Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/12/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
3.1MB
-
MD5
0bc8514721ccb995fa1072d8f167d532
-
SHA1
8ab7107e7adbba9e6fe9362e3bb923706c852797
-
SHA256
c87a5e136fafd0da8252d65d01cde92bb27e8da419b57ea32f9522855d0a948d
-
SHA512
488f786a09667183a954126bae120c1131015d2aa94eee1d56563e209418d3330aabe5e373d17eb682298fbcc00a801549c039d52a4778ab1c844d28505c6ce5
-
SSDEEP
24576:DKw0Lh8d7frwfVdnJsypGa6R5iBHjIwUyv6g6t/AicUvPXVvkIs3H/XL8VI6w6Rq:ed6dSVHsa7/PXuPYR6L4mLpTn9cV
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://atten-supporse.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1a95acc57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1a95acc57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1a95acc57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1a95acc57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1a95acc57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1a95acc57.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ff6aa8fd8d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 93a4f7a225.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a1a95acc57.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f392de5c5c.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f392de5c5c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ff6aa8fd8d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 93a4f7a225.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 93a4f7a225.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f392de5c5c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ff6aa8fd8d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a1a95acc57.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a1a95acc57.exe -
Executes dropped EXE 8 IoCs
pid Process 2792 skotes.exe 1920 ziNGMDa.exe 1160 ziNGMDa.exe 2108 ff6aa8fd8d.exe 596 93a4f7a225.exe 876 3af8a9213e.exe 1588 a1a95acc57.exe 3256 f392de5c5c.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine ff6aa8fd8d.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine 93a4f7a225.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine a1a95acc57.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine f392de5c5c.exe -
Loads dropped DLL 14 IoCs
pid Process 3004 file.exe 3004 file.exe 2792 skotes.exe 1920 ziNGMDa.exe 1160 ziNGMDa.exe 2792 skotes.exe 2792 skotes.exe 2792 skotes.exe 2792 skotes.exe 2792 skotes.exe 2792 skotes.exe 2792 skotes.exe 2792 skotes.exe 3256 f392de5c5c.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a1a95acc57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a1a95acc57.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\ff6aa8fd8d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013439001\\ff6aa8fd8d.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\93a4f7a225.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013440001\\93a4f7a225.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\3af8a9213e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013441001\\3af8a9213e.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\a1a95acc57.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013442001\\a1a95acc57.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000600000001868b-255.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3004 file.exe 2792 skotes.exe 2108 ff6aa8fd8d.exe 596 93a4f7a225.exe 1588 a1a95acc57.exe 3256 f392de5c5c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016d1d-35.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff6aa8fd8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 3af8a9213e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 3af8a9213e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93a4f7a225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f392de5c5c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1a95acc57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3af8a9213e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 808 taskkill.exe 2872 taskkill.exe 1608 taskkill.exe 540 taskkill.exe 2888 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3004 file.exe 2792 skotes.exe 2108 ff6aa8fd8d.exe 596 93a4f7a225.exe 876 3af8a9213e.exe 1588 a1a95acc57.