Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/12/2024, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240729-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
1b82d576a24fea9887d2053400b398e1
-
SHA1
c16ed93fa092a43ed3e58cfe67a97cfc2a116fa0
-
SHA256
63dd53f2a2e04de1526484e736943956df062793e16274a8c1460a229d7149af
-
SHA512
5df6454c655b96a7004630123848201e2e43b084b72adf8d97f1e3227bf0f473ed27f49b6edd1f6e2f28dc2937680407bb09dff6c3cf467cb08de31a238928d8
-
SSDEEP
49152:Ao4gSaEAMcmCV75hKOouPdSxTAM3dQsHC:/RSagctZ5hR3SxEMNQsHC
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
lumma
https://atten-supporse.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 39244a9e2d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 39244a9e2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 39244a9e2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 39244a9e2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 39244a9e2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 39244a9e2d.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ab4e0f84c8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 39244a9e2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5414b81da0.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5414b81da0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5414b81da0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 39244a9e2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 39244a9e2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ab4e0f84c8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ab4e0f84c8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Executes dropped EXE 5 IoCs
pid Process 2804 skotes.exe 1112 5414b81da0.exe 1484 ab4e0f84c8.exe 1068 8694b7c33e.exe 576 39244a9e2d.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine 5414b81da0.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine ab4e0f84c8.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine 39244a9e2d.exe -
Loads dropped DLL 8 IoCs
pid Process 2096 file.exe 2096 file.exe 2804 skotes.exe 2804 skotes.exe 2804 skotes.exe 2804 skotes.exe 2804 skotes.exe 2804 skotes.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 39244a9e2d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 39244a9e2d.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\5414b81da0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013080001\\5414b81da0.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ab4e0f84c8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013081001\\ab4e0f84c8.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\8694b7c33e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013082001\\8694b7c33e.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\39244a9e2d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013083001\\39244a9e2d.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000018b62-77.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2096 file.exe 2804 skotes.exe 1112 5414b81da0.exe 1484 ab4e0f84c8.exe 576 39244a9e2d.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 8694b7c33e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39244a9e2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5414b81da0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab4e0f84c8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8694b7c33e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 8694b7c33e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 1876 taskkill.exe 2596 taskkill.exe 2368 taskkill.exe 3036 taskkill.exe 2372 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2096 file.exe 2804 skotes.exe 1112 5414b81da0.exe 1484 ab4e0f84c8.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 576 39244a9e2d.exe 576 39244a9e2d.exe 576 39244a9e2d.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1876 taskkill.exe Token: SeDebugPrivilege 2596 taskkill.exe Token: SeDebugPrivilege 2368 taskkill.exe Token: SeDebugPrivilege 3036 taskkill.exe Token: SeDebugPrivilege 2372 taskkill.exe Token: SeDebugPrivilege 2976 firefox.exe Token: SeDebugPrivilege 2976 firefox.exe Token: SeDebugPrivilege 576 39244a9e2d.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2096 file.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 2976 firefox.exe 2976 firefox.exe 2976 firefox.exe 2976 firefox.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 2976 firefox.exe 2976 firefox.exe 2976 firefox.