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3228 1380 WerFault.exe 34 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f13b260116.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30671e2514.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9eb31a7d7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b9eb31a7d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b9eb31a7d7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 2792 taskkill.exe 2064 taskkill.exe 552 taskkill.exe 1020 taskkill.exe 1768 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\1004136001\0:8d23c08.exe skotes.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2464 file.exe 2872 skotes.exe 2484 f13b260116.exe 1380 b9eb31a7d7.exe 1380 b9eb31a7d7.exe 1380 b9eb31a7d7.exe 1924 chrome.exe 1924 chrome.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1768 taskkill.exe Token: SeDebugPrivilege 2792 taskkill.exe Token: SeDebugPrivilege 2064 taskkill.exe Token: SeDebugPrivilege 552 taskkill.exe Token: SeDebugPrivilege 1020 taskkill.exe Token: SeDebugPrivilege 756 firefox.exe Token: SeDebugPrivilege 756 firefox.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 2464 file.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 756 firefox.exe 756 firefox.exe 756 firefox.exe 756 firefox.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe 756 firefox.exe 756 firefox.exe 756 firefox.exe 344 30671e2514.exe 344 30671e2514.exe 344 30671e2514.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2872 2464 file.exe 30 PID 2464 wrote to memory of 2872 2464 file.exe 30 PID 2464 wrote to memory of 2872 2464 file.exe 30 PID 2464 wrote to memory of 2872 2464 file.exe 30 PID 2872 wrote to memory of 2484 2872 skotes.exe 32 PID 2872 wrote to memory of 2484 2872 skotes.exe 32 PID 2872 wrote to memory of 2484 2872 skotes.exe 32 PID 2872 wrote to memory of 2484 2872 skotes.exe 32 PID 2872 wrote to memory of 1380 2872 skotes.exe 34 PID 2872 wrote to memory of 1380 2872 skotes.exe 34 PID 2872 wrote to memory of 1380 2872 skotes.exe 34 PID 2872 wrote to memory of 1380 2872 skotes.exe 34 PID 2872 wrote to memory of 344 2872 skotes.exe 36 PID 2872 wrote to memory of 344 2872 skotes.exe 36 PID 2872 wrote to memory of 344 2872 skotes.exe 36 PID 2872 wrote to memory of 344 2872 skotes.exe 36 PID 344 wrote to memory of 1768 344 30671e2514.exe 37 PID 344 wrote to memory of 1768 344 30671e2514.exe 37 PID 344 wrote to memory of 1768 344 30671e2514.exe 37 PID 344 wrote to memory of 1768 344 30671e2514.exe 37 PID 1380 wrote to memory of 1924 1380 b9eb31a7d7.exe 39 PID 1380 wrote to memory of 1924 1380 b9eb31a7d7.exe 39 PID 1380 wrote to memory of 1924 1380 b9eb31a7d7.exe 39 PID 1380 wrote to memory of 1924 1380 b9eb31a7d7.exe 39 PID 1924 wrote to memory of 2592 1924 chrome.exe 40 PID 1924 wrote to memory of 2592 1924 chrome.exe 40 PID 1924 wrote to memory of 2592 1924 chrome.exe 40 PID 1924 wrote to memory of 1816 1924 chrome.exe 41 PID 1924 wrote to memory of 1816 1924 chrome.exe 41 PID 1924 wrote to memory of 1816 1924 chrome.exe 41 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 PID 1924 wrote to memory of 672 1924 chrome.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1004133001\f13b260116.exe"C:\Users\Admin\AppData\Local\Temp\1004133001\f13b260116.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\1004134001\b9eb31a7d7.exe"C:\Users\Admin\AppData\Local\Temp\1004134001\b9eb31a7d7.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefaa29758,0x7fefaa29768,0x7fefaa297785⤵PID:2592
-
-
C:\Windows\system32\ctfmon.exectfmon.exe5⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:25⤵PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:85⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:85⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=976 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:25⤵