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 1588 a1a95acc57.exe 1588 a1a95acc57.exe 3256 f392de5c5c.exe 3256 f392de5c5c.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 808 taskkill.exe Token: SeDebugPrivilege 2872 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 540 taskkill.exe Token: SeDebugPrivilege 2252 firefox.exe Token: SeDebugPrivilege 2252 firefox.exe Token: SeDebugPrivilege 1588 a1a95acc57.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 3004 file.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 2252 firefox.exe 2252 firefox.exe 2252 firefox.exe 2252 firefox.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 2252 firefox.exe 2252 firefox.exe 2252 firefox.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe 876 3af8a9213e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2792 3004 file.exe 31 PID 3004 wrote to memory of 2792 3004 file.exe 31 PID 3004 wrote to memory of 2792 3004 file.exe 31 PID 3004 wrote to memory of 2792 3004 file.exe 31 PID 2792 wrote to memory of 1920 2792 skotes.exe 33 PID 2792 wrote to memory of 1920 2792 skotes.exe 33 PID 2792 wrote to memory of 1920 2792 skotes.exe 33 PID 2792 wrote to memory of 1920 2792 skotes.exe 33 PID 1920 wrote to memory of 1160 1920 ziNGMDa.exe 35 PID 1920 wrote to memory of 1160 1920 ziNGMDa.exe 35 PID 1920 wrote to memory of 1160 1920 ziNGMDa.exe 35 PID 2792 wrote to memory of 2108 2792 skotes.exe 36 PID 2792 wrote to memory of 2108 2792 skotes.exe 36 PID 2792 wrote to memory of 2108 2792 skotes.exe 36 PID 2792 wrote to memory of 2108 2792 skotes.exe 36 PID 2792 wrote to memory of 596 2792 skotes.exe 38 PID 2792 wrote to memory of 596 2792 skotes.exe 38 PID 2792 wrote to memory of 596 2792 skotes.exe 38 PID 2792 wrote to memory of 596 2792 skotes.exe 38 PID 2792 wrote to memory of 876 2792 skotes.exe 39 PID 2792 wrote to memory of 876 2792 skotes.exe 39 PID 2792 wrote to memory of 876 2792 skotes.exe 39 PID 2792 wrote to memory of 876 2792 skotes.exe 39 PID 876 wrote to memory of 2888 876 3af8a9213e.exe 40 PID 876 wrote to memory of 2888 876 3af8a9213e.exe 40 PID 876 wrote to memory of 2888 876 3af8a9213e.exe 40 PID 876 wrote to memory of 2888 876 3af8a9213e.exe 40 PID 876 wrote to memory of 808 876 3af8a9213e.exe 42 PID 876 wrote to memory of 808 876 3af8a9213e.exe 42 PID 876 wrote to memory of 808 876 3af8a9213e.exe 42 PID 876 wrote to memory of 808 876 3af8a9213e.exe 42 PID 876 wrote to memory of 2872 876 3af8a9213e.exe 44 PID 876 wrote to memory of 2872 876 3af8a9213e.exe 44 PID 876 wrote to memory of 2872 876 3af8a9213e.exe 44 PID 876 wrote to memory of 2872 876 3af8a9213e.exe 44 PID 876 wrote to memory of 1608 876 3af8a9213e.exe 46 PID 876 wrote to memory of 1608 876 3af8a9213e.exe 46 PID 876 wrote to memory of 1608 876 3af8a9213e.exe 46 PID 876 wrote to memory of 1608 876 3af8a9213e.exe 46 PID 876 wrote to memory of 540 876 3af8a9213e.exe 48 PID 876 wrote to memory of 540 876 3af8a9213e.exe 48 PID 876 wrote to memory of 540 876 3af8a9213e.exe 48 PID 876 wrote to memory of 540 876 3af8a9213e.exe 48 PID 876 wrote to memory of 2448 876 3af8a9213e.exe 50 PID 876 wrote to memory of 2448 876 3af8a9213e.exe 50 PID 876 wrote to memory of 2448 876 3af8a9213e.exe 50 PID 876 wrote to memory of 2448 876 3af8a9213e.exe 50 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2448 wrote to memory of 2252 2448 firefox.exe 51 PID 2252 wrote to memory of 352 2252 firefox.exe 52 PID 2252 wrote to memory of 352 2252 firefox.exe 52 PID 2252 wrote to memory of 352 2252 firefox.exe 52 PID 2252 wrote to memory of 2284 2252 firefox.exe 53 PID 2252 wrote to memory of 2284 2252 firefox.exe 53 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"C:\Users\Admin\AppData\Local\Temp\1013433001\ziNGMDa.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013439001\ff6aa8fd8d.exe"C:\Users\Admin\AppData\Local\Temp\1013439001\ff6aa8fd8d.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\1013440001\93a4f7a225.exe"C:\Users\Admin\AppData\Local\Temp\1013440001\93a4f7a225.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:596