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe 1068 8694b7c33e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2804 2096 file.exe 31 PID 2096 wrote to memory of 2804 2096 file.exe 31 PID 2096 wrote to memory of 2804 2096 file.exe 31 PID 2096 wrote to memory of 2804 2096 file.exe 31 PID 2804 wrote to memory of 1112 2804 skotes.exe 33 PID 2804 wrote to memory of 1112 2804 skotes.exe 33 PID 2804 wrote to memory of 1112 2804 skotes.exe 33 PID 2804 wrote to memory of 1112 2804 skotes.exe 33 PID 2804 wrote to memory of 1484 2804 skotes.exe 34 PID 2804 wrote to memory of 1484 2804 skotes.exe 34 PID 2804 wrote to memory of 1484 2804 skotes.exe 34 PID 2804 wrote to memory of 1484 2804 skotes.exe 34 PID 2804 wrote to memory of 1068 2804 skotes.exe 36 PID 2804 wrote to memory of 1068 2804 skotes.exe 36 PID 2804 wrote to memory of 1068 2804 skotes.exe 36 PID 2804 wrote to memory of 1068 2804 skotes.exe 36 PID 1068 wrote to memory of 1876 1068 8694b7c33e.exe 37 PID 1068 wrote to memory of 1876 1068 8694b7c33e.exe 37 PID 1068 wrote to memory of 1876 1068 8694b7c33e.exe 37 PID 1068 wrote to memory of 1876 1068 8694b7c33e.exe 37 PID 1068 wrote to memory of 2596 1068 8694b7c33e.exe 39 PID 1068 wrote to memory of 2596 1068 8694b7c33e.exe 39 PID 1068 wrote to memory of 2596 1068 8694b7c33e.exe 39 PID 1068 wrote to memory of 2596 1068 8694b7c33e.exe 39 PID 1068 wrote to memory of 2368 1068 8694b7c33e.exe 41 PID 1068 wrote to memory of 2368 1068 8694b7c33e.exe 41 PID 1068 wrote to memory of 2368 1068 8694b7c33e.exe 41 PID 1068 wrote to memory of 2368 1068 8694b7c33e.exe 41 PID 1068 wrote to memory of 3036 1068 8694b7c33e.exe 43 PID 1068 wrote to memory of 3036 1068 8694b7c33e.exe 43 PID 1068 wrote to memory of 3036 1068 8694b7c33e.exe 43 PID 1068 wrote to memory of 3036 1068 8694b7c33e.exe 43 PID 1068 wrote to memory of 2372 1068 8694b7c33e.exe 45 PID 1068 wrote to memory of 2372 1068 8694b7c33e.exe 45 PID 1068 wrote to memory of 2372 1068 8694b7c33e.exe 45 PID 1068 wrote to memory of 2372 1068 8694b7c33e.exe 45 PID 1068 wrote to memory of 636 1068 8694b7c33e.exe 47 PID 1068 wrote to memory of 636 1068 8694b7c33e.exe 47 PID 1068 wrote to memory of 636 1068 8694b7c33e.exe 47 PID 1068 wrote to memory of 636 1068 8694b7c33e.exe 47 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 636 wrote to memory of 2976 636 firefox.exe 48 PID 2976 wrote to memory of 2736 2976 firefox.exe 49 PID 2976 wrote to memory of 2736 2976 firefox.exe 49 PID 2976 wrote to memory of 2736 2976 firefox.exe 49 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 PID 2976 wrote to memory of 2152 2976 firefox.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1013080001\5414b81da0.exe"C:\Users\Admin\AppData\Local\Temp\1013080001\5414b81da0.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\1013081001\ab4e0f84c8.exe"C:\Users\Admin\AppData\Local\Temp\1013081001\ab4e0f84c8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\1013082001\8694b7c33e.exe"C:\Users\Admin\AppData\Local\Temp\1013082001\8694b7c33e.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.0.46786945\1058243803" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fcf2e3a-6219-4a95-8f40-7bda0d956a75} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 1300 42d7658 gpu6⤵PID:2736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.1.277327976\1504781452" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10613114-7967-4094-b1dd-f0228730711d} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 1496 e74b58 socket6⤵PID:2152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.2.1730981619\2061568531" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {035683ab-7be6-467b-8c3b-6771a4d23a0d} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 2104 1a6b8358 tab6⤵PID:2872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.3.907147916\1886950526" -childID 2 -isForBrowser -prefsHandle 2924 -prefMapHandle 2864 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8586e5ac-5008-4033-9a7d-a9b67d2bc012} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 2936 e63c58 tab6⤵PID:2176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.4.546796685\1381413469" -childID 3 -isForBrowser -prefsHandle 3808 -prefMapHandle 3804 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e700257-c5b1-4933-9f80-8f8b9ae67faf} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 3820 21895458 tab6⤵PID:3004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.5.583885108\1796048607" -childID 4 -isForBrowser -prefsHandle 3924 -prefMapHandle 3928 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {668cefa8-d239-4c92-a1ba-3ef617ecf21b} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 3912 21895758 tab6⤵PID:1888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2976.6.1557439343\345387561" -childID 5 -isForBrowser -prefsHandle 4048 -prefMapHandle 4052 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae88489a-d558-4666-87d8-5ca371e094ff} 2976 "\\.\pipe\gecko-crash-server-pipe.2976" 3820 21897b58 tab6⤵PID:2380
