Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 22:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20241023-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
f5db9dcea4098275cb46b5d6fe73cef8
-
SHA1
9b623e4cfff93bffbaf7034ebbf893773700ba94
-
SHA256
34959918550ef8a11fe8e0ef9dde5f85f0dac541e62a2cad53998d4a0eb07d9d
-
SHA512
c68ddb34d1268d47f28f7b8e4ed7ac807b39424d09097aabc3274690d1f37bfc3615bdfb69acec1e8c08eee0a3ebbac6fcc99192441cf94ab4d7e14cb917b9c4
-
SSDEEP
49152:xiF3GbjN188C7PW+r5iGNWF79gUeKBlI3uv/zQKsE6d94/Ubd:xiF3UH8D7W+9iGNWhgBmi+vbpsjd94U
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://drive-connect.cyou/api
https://atten-supporse.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://drive-connect.cyou/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
https://atten-supporse.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 4ddb8209ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 4ddb8209ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 4ddb8209ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 4ddb8209ed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 4ddb8209ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 4ddb8209ed.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5fa71407cd.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b60765328e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3213196066.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4ddb8209ed.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b60765328e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3213196066.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4ddb8209ed.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5fa71407cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5fa71407cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b60765328e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3213196066.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4ddb8209ed.exe -
Executes dropped EXE 8 IoCs
pid Process 2876 skotes.exe 616 ba78f544d6.exe 596 ba78f544d6.exe 2764 5fa71407cd.exe 2036 b60765328e.exe 1660 3213196066.exe 2768 8b36c088b3.exe 3376 4ddb8209ed.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 5fa71407cd.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine b60765328e.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 3213196066.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 4ddb8209ed.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe -
Loads dropped DLL 14 IoCs
pid Process 1388 file.exe 1388 file.exe 2876 skotes.exe 2876 skotes.exe 616 ba78f544d6.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2876 skotes.exe 2764 5fa71407cd.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 4ddb8209ed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 4ddb8209ed.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\b60765328e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013536001\\b60765328e.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\3213196066.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013537001\\3213196066.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\8b36c088b3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013538001\\8b36c088b3.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\4ddb8209ed.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013539001\\4ddb8209ed.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000017497-140.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1388 file.exe 2876 skotes.exe 2764 5fa71407cd.exe 2036 b60765328e.exe 1660 3213196066.exe 3376 4ddb8209ed.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 616 set thread context of 596 616 ba78f544d6.exe 34 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fa71407cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b36c088b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 8b36c088b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ddb8209ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba78f544d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b60765328e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba78f544d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 8b36c088b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3213196066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 336 taskkill.exe 2892 taskkill.exe 3016 taskkill.exe 1000 taskkill.exe 2820 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1388 file.exe 2876 skotes.exe 2764 5fa71407cd.exe 2036 b60765328e.exe 1660 3213196066.