-
-
C:\Users\Admin\AppData\Local\Temp\1013441001\3af8a9213e.exe"C:\Users\Admin\AppData\Local\Temp\1013441001\3af8a9213e.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.0.1006637906\624888423" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdaa493f-0e38-43a9-96f2-0c6c23fb9ad7} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 1288 123d8258 gpu6⤵PID:352
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.1.352661435\1483077502" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fc7be6a-806e-4e9f-b0ba-0b263aa4400f} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 1508 e74558 socket6⤵PID:2284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.2.902922067\355441701" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57bec4e8-3d98-4373-b426-465d3b029be2} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 2104 19cbb658 tab6⤵PID:1732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.3.1401598049\123877122" -childID 2 -isForBrowser -prefsHandle 2908 -prefMapHandle 1116 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9b85cf9-0328-44f1-bf49-3aa9ffdff025} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 2920 e63958 tab6⤵PID:1676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.4.1694497381\1641235223" -childID 3 -isForBrowser -prefsHandle 3804 -prefMapHandle 3800 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37a3b043-bb7d-4097-be51-9e1b84d72d9a} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 3816 208cf858 tab6⤵PID:2464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.5.1355762529\1460641640" -childID 4 -isForBrowser -prefsHandle 3936 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2edc8c1-a2a4-4bec-9369-1bb249cc466a} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 3924 208cc558 tab6⤵PID:1036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.6.2036118913\407833310" -childID 5 -isForBrowser -prefsHandle 4120 -prefMapHandle 4124 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f8d2267-168f-4e0b-b219-432bd62aac0c} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 4108 20bc9e58 tab6⤵PID:2992
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013442001\a1a95acc57.exe"C:\Users\Admin\AppData\Local\Temp\1013442001\a1a95acc57.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\1013443001\f392de5c5c.exe"C:\Users\Admin\AppData\Local\Temp\1013443001\f392de5c5c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD57e9b20ac6385ec9c0dbabb5b4d707cb9
SHA1ed48718dc36f52a7ec2f40e14a0797b1280bd6bf
SHA2563bd9074658f0d6fb59221b2e52eb3bb52ccc862314de6a2088bab8529b4be9d6
SHA512c15c881e99eabab5b3a853d03d3784324f8679ba4229edc814250c5f281638fe65abf9268eaedfe635ce4cdcf739b8598808157ff5db332e4843ac913ac3f1b3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
9.9MB
MD553306653e88891da35bdfc1330a2dafd
SHA10870df54ca24e32bf88ccf00d7dd0ada3a0ea096
SHA256fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09
SHA512930ff27fc7377eaf0097cc6430f2c5486336c398a7ae08fadbcb0af62490b96c0b9ec3d36455c04e5a79d2405fc0c6f1f6a44b0298f3b6ff46f2a6c591aa51ba
-
Filesize
1.8MB
MD5aea9554a885748e0394687cc80792951
SHA16fe6285b185928ece358988782074e7ddf8ac5de
SHA2561efbb04fa466e6dbab12ce5eded56ad4a4feb1c6a355ed82ebd15b4f35d51080
SHA51256acc112cf707f90eafa2f76a7ae87bd9198fb7175cd2be562ba3d77da8f389e7b6441f7f4e39e58059f71842857b958e75a1c01587d71c3bad6e0d0ff929b8f
-
Filesize
1.7MB
MD5426c4cc5cc662dbf06c9232c69e5d989
SHA166ef4347c88c6f9e42f6fadcd8bc241c3ebff11c
SHA25669877dd837ed30807eb6255dd96d4031f1473a677decb52b023e260c1d7aa851
SHA512e61545a5c91201fb1a374dfa4f0265e28b0a366ba300e427f5e60d8d745ac94013086d1fb6861f41f9396d4c09c7fff5623d7b8d30831a64b42379250bd5a1c7
-
Filesize
947KB
MD5b3a5fcb520f185d12b7a23956d484580
SHA1d142512b47377fbadf7e4c6230735dcb4cfd14ba
SHA2560ff962a7a36b2072e997377dcf8acc2f94c9e47798f4d20c28b7344f7ed876f3
SHA5123fb358b07f6b199adfe50c59917081176b9f2e3f0b6f2b62bbde6f15b0a83f3864d895842b9b24a0a27dde76a7585a4b32e7ab1b048cc6f58aef74aae28b2c67
-
Filesize
2.6MB
MD5cfef37fbe0ea770c5a0c043720b118e7