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013083001\39244a9e2d.exe"C:\Users\Admin\AppData\Local\Temp\1013083001\39244a9e2d.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp
Filesize29KB
MD57bedc0ef978fba796b8210da2bc53445
SHA1d97c58c9198727ceedffef9f3212aa858ee1ddd0
SHA256715d23310ba46d1e23d0576c0a0a1727fceb77206768da30eb5910abf1e3b15f
SHA512caa423f67fe6de22c4a7a53e3e7c2558d6f25dbb8d2d0806a71293d487156d15537976e7b1cd0092c9614b814516f6adbb6e8a070a526ee01302adc91fc9e0e0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.7MB
MD506cc1e6cb96567a1c093e5818199c923
SHA1f8088a097de5ba333506b686eaa6aa6bf0f49db4
SHA256fb04fd6f7e99a164af92b5ea236e1c9cc62f6bf842e263dcce45429d3d7068b8
SHA51285f67606ebdde69f3df353da4efb409847e25ad9c6df343171befbfab6e4049898c0cd88f6c7377bd08180f1ae7b76f27753ded56efd46ea8730d8249287e869
-
Filesize
1.7MB
MD57218258407d8eb0196cde40a1c5077ed
SHA194a13e5bedc1f4f68f913e6f8661219d42775d10
SHA256592abfafc316f7bc70f4ba70308b1351438f8a57f20d1e7d092f486076ebec60
SHA51243dbaff962e0b82e19d228e6d72e4241733aab6fdb395b3721b6641e80dd6fb680e1e8375959239a6fd76fa72708864fa85462373980851b3a1286633afdcd0a
-
Filesize
947KB
MD500e85f531dfebf8fa8a4539da21cd8bb
SHA1e872754179cd34ea1a06f1a1793490a55553ae54
SHA256c41bf66d05d11d4c0cd3ef2c245f7647ca64fd99220ac33694a40bd68425b03c
SHA5122b55fa94017c4eb97d72e15fde5e32b922db3cc3d03a98c2ba10d93c3f6d1fc332daae4231809e1253689acc2103cfb151bc87b33f099ad7a6acc7ae84ec286c
-
Filesize
2.7MB
MD536521d750e7fd8ba209fe3efcb1ff687
SHA1214e7fc99702013baeed77d562dcd98353cf2a2b
SHA256d9afb3b438f245aa0f279e1e0a70263080df6fbd4cf134e30356274a287a1463
SHA5123e61d70dc24070cedf3dfbc14d3852ca022a5966d71f9fa189a4fc5d7433d60b11b9937b42b4a4234745a690f1455639e5d6961f36762d7ab3d69b2c0ddf5e88
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD56852b768636759143794dc66604a0e84
SHA1c30781f831107a15923872dd27e77937881dc2ea
SHA25600619ff39b0f7fe3bb090a3cb1d912e7a3b8478617655a6ab3bc8bc666df4871
SHA512fd6d9a2f1e2704530c0e16db6d199e3fe653c68861969aa9b08702870603b294a771cf4fa3e4b3fb33333c5e5b5fa6bdfc1a38e743f8de89d56d841259f78423
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\ae9001b0-2948-4cae-94a4-6e23cd749716
Filesize733B
MD57e44d51d92d62cade512949b7a5ea1bb
SHA19af458639427da3e4626b8d499467acd9a06e1da
SHA256a688df75bd3e57fdb741ebaed05828b2299f724e01204a3975ba0f16e5a9a3d2
SHA512b303fff1e311fbf19b482d0388e77cf19e4aa7ac6c7a12f8f6a92cf320cca6f81c56a351a1f4453e38f5d4e581f6a968b24927dc565f2d4ae409ac24a85c0be0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5867303d176381bb0c072a4267e9fc896
SHA115c39010b84d9d3ec4cd9aced780248827b65d2f
SHA25603af73905124158d99a67e413bd81c5d9cda828b2039bf6e90514c352f845b51
SHA512a93e60dbf7603616eaf6d3c631636f956dc3ef747b09ced1d114d381a809a9b525de6df8dede4b9429c5d38bad7a327f1927daf6f3b3d61e938fa81a8013cb59
-
Filesize
7KB
MD57782bfbcbe8a489599a2fbc073f36c1d
SHA1a1021311ffd5909c44a15bf3d1b26fe97ced6dc7
SHA256286539fd57f734d260cdb595e300d9519a6422f3bd30f0d8cfb8e68f41ca84ee
SHA51205d6ea4e00852092c5ee59fbca7ad7dbe259212bb8af33e02443e0c2d5671d18b388397a23f9659d3c9674d1f7817f1a89a7cf8a58262428aa94d5d178cab807
-
Filesize
6KB
MD5633ebc321317e2d6759b8b0dcf857105
SHA1fd4fe888c30cbd83e8a359e28b9a7e350207e66d
SHA256e838ad150b1ad3523898926dbc27daa8fe2b53071d0f0fb29af562728ac84430
SHA512231ac1e50241df066bb1417874063d40433e27e16a64cb11a0d50290dc65bafb5cea53cd2376568122753fbc32197018b5622085555c52c21447acc6a2a4629c
-
Filesize
6KB
MD5c04e7c4b468c6e881936301075581132
SHA18e48771d7f9c259e0e37c4c3cfaa2a30366c9c1c
SHA256ff8b3190cd2a851ac78e135a62fa19869446831a728db7bdc39a57e34d56196e
SHA5120c43e835a88f4a8eee97931fa11cd490e0e41b4d24a98343a969f7e9ead0bc889dff9e3aa79f372cd5b268c700bd73bda02627170fbbd38edd52c37fe3ed2cdf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5a0942648f85f5aadd788d0f4f4b60c25
SHA1c7bb5370cf3dc722c6d7e23e9ad0c91e01341889
SHA25650b98f5c7f64302215facdbbb888badfba95bdc9485f4fa773e767acd4ba2260
SHA5121b524dd362097f4b7e42821df799cd2aa1401ac2581b8712936446ecf48c14bedd38be71b6da99b3c73854d86e070599020f5855c45bf2686a1af66f2d09140d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5bece0acf9d7f19d01c7943c54d2ad372
SHA1aef59ca4b0fe97f32db128e103bfb98aee3b5e29
SHA256ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8
SHA512105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b
-
Filesize
3.1MB
MD51b82d576a24fea9887d2053400b398e1
SHA1c16ed93fa092a43ed3e58cfe67a97cfc2a116fa0
SHA25663dd53f2a2e04de1526484e736943956df062793e16274a8c1460a229d7149af
SHA5125df6454c655b96a7004630123848201e2e43b084b72adf8d97f1e3227bf0f473ed27f49b6edd1f6e2f28dc2937680407bb09dff6c3cf467cb08de31a238928d8