- Drops file in Program Files directory
PID:2384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 9604⤵
- Loads dropped DLL
- Program crash
PID:3228
-
-
-
C:\Users\Admin\AppData\Local\Temp\1004135001\30671e2514.exe"C:\Users\Admin\AppData\Local\Temp\1004135001\30671e2514.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵PID:940
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:756 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.0.70805275\1245743848" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95f31364-d478-492b-be67-d195befe07ae} 756 "\\.\pipe\gecko-crash-server-pipe.756" 1304 46f3b58 gpu6⤵PID:1908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.1.519233231\137627110" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {defbe69a-996c-4801-acfc-6ec1a34f3d04} 756 "\\.\pipe\gecko-crash-server-pipe.756" 1500 e74e58 socket6⤵PID:2344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.2.1117121670\1249636014" -childID 1 -isForBrowser -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bb298c5-ea5b-4d8f-a876-756e2eafee68} 756 "\\.\pipe\gecko-crash-server-pipe.756" 2096 1a1c2358 tab6⤵PID:1896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.3.2125585266\1241664868" -childID 2 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f10f1850-6165-43f8-b0f4-f461c4878392} 756 "\\.\pipe\gecko-crash-server-pipe.756" 2916 1b19a058 tab6⤵PID:2124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.4.107699797\372071087" -childID 3 -isForBrowser -prefsHandle 3628 -prefMapHandle 3648 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c41b3e9e-f31a-426b-9d0e-e2ff226f6149} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3616 1f90fb58 tab6⤵PID:2276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.5.1099073971\1239676362" -childID 4 -isForBrowser -prefsHandle 3808 -prefMapHandle 3812 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ee07942-6583-4ba5-a4d9-460f9986c2ac} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3796 1f912258 tab6⤵PID:1116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.6.1341650051\253360296" -childID 5 -isForBrowser -prefsHandle 3984 -prefMapHandle 3988 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5495b035-9dea-4a0b-99a4-00d85fe126fa} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3972 1f912e58 tab6⤵PID:2616
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2268
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Authentication Process
1Modify Registry
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
Filesize22KB
MD56060ccb85c910cb99fed867468a5259d
SHA170d2e4cb6abc7567df6040a1a79e6d668ccc4639
SHA25606ad676e1eada008f7d003c8ca6456a4120d429ed05a20c5402a98639a658bf0
SHA5122c683734960536d293197d565831d07a95158ae5fe4b93f196cf6f6d112c17f1ed6518f8c368eb4b820b15ff60c3cf09ac67fb441ff79f160499f672e7ddfd7c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize13KB
MD5f99b4984bd93547ff4ab09d35b9ed6d5
SHA173bf4d313cb094bb6ead04460da9547106794007
SHA256402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
SHA512cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
-
Filesize
3.0MB
MD50d7b1ba6e967a55e6cff34069832498e
SHA1be54bc4033d47cd14bc9648ce964c67b283fb6c6
SHA2566ecb0aee684e895fbaede81d1ecacd3b2379301d7ab37ccd883de5ece7651988
SHA512a4713d6a23b406c2bba2035d34c9e8a7da2b4af1fb27f3a26b9821c45f250766b7d171044b7f8a35bc51a49eae7f6541c483af0bb08f06040b9fc4be567c73e2
-
Filesize
2.1MB
MD5d295038f6facf219e302c0444bffa7b0
SHA117a55b8e0872feb3476eb425758c7b8500e857fb
SHA256a0cc678c942c6f391cb39e06f20cb9a8cdc2e319e41f52023c5e0e7b3985594d