SHA12f321198ee78970ac623f99c70d9367ae78a6894
SHA2568aa6f2393c9bf51cd7554b6c509fae78f5151f7a5ee8a1499d16f4a4370a3f82
SHA5127c78dc3692e4c4236035fb65b425798ac50a0684b1cf2b87cc0c4ec440ed68b9ef67c82ea02bb3796e1f910b17428c46682fa130365b38406ff50b608ef5a31d
-
Filesize
1.9MB
MD5019e86910ed71e979bc9f08877bc950d
SHA1d98da51af5c79925bbc3e735189990137b01252e
SHA256d3a2826492bfcf84e775bfc185033ecd34cb374cd7ea31a35188957501f394bd
SHA51265d8fedfa3c6b4ee4dc80f626513af7e42f7f4659978caa8e09b2fb3250b809c4a2822265d9cdd83b5266278c495a400ae79e1871b5316a1b1f4f7103b57c0f3
-
Filesize
4.2MB
MD5c6c37b848273e2509a7b25abe8bf2410
SHA1b27cfbd31336da1e9b1f90e8f649a27154411d03
SHA256b7a7f3707beab109b66de3e340e3022dd83c3a18f444feb9e982c29cf23c29b8
SHA512222ad791304963a4b8c1c6055e02c0c4c47fce2bb404bd4f89c022ff9706e29ca6fa36c72350fbf296c8a0e3e48e3756f969c003dd1eb056cd026efe0b7eba40
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD58c1acfea8f814668cb245f880dd9e7e5
SHA19f287e4ec1f79047a7c999b7ed9cf249607820b4
SHA256c70289672fba99a1e3e0b62d2765abd6d0000890c87287c834009ef70ee079de
SHA512e39b9b89fa5bfd1cff7074e4c7919d63da0d932d73e469d228e523ec4b1357f3e25e5e939558e9ca76e9cd10b359ca3387e1512894fdc4b73912b9493e225f21
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\00daff72-c6a2-46a6-b6bc-24c93de407f6
Filesize12KB
MD5527a73dd36d839efeac0e6fca3946993
SHA1627cbe2eeae6963dde6d119c1e099366e98ed365
SHA25647cadbd697d9857dd8ca31e884b46c783f0e59f8844f37b98d68428f5b37752b
SHA5126f575b70169f851660f0903450c24ac9a0dfe1a053d10a8f124f0670560e1ef4d5544af65668b61de90343c7afc7ecc949693e133698ddc5fe49e9723978f22d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\183d50d9-9ecb-48ba-bd9b-ae1b86bd9cd2
Filesize745B
MD51b8e22f5b4799348cbcb9817aa8f6b58
SHA1584e559449b9321d7ab1b9a4b8a9c0a45d8f0ea1
SHA256e343ac89c19be17c91c193f085ec0ef91c3b5557ffebd55a2e269011559f941a
SHA512a2b0f83c6483155bf1f72e9df9e08b77f61c13ca2f7882b1aac0a70adc93ee98a737cd986b1531ef361203875f229fcada4835f5eb8fb668c7286db8ef7d0de5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5d58b12f5e26e789a6f8a3e03ad2b032c
SHA15f625fe5d34853ba87ef2229c0b8047021497f00
SHA256e9f2b502405d60c1e6cb4574bd22bf05cfef36392323ff5d26dc771cce550e17
SHA512490d1ccc6d5402c6eb72f5839a2abf8c9b95a1a10aa990d4cec2ede01e4b32018361fcdc53bb983c7650d2ac69c7fc30b15fee5104fe091fcc120598605939d9
-
Filesize
7KB
MD591bc0332f0d62735b52ad8e8df9a1ac0
SHA160cbd438221259d54947de88c9c808b4142ee1df
SHA2563bd8ed0a4f5db4cced5982e1db663871f1352563cd0bbeab19573c23980f5624
SHA5124c15db14668d874e6c5530577861127b323b507fd92e7c05655deb70a78188523794fe977872438beb68276b5fe0f357bbf766540276d740b5354595a245afe0
-
Filesize
6KB
MD5b213bf706e0c2a4d488af2d342bd63ee
SHA13632efe9d080e7a7868ae37dd0e264b8a44c78a9
SHA256e64ac919a49659442a76be2ea6ad68228bfdfc67dc5ef5f91f59b3ea22af51a7
SHA512e5c7cb2fff8da275d5c85d0a0fbc53f4ac21c9b0330dce3dff5f7761ae583362149ee08010e4db50f31bdfe32a21a7c51181ffd00acefccd6cdd144839750c4e
-
Filesize
6KB
MD5419d3e3ac4d6f360b0232c4b8d7261d9
SHA1100b9fde498f1fddcb9285b6efbd914afacfedea
SHA25610d23c708c14d9816b23ab625a89f7d9a2710851f9afce2ecc8be6397d9dd000
SHA512b012bc79c7a10c258af9244ccf7b07cb2a6649fae6c74947b295037854e2c4da0fad26a5d24a511da73aeacd955a1ebdf5f0eac7a52a431edc76554d4bb78da0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD577ff7a7bce0572a1e348229938d0b49e
SHA193938b34cc8df00dca1245a5d2489f5bdd91398c
SHA256b4e25be43e6d34b5d5afec6afe4e5296f0552e7eea399cc0983e0a6b6dbf41c2
SHA5127924e1e907e592320d05d7f7932f2fcd507225ae85bdef8ffe8c8236c4a5f4b49220c99d14947b6690ff9c950836ee0ce437e0c1f6e63b3f270397c21c9b0f4f
-
Filesize
1.4MB
MD5a8cf5621811f7fac55cfe8cb3fa6b9f6
SHA1121356839e8138a03141f5f5856936a85bd2a474
SHA256614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c
SHA5124479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd
-
Filesize
3.1MB
MD50bc8514721ccb995fa1072d8f167d532
SHA18ab7107e7adbba9e6fe9362e3bb923706c852797
SHA256c87a5e136fafd0da8252d65d01cde92bb27e8da419b57ea32f9522855d0a948d
SHA512488f786a09667183a954126bae120c1131015d2aa94eee1d56563e209418d3330aabe5e373d17eb682298fbcc00a801549c039d52a4778ab1c844d28505c6ce5