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 3376 4ddb8209ed.exe 3376 4ddb8209ed.exe 3376 4ddb8209ed.exe 3376 4ddb8209ed.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2820 taskkill.exe Token: SeDebugPrivilege 336 taskkill.exe Token: SeDebugPrivilege 2892 taskkill.exe Token: SeDebugPrivilege 3016 taskkill.exe Token: SeDebugPrivilege 1000 taskkill.exe Token: SeDebugPrivilege 2420 firefox.exe Token: SeDebugPrivilege 2420 firefox.exe Token: SeDebugPrivilege 3376 4ddb8209ed.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 1388 file.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe 2768 8b36c088b3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 2876 1388 file.exe 30 PID 1388 wrote to memory of 2876 1388 file.exe 30 PID 1388 wrote to memory of 2876 1388 file.exe 30 PID 1388 wrote to memory of 2876 1388 file.exe 30 PID 2876 wrote to memory of 616 2876 skotes.exe 32 PID 2876 wrote to memory of 616 2876 skotes.exe 32 PID 2876 wrote to memory of 616 2876 skotes.exe 32 PID 2876 wrote to memory of 616 2876 skotes.exe 32 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 616 wrote to memory of 596 616 ba78f544d6.exe 34 PID 2876 wrote to memory of 2764 2876 skotes.exe 37 PID 2876 wrote to memory of 2764 2876 skotes.exe 37 PID 2876 wrote to memory of 2764 2876 skotes.exe 37 PID 2876 wrote to memory of 2764 2876 skotes.exe 37 PID 2876 wrote to memory of 2036 2876 skotes.exe 38 PID 2876 wrote to memory of 2036 2876 skotes.exe 38 PID 2876 wrote to memory of 2036 2876 skotes.exe 38 PID 2876 wrote to memory of 2036 2876 skotes.exe 38 PID 2876 wrote to memory of 1660 2876 skotes.exe 39 PID 2876 wrote to memory of 1660 2876 skotes.exe 39 PID 2876 wrote to memory of 1660 2876 skotes.exe 39 PID 2876 wrote to memory of 1660 2876 skotes.exe 39 PID 2876 wrote to memory of 2768 2876 skotes.exe 41 PID 2876 wrote to memory of 2768 2876 skotes.exe 41 PID 2876 wrote to memory of 2768 2876 skotes.exe 41 PID 2876 wrote to memory of 2768 2876 skotes.exe 41 PID 2768 wrote to memory of 2820 2768 8b36c088b3.exe 42 PID 2768 wrote to memory of 2820 2768 8b36c088b3.exe 42 PID 2768 wrote to memory of 2820 2768 8b36c088b3.exe 42 PID 2768 wrote to memory of 2820 2768 8b36c088b3.exe 42 PID 2768 wrote to memory of 336 2768 8b36c088b3.exe 44 PID 2768 wrote to memory of 336 2768 8b36c088b3.exe 44 PID 2768 wrote to memory of 336 2768 8b36c088b3.exe 44 PID 2768 wrote to memory of 336 2768 8b36c088b3.exe 44 PID 2768 wrote to memory of 2892 2768 8b36c088b3.exe 46 PID 2768 wrote to memory of 2892 2768 8b36c088b3.exe 46 PID 2768 wrote to memory of 2892 2768 8b36c088b3.exe 46 PID 2768 wrote to memory of 2892 2768 8b36c088b3.exe 46 PID 2768 wrote to memory of 3016 2768 8b36c088b3.exe 48 PID 2768 wrote to memory of 3016 2768 8b36c088b3.exe 48 PID 2768 wrote to memory of 3016 2768 8b36c088b3.exe 48 PID 2768 wrote to memory of 3016 2768 8b36c088b3.exe 48 PID 2768 wrote to memory of 1000 2768 8b36c088b3.exe 50 PID 2768 wrote to memory of 1000 2768 8b36c088b3.exe 50 PID 2768 wrote to memory of 1000 2768 8b36c088b3.exe 50 PID 2768 wrote to memory of 1000 2768 8b36c088b3.exe 50 PID 2768 wrote to memory of 2500 2768 8b36c088b3.exe 52 PID 2768 wrote to memory of 2500 2768 8b36c088b3.exe 52 PID 2768 wrote to memory of 2500 2768 8b36c088b3.exe 52 PID 2768 wrote to memory of 2500 2768 8b36c088b3.exe 52 PID 2500 wrote to memory of 2420 2500 firefox.exe 53 PID 2500 wrote to memory of 2420 2500 firefox.exe 53 PID 2500 wrote to memory of 2420 2500 firefox.exe 53 PID 2500 wrote to memory of 2420 2500 firefox.exe 53 PID 2500 wrote to memory of 2420 2500 firefox.exe 53 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1013509001\ba78f544d6.exe"C:\Users\Admin\AppData\Local\Temp\1013509001\ba78f544d6.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\1013509001\ba78f544d6.exe"C:\Users\Admin\AppData\Local\Temp\1013509001\ba78f544d6.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:596