SHA512075691b3e30fd88fc59428f94c05858a0d625b371a1c44625d2d801efe337548bff94d7dc4facf14cbb88679a8186f23b053b9c7952120f40b50498693178e09
-
Filesize
898KB
MD58235b5d1589ab0fe6fbdbf7c63f574f7
SHA13d81dd57f1b105ce0e3648d35be7567e62715bf3
SHA25622dc0e00649fa29f1296d0fa1a3873454548b100f49b96719eb5e53e3076d174
SHA5128304ff6fc771e5973dc3b6a6da03bd9109dc7ef96f54b5a4876e9d1876b6cf97fa0279cee16c957dd87948682673b4f76471b58b1fdf4f33a0e4454cc9eaaaad
-
Filesize
2.7MB
MD5018ab4002d0f1bfdc37b1c9fb9e9cffb
SHA1fc9a3953eaf35b200bef857e3a30aa1557a5291f
SHA256eef10ff2e1de516e49d2c3e257abfa550a733819375ca20d7fdc165879da1c11
SHA512be3a705d025824c9c3f03936e6e3126d3a0fe864a9529a4dde199530e27240e896d4393e87e4b54547852a10e62457e6b63cc70bd26aae30fc6b98f7e2e32eeb
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5064913bff9de30b86b9f2c5cc4bfd6c8
SHA158b4f0fdfc816be53d3613bec91cff732d01d521
SHA2563bc595b237c58be92aec7525618268495dd06aeb8d2c42dd7d5d0a9a4fa6657a
SHA51267c25459cb936dd0454fbf8af7ab817afcce05dea95f1eaf03cf0ad61c62260e963ec5fd8f6469b9fe366c274839b32b9ddc5480f649ecafb3c771bfee2d7000
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\56d941fb-4ef0-44c4-aff8-2c0e1fa2786e
Filesize745B
MD5f8806daa0a4d6b2ede5979585d7a6eed
SHA10dd1c147bb7c5fdd18ce4c451a6840016130305e
SHA256216df1694c7e3ffce949eaba846b6c07442615bdb999d36a69cdfefa15d72614
SHA512d1a19d8945271cb032a06695893ae08aa2287250520268922dea70512b7dcbbe9975937b9df3bd6229058b616a30c0824c81a63d7ced52370fc46be15e5737d4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\86ab1b60-12d6-49d6-ab80-5357eba4e45f
Filesize11KB
MD51e712642cd84e5b916a18a9d930f904a
SHA1d700717078a9d3fd3e34c0c6e3177116d5bdb4f8
SHA256d9947dacf273bd719ad5a0c459d25d5cdb1b8a96257196942c4acb63a0148130
SHA512998b61cf89ddf4ca028b62b1b03e308709e76b51d586af6eca04260af448b2183b16977ae388e6c997a58434fd49f1756e4d34f5130c087d205f36d899ca4dd2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD52c071f511835c9da235c933003d18812
SHA163990e0ea5a2ecf7d30f5335efca2855829a8f16
SHA256ad4fc651f5c7bd21f49ce3a62f7cf87c98789d832fafc27a0cffeb1265a65ae8
SHA5126bf7d3ea161e9349830f24beedf21549fc10d732f63aff213e6078f1ba70ef16f645f44e0a907ea051c930278f5c69a381304426fa3754c22fa244e2f727a736
-
Filesize
7KB
MD531ee4a9c49fce600f34358a76c2991ad
SHA195d11a1fe5b77dbccffa462e98f2410724a88c52
SHA256aed4d0bbc50ec266b0a756160303b365f6e51c8e14829919bf250df76f1f03da
SHA5121f687b3258a99a935a00a9ba52c776b2e2f1d06543aaf76f954814c9185e2d984f0ccf96782df7839ce773ca52f3e941c7f91265c8de6454d447c75c4c8e5cf8
-
Filesize
6KB
MD54a0da6e1d335b5a06e3d1b1ed2b4b42a
SHA15c3ca0fc0c9e53322d21c7b104d60b833b81c463
SHA256bacdedfb0c49cde5afd693a848973084e52a0dd320309c89ed4a170dcc5390d2
SHA5120aa26e4d3a705d2ad02b929e5982ce71c0ed5830b01188300c80fea6f10dea7b958a237768649cd50b96de578ca6465270730bac1000318364f6340f8625a525
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5bf3229d294e946762332ff676ce25e3c
SHA1fddf1cda5e00342dafc82fa2c4644aa0769acdc3
SHA256d5280abf44342287fc98cf762ae01f31891a48aab265f1c046dbf86b3e566879
SHA512a7e46ec89adad83efa1a178a19b61d2d1cb6313c9fb1e31ce74054938ad534ca865864d761bd3f35ef5b9ad89bf45d638ff493b4344e122667f936ac621dbc0a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5bece0acf9d7f19d01c7943c54d2ad372
SHA1aef59ca4b0fe97f32db128e103bfb98aee3b5e29
SHA256ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8
SHA512105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85
-
Filesize
3.1MB
MD55c87bc7b86c06bb8cd470891009473f0
SHA15206f5d15901d89f85e8eaffb3c769c157b0718f
SHA2560bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363
SHA512c4d9f94f58f19c3cadfa0eff7651dcf0c6ef3278848b53a4bb4b5aee19c8442248f233d22256eaf5f1f5e107d635623f8eb5598f3e8bdd3c209b9b6f27d6365a