Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/12/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe
Resource
win7-20240708-en
General
-
Target
a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe
-
Size
3.1MB
-
MD5
93466f88f4f2f8ea092bd09756760ce0
-
SHA1
ef5cf2952ca01f1c9f48209527d450cae503800d
-
SHA256
a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1
-
SHA512
192e89465f65b3a0c32019ac1d3ef833752446c7a0665d83b5caf95057fb4781e89993da0a396df5fbb8d3d5a7e88f3679d6683dedaafa24e4987f937b8c56a9
-
SSDEEP
49152:r+fUCjXJvougi8pQotNWj6LS1HWTB/ewzAXvvtDAlng5LO:rgvZgi8pfXWmLuA/ewzAXvvtug
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://atten-supporse.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a642826272.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a642826272.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a642826272.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a642826272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a642826272.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a642826272.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ afe76c087b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 35373b9810.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a642826272.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 35373b9810.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a642826272.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a642826272.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion afe76c087b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion afe76c087b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 35373b9810.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Executes dropped EXE 5 IoCs
pid Process 2708 skotes.exe 1088 afe76c087b.exe 2004 35373b9810.exe 1608 8bed0a0067.exe 1056 a642826272.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine afe76c087b.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 35373b9810.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine a642826272.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe -
Loads dropped DLL 8 IoCs
pid Process 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 2708 skotes.exe 2708 skotes.exe 2708 skotes.exe 2708 skotes.exe 2708 skotes.exe 2708 skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a642826272.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a642826272.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\afe76c087b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013100001\\afe76c087b.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\35373b9810.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013101001\\35373b9810.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\8bed0a0067.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013102001\\8bed0a0067.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\a642826272.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013103001\\a642826272.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0005000000019d5c-72.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 2708 skotes.exe 1088 afe76c087b.exe 2004 35373b9810.exe 1056 a642826272.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afe76c087b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 8bed0a0067.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8bed0a0067.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 8bed0a0067.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a642826272.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35373b9810.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 2008 taskkill.exe 1640 taskkill.exe 1552 taskkill.exe 1036 taskkill.exe 1744 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 2708 skotes.exe 1088 afe76c087b.exe 2004 35373b9810.exe 1608 8bed0a0067.exe 1056 a642826272.exe 1608 8bed0a0067.exe 1056 a642826272.exe 1056 a642826272.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2008 taskkill.exe Token: SeDebugPrivilege 1640 taskkill.exe Token: SeDebugPrivilege 1552 taskkill.exe Token: SeDebugPrivilege 1036 taskkill.exe Token: SeDebugPrivilege 1744 taskkill.exe Token: SeDebugPrivilege 1152 firefox.exe Token: SeDebugPrivilege 1152 firefox.exe Token: SeDebugPrivilege 1056 a642826272.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1152 firefox.exe 1152 firefox.exe 1152 firefox.exe 1152 firefox.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1152 firefox.exe 1152 firefox.exe 1152 firefox.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe 1608 8bed0a0067.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2708 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 30 PID 2372 wrote to memory of 2708 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 30 PID 2372 wrote to memory of 2708 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 30 PID 2372 wrote to memory of 2708 2372 a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe 30 PID 2708 wrote to memory of 1088 2708 skotes.exe 33 PID 2708 wrote to memory of 1088 2708 skotes.exe 33 PID 2708 wrote to memory of 1088 2708 skotes.exe 33 PID 2708 wrote to memory of 1088 2708 skotes.exe 33 PID 2708 wrote to memory of 2004 2708 skotes.exe 35 PID 2708 wrote to memory of 2004 2708 skotes.exe 35 PID 2708 wrote to memory of 2004 2708 skotes.exe 35 PID 2708 wrote to memory of 2004 2708 skotes.exe 35 PID 2708 wrote to memory of 1608 2708 skotes.exe 36 PID 2708 wrote to memory of 1608 2708 skotes.exe 36 PID 2708 wrote to memory of 1608 2708 skotes.exe 36 PID 2708 wrote to memory of 1608 2708 skotes.exe 36 PID 1608 wrote to memory of 2008 1608 8bed0a0067.exe 37 PID 1608 wrote to memory of 2008 1608 8bed0a0067.exe 37 PID 1608 wrote to memory of 2008 1608 8bed0a0067.exe 37 PID 1608 wrote to memory of 2008 1608 8bed0a0067.exe 37 PID 1608 wrote to memory of 1640 1608 8bed0a0067.exe 39 PID 1608 wrote to memory of 1640 1608 8bed0a0067.exe 39 PID 1608 wrote to memory of 1640 1608 8bed0a0067.exe 39 PID 1608 wrote to memory of 1640 1608 8bed0a0067.exe 39 PID 1608 wrote to memory of 1552 1608 8bed0a0067.exe 41 PID 1608 wrote to memory of 1552 1608 8bed0a0067.exe 41 PID 1608 wrote to memory of 1552 1608 8bed0a0067.exe 41 PID 1608 wrote to memory of 1552 1608 8bed0a0067.exe 41 PID 1608 wrote to memory of 1036 1608 8bed0a0067.exe 43 PID 1608 wrote to memory of 1036 1608 8bed0a0067.exe 43 PID 1608 wrote to memory of 1036 1608 8bed0a0067.exe 43 PID 1608 wrote to memory of 1036 1608 8bed0a0067.exe 43 PID 1608 wrote to memory of 1744 1608 8bed0a0067.exe 45 PID 1608 wrote to memory of 1744 1608 8bed0a0067.exe 45 PID 1608 wrote to memory of 1744 1608 8bed0a0067.exe 45 PID 1608 wrote to memory of 1744 1608 8bed0a0067.exe 45 PID 1608 wrote to memory of 2500 1608 8bed0a0067.exe 47 PID 1608 wrote to memory of 2500 1608 8bed0a0067.exe 47 PID 1608 wrote to memory of 2500 1608 8bed0a0067.exe 47 PID 1608 wrote to memory of 2500 1608 8bed0a0067.exe 47 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 2500 wrote to memory of 1152 2500 firefox.exe 48 PID 1152 wrote to memory of 2156 1152 firefox.exe 49 PID 1152 wrote to memory of 2156 1152 firefox.exe 49 PID 1152 wrote to memory of 2156 1152 firefox.exe 49 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 PID 1152 wrote to memory of 2528 1152 firefox.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe"C:\Users\Admin\AppData\Local\Temp\a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1013100001\afe76c087b.exe"C:\Users\Admin\AppData\Local\Temp\1013100001\afe76c087b.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\1013101001\35373b9810.exe"C:\Users\Admin\AppData\Local\Temp\1013101001\35373b9810.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2004
-
-
C:\Users\Admin\AppData\Local\Temp\1013102001\8bed0a0067.exe"C:\Users\Admin\AppData\Local\Temp\1013102001\8bed0a0067.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.0.1280122516\9769039" -parentBuildID 20221007134813 -prefsHandle 1244 -prefMapHandle 1236 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51963e0d-a517-415d-b794-fe20dc2d2298} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 1308 105dab58 gpu6⤵PID:2156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.1.1208505366\1468494206" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63549cc7-c81b-4ef5-81a5-ca26097fa182} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 1524 e74558 socket6⤵PID:2528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.2.1607100989\395852078" -childID 1 -isForBrowser -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {355cc88e-5598-48a0-ab87-1f40a969ad31} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 2088 19d99e58 tab6⤵PID:2252
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.3.1455949356\503020415" -childID 2 -isForBrowser -prefsHandle 2720 -prefMapHandle 2716 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5baffea-c922-40e5-807a-47dbcba66b49} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 2732 e64258 tab6⤵PID:2112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.4.1478221099\1738408912" -childID 3 -isForBrowser -prefsHandle 3752 -prefMapHandle 3740 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2219d84f-bc79-4662-9a6f-b0ada71d1c27} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 3736 1e4e5d58 tab6⤵PID:2492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.5.999464828\2091107112" -childID 4 -isForBrowser -prefsHandle 3900 -prefMapHandle 1124 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c931891-51a4-4a6b-95cc-6917b9df7cc9} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 3888 1e41f858 tab6⤵PID:1288
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1152.6.1053904110\667942721" -childID 5 -isForBrowser -prefsHandle 3836 -prefMapHandle 3844 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b5570f9-2ea1-4795-b22e-f24e72f9d388} 1152 "\\.\pipe\gecko-crash-server-pipe.1152" 3820 1f771058 tab6⤵PID:1852
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013103001\a642826272.exe"C:\Users\Admin\AppData\Local\Temp\1013103001\a642826272.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp
Filesize31KB
MD5c981e3ed5c70a6d5cdcfffdc85839628
SHA1b43ac1f1b0fb22956422933cba057ff7c79eabe0
SHA25626a9319916d8e3e47eca3e0e6d50c78968ed2929d4073ba01575afc0da8c90f6
SHA512cd1cfe352acbdc7a27dc8cbfa6127217c781bdbcf1cd20d8c26b748e753ee4222445861126a601f51868111cdbfea066c7c482cbca47a80565974858fa8c5fd6
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.8MB
MD5ae3d45c9e87392c2696c359cc7c76b36
SHA1bc712f300ea25748028255e83a2c52dd9c814c78
SHA2569a94dc4f3aa50a4730403c56d03e4b4a58cdc3a68d37548ea431f93010a6879a
SHA5120ec5f292f2c73d894c7b66cd69653663d735c899a41ce02d5dc43b06cb3662b23b1c7ffb0a36bc2a29f6e10fc7309a94fac4bb25c3036b1e5487747ef12e78be
-
Filesize
1.7MB
MD54359e876386a8d8d35132404f6e2090f
SHA1160801525ab37269a6ada9bc36991cd2f0f09112
SHA256ee5647fd7e2f7c8de0a96833d057a28ca051ee67ef8d10b97196418d2b55c340
SHA512c64038a5256bc95eadabdcce643135b2228efa1091009b53a62a5277090756f4872f47a39caf29ef99383a6f6c67d2f57b39fe33f0c231542eb5992d0487690e
-
Filesize
947KB
MD57a102edcea7928fa9540e204419a27c3
SHA12283ef07f7ad3b97c55a2c18286196cfe20c39e5
SHA2566c3a98e206d5c4ffa7ee6df0fe98808da4d45da7d5fbcbaddbf2d4417eb4aed4
SHA5124e18edf420d155c14894fb6f3a41a42bb2920629d1ff1a832006de8c6254b7de7caebdb9b501cdc66e28ecc1c73a7ddbdf64bcaaf43b33f24b93894fe0f0aaf8
-
Filesize
2.6MB
MD5c86f1f5cdd71da3c1553b05ad734681c
SHA1ddc9672b2948584778e5ed65b7a286acd884c841
SHA256981841af8c8073eb15b084cd48f2572ec44f72a2fc3a775b0cba574e26a97403
SHA5128372f3e4b18a0110a798af9de37e90fa57c90ba05062172b3f4891ad8be5ee8d17dc820bbaff47749752d66284429d745afc8c92e5b54d793e176db1e7d2043e
-
Filesize
3.1MB
MD593466f88f4f2f8ea092bd09756760ce0
SHA1ef5cf2952ca01f1c9f48209527d450cae503800d
SHA256a52032816d7f78f3d765e1f02d0582ad0c5059a3883ce8bb4183ed0dc999f4e1
SHA512192e89465f65b3a0c32019ac1d3ef833752446c7a0665d83b5caf95057fb4781e89993da0a396df5fbb8d3d5a7e88f3679d6683dedaafa24e4987f937b8c56a9
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD55eadc8da00464d7a2bbf3fee06adbcb0
SHA15be095e4a13aea6c2b71261e6ff39fb23b5927b9
SHA256bcdf58dfc7e72b11f709e4867fb49304c9f306be6b53dd0e8da7d32837e354c9
SHA5127c5c86b4085abb201ac3527e301af586d893f2e3e41d2f1d3a237de4d7ce7a7ab4010168c4f5c49378126a71997ca11148d1dbdb20046e224cc172d0da32a2af
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\4f1f7b47-0215-4b5a-81a5-77e51168d575
Filesize12KB
MD5482f4837b3fe20f97ab1579a6f48f352
SHA13b3a673bb4208665232a4444a6d579de1eb6354e
SHA256e4ad014d25a012b689ae52041aab08bbb12bc2542481805c6a1443bc021e8f80
SHA51257f4ce23f87752eeb210b9f25dbd33d77caef45ff3ca5b19424100a58d33d5b0bc06f13e2e4259370dbcf31d6b64eb3f0ab1d87abb02232671c8b6ad0490ed99
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\90be07d3-a2e3-45ed-a700-d967d77478d4
Filesize745B
MD533c44dfa1f964548bffd55b554e36c75
SHA1d1580f7a21d8b0e066c881277c55d5b6dbdac40c
SHA25614d459734b679c3f216392674152774e0fe0209ed1e6801b3c80162218c9a780
SHA512b579d9e0594f2543adac4e30ea04f1d304295e8c9394ac02002f3bf7b47ce8895d48f5a3e31a8ab04a17add28f7f22e1ecfe1594195f3da0b5e1c537617657f5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5de6338fdac21e4917a9b1476b6e08aa3
SHA1173a5077954057722ad786fb48cc8eadf441038f
SHA2569c044c22a2f9e31be770542508257a54863a8ccbf066df153db2db89f8b18b03
SHA512b2bd11940cce03ff059dddc09efcab13d0875f2c7fedbd987bb65e61304c456f3ba50e49eb60ae0e7fc892c03cdf66e400d2e81e8482a9644f0a8791dcaa4c9e
-
Filesize
7KB
MD573353f1f80f64da38ebf5776ca313b76
SHA179ad55c8567c2c5df02697e9ed786914aa815d6f
SHA2561cb32651f45ae1f76984eefaefaa38821bfc79149cbca737bcea3849211be22c
SHA5123139f49478feb43cbfe270e2787cc3909efe92661d6b275ac38ac4b0f1e58a0b5a613552d188cef401d35783de985d1ac6045ee38374cb9d82dbdefe21559127
-
Filesize
7KB
MD55541dca828b934996c0757b570304800
SHA16770ab7d583f191026c60d843b7f998737a1b849
SHA256d210a3b955267c803e1943e4f45b47226150e05b12929c776d32982870e6e5c7
SHA5123ff6803ebf4842b2d558bb7de66938d6c24d2a798696a431d6e7651b1630b0a130f9bf88adb76ade7f9e4dc188a3207e2cbd91016c93fd4813f4bc52b2bd4daf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD55e48d25a63e2dea184a5e32e3260085e
SHA14629ff663217fdd8f6773b5d3ed3a0cc539e81a9
SHA256a152c4a056c7ff5bc66596f0ed331f1ea9c8a276119488e577e7dcf95f91a52f
SHA512d95c944841106bcd90640259e2ca521624728b5581a43b1ccb9f84579e1ed464e14314bc7f24a2ff9d5d0fdec43b6a0b6f6356cce4e626d25310fdd7568bbef0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD53dc733f51b6c47c0e57ae7035b9abacf
SHA1d4c28a6f9d4bae9e297440a46726a2cb3e2504ba
SHA256aafa700fb884f14becaf86a0eb9df79dfa15885b2ebe11cabe5f48a3a5d9e0e1
SHA512e02670f6fa626a21ad150e0e0e589ba9f1f7a1fb921dc28f4117dc0a30a337b9c9b165dd0a30da864fe4dbdf130372e846648792a0bcf5aad4e8d28118101067