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013535001\5fa71407cd.exe"C:\Users\Admin\AppData\Local\Temp\1013535001\5fa71407cd.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\1013536001\b60765328e.exe"C:\Users\Admin\AppData\Local\Temp\1013536001\b60765328e.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\1013537001\3213196066.exe"C:\Users\Admin\AppData\Local\Temp\1013537001\3213196066.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\1013538001\8b36c088b3.exe"C:\Users\Admin\AppData\Local\Temp\1013538001\8b36c088b3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2420 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.0.1501844568\316159331" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e54ce6fd-9d22-4a68-b380-c572a222c1c7} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 1304 11fd6158 gpu6⤵PID:1408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.1.2118972941\315947881" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f44c4a54-2332-4682-ad27-d482871f5686} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 1512 d74558 socket6⤵PID:2424
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.2.1471500578\1044210612" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5000d8a-3da2-4553-89c2-6b7a7f72ce74} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 2108 198b5558 tab6⤵PID:1084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.3.682303596\101047645" -childID 2 -isForBrowser -prefsHandle 2584 -prefMapHandle 2580 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0713ddc-4632-4418-b105-40e69eacb505} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 2596 1b59b858 tab6⤵PID:1876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.4.343963708\1674190533" -childID 3 -isForBrowser -prefsHandle 3884 -prefMapHandle 3836 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6864ff04-08c4-4f5e-8bb6-4e992cb4bfb2} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3896 202faf58 tab6⤵PID:576
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.5.1012072518\1025604798" -childID 4 -isForBrowser -prefsHandle 4008 -prefMapHandle 4012 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb79e794-b1e1-4137-a379-f05d30ef65b2} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3996 21022d58 tab6⤵PID:1852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.6.1023412761\1186801037" -childID 5 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d24c2221-81f7-4d12-8a6a-1a92d80aa523} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 4112 21024b58 tab6⤵PID:336
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013539001\4ddb8209ed.exe"C:\Users\Admin\AppData\Local\Temp\1013539001\4ddb8209ed.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp
Filesize23KB
MD58c8e59b5efcc10d3673a990a2ebe0a93
SHA10832d832e862f566e3cd097d93b49a1ad0155844
SHA2562dada5f5888eb79b4e6ed5908f42ad602ae396d5d2744511967f6f35a3d56e4b
SHA5121530e15926d5c6126b12fad4316296ab23faa28556962b746a9aca4caa1c1d41de1af4033348cf561ba074c01df35f921bc36918a65280eb3dbda1c4e55728f2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
809KB
MD59a2cc9d6c6282e7b2a0ff5649a70b0df
SHA199c7c3969c9ab39261b59f047514ff7de2bc4c07
SHA256b08f2b65885b9ae1825d27ddf6dc9189641e0f8817999f4386da55ffcc548287
SHA512b61aa465d601a75426129b2096e900c008faeee6d67b729bf3b2fdeef6957934e9bba7353ad55b499c2722f5381c9cc684f867e4c2b7958e743d1a459eae88d7
-
Filesize
1.9MB
MD508efa0bf248584557641dc5db156248e
SHA18b64a7d0ea9af4524e7be713ba22ab0191528403
SHA25615df6347f76b4d0c86e07c4482e0b81b119265a4dd71f2c729c6bcc59e1cfa9b
SHA5123880c4bb59d0a00be445c3571efb0fbcd679b982d86ed88574f51b788c917f943f10cd71a35ac4389f1b320f6947a15feabd1a5d206bb7be88e8c77990e89add
-
Filesize
1.8MB
MD552f0f216dfbb86683b1e318a0796dd81
SHA12e2b8710e0a077ed8a2124fde2486f397857b8f6
SHA2561d95373c2284b657b614f07051eed5fed72f34f787350409e49e8dc30a5ea494
SHA512bf3bff59a42e2d10238306fe34f072c14bd482cac5c20563987a27174bf304a06cfc9c0b3914254f17695d80b006261b29ea025e2b31324ca3caeedf3da211cb
-
Filesize
1.7MB
MD5cbf2b84f9b993a77c0e2170cccbacb7c
SHA133fdf37b3a3f1394edc5d64c0952064b7f4177ea
SHA2569c9687e8c61b784d08f6d80853666faa0884043ce7b99f4fb3676f3bc563c2f5
SHA51233fc97ad5723e42c856e8797877e2cfb8a6afb48718834dbc4efc3407cf96499844910eff60d60270f72ed288ca7c05552287283ff412f0901739ec9c19ef2d1
-
Filesize
946KB
MD531e83117e3f9c52a9c42bf3b2ab06016
SHA18583f8f8a3264a01dd9991a0f1e0275c0a26f83a
SHA2567eed919e39fe9d07c7a3119281e6e261bed4c4769c451101f72e005a04e11078
SHA51293295bcfcbae4b055d5124aead7d07510fbb44fa8af8f54cf0eea6471e2e0c8d74c3b3880e190dfc153e60d7f5a58147672d3f08dbf39167600cb54fa8fb1476
-
Filesize
2.7MB
MD58ac4a1b0cc739478c779d0909f664099
SHA1b90363c3750ab3ac2cd36d18356108c8be3b647a
SHA256afa4fd51e40bd644b329f993a157df79194ac9820100c3378dacb674dc63ee2c
SHA51228afa024a71aefb0491a4af9d328747dab6c1682cb4a9746e3b01fbc5e610063acf186b6cfcb493491e0e24863dcfaff2f6765d69ab71eb8f28a6c40acf2e8a1
-
Filesize
3.1MB
MD5f5db9dcea4098275cb46b5d6fe73cef8
SHA19b623e4cfff93bffbaf7034ebbf893773700ba94
SHA25634959918550ef8a11fe8e0ef9dde5f85f0dac541e62a2cad53998d4a0eb07d9d
SHA512c68ddb34d1268d47f28f7b8e4ed7ac807b39424d09097aabc3274690d1f37bfc3615bdfb69acec1e8c08eee0a3ebbac6fcc99192441cf94ab4d7e14cb917b9c4
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD55e6c02f18a06fa348da96f040253c9b7
SHA1f80499da3dc6bd1bd98b66238b9e3281bacf6a05
SHA2568be8b8af51e898887f51c802f9a09469b12727b09298130ed6c7950cf930a058
SHA5121cc7da92720fad7b42f59867cb30eab93aa2ba508d45128fdc2f107fbe4fb0d7f388e84f6d628790107251f87b545db95993c3aa554f0de97c1452bb008b5181
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\1cb2841d-77d4-45f5-8f96-2aa82b89b032
Filesize11KB
MD57c468c111395a37a00523ed6513a5f70
SHA150610be78c544b78ce7d3cb39eec401aa6deb000
SHA2565d06e6475aca6f31de86eff4fe6b1fe83c6d42e892f1da669b58af18dd8a16c4
SHA5122fe9a5080305d0f109a73d8b83a4597d6ca12e269fc83510ecd86930f9893fed0a71409da10237bf166c8977e9e4a4359132eb0f9369c44f18e109e573d0e3de
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\4a92e1aa-25d7-4222-9bfa-4fe8809161ad
Filesize745B
MD565cac1130182e268eb46f9e4ff0ff59a
SHA1f7898ed7341d688f142c2cfd01d7ea98aef48f5f
SHA25687025ffc4f5a4a30975faff3b9baf5bbc65fc05f48bf3cf6646f9286d1bf4d1a
SHA5124da5b6f34171bc53002ea239ed607e53415dc2f6f25cf36eecd792bfa826d364ddd1f613884c1bf4b0c2eb3a3e7e7f6994cb4be2edcdab85c68883963f7b42cf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5460f9e25b2e2ba39cf32cb40f0064cda
SHA1ad5408e975d3e15e039d6bc6523781e1ff7bd45d
SHA256b49eb0c7a739cadff14c1a1dab014cbfd9087a4ef74232dcff8a44dfada156e7
SHA51240395bc5bc4fc50155b9eb6568002f91e4182b663794bfc352795209fe19c8a53c17e5b392aa19a1a656f64f996fd67f344ad17c14c45c6a2739c2de09027811
-
Filesize
7KB
MD5ba9cdc70ee677e26a1685d726d41b2e2
SHA1b20f0e64de13039eece5151a4645d5513c9d6cd9
SHA256118c012e6efae0c130af58cbda33ffbe0896a4214cda32c4ea632379966d9c87
SHA51203040ab1f80bc2608a4692fc0c11b584252bd7ae5f43b301ab8a04df80bb36d7f0c93088ccc666e47ee5019be6a68f87da098144cbaad09258cb5d11f6bc7e96
-
Filesize
6KB
MD5542006b5534e304c90fa2a93c3a805cd
SHA1af3b89a5fddefe20efff72af7eb0c509fd8b589f
SHA256bd0b1213ad1da6ac60f04fb6b67303e6d9cafba96a9962cc322d1afab881693d
SHA5127c61f4dcc94861b68d73820c4da896f894f2fd2a83d89331670b8dfd3edce2fda590d91e23c1bc3fda90c4bfc51a50b7ff16f1eafbeb47495a0f3d0bd318c650
-
Filesize
6KB
MD521e59a1e5fcb895510e31826bf8838ea
SHA1481baf3e147661418c563e4e904adc17c5bbfa43
SHA2564fc00f30b2aa100434770313f1ad220e8b8c23b160c8d2c16bf6ea75370da8ca
SHA5129efb449a1f91e797be07e2bd4c1b3981a814bc27eec896e9b5b64f7b9d295d555fa518bc1f49e059cba2de0bd1a80badca7887f48bc2ccad09adebf81c7e14a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5153367a141c7746736811967d6301cf8
SHA1faf761a74eadb04894b92ca14ef2c4b65348f929
SHA2561c964a4b1f7001873aa73df95865b22f2e63fc93806c33cc59a0ed000dc64125
SHA5128683bdf7597b4534ec3eea2012ae7b54540719dfc3716f5655350bdf7c6c17128211c4ee29459db51b5a198e6715eb060dfc9fb4df439ba36e94c4208ec61a24
-
Filesize
1.4MB
MD5a8cf5621811f7fac55cfe8cb3fa6b9f6
SHA1121356839e8138a03141f5f5856936a85bd2a474
SHA256614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c
SHA5124479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd