Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 03:23
Static task
static1
Behavioral task
behavioral1
Sample
b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe
Resource
win7-20240708-en
General
-
Target
b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe
-
Size
3.1MB
-
MD5
9616371054857f390d2a2cefeb6fb9ea
-
SHA1
e1b0ffc6f19b81ecd8552483986570a0acafe576
-
SHA256
b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442
-
SHA512
1cefd75f8f84a5bdc2af9225f034a4cc9067287f674a64495f534f910d39ca45738a4736d650c5cb99824bce4ca9b3ff0371bc7f66651e525aa79e13103139a5
-
SSDEEP
24576:A+FiXZMeKDrxsQKUxPbp8CzZb9Ynxo+LItEHUpYxD8eXg3A87hzdnMOrVe6+9KD7:aZGx91yJTXO3pX+GoCXb
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
https://impend-differ.biz/api
https://print-vexer.biz/api
https://dare-curbys.biz/api
https://covery-mover.biz/api
https://formy-spill.biz/api
https://dwell-exclaim.biz/api
https://zinc-sneark.biz/api
https://se-blurry.biz/api
https://atten-supporse.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://atten-supporse.biz/api
https://se-blurry.biz/api
https://zinc-sneark.biz/api
Signatures
-
Amadey family
-
Gcleaner family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 41aa1a3660.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 41aa1a3660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 41aa1a3660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 41aa1a3660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 41aa1a3660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 41aa1a3660.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4b7f3a7c48.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1e9bb0a28b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 41aa1a3660.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 625bcc1b39.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 625bcc1b39.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4b7f3a7c48.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4b7f3a7c48.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1e9bb0a28b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 625bcc1b39.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1e9bb0a28b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 41aa1a3660.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 41aa1a3660.exe -
Executes dropped EXE 6 IoCs
pid Process 2852 skotes.exe 1744 4b7f3a7c48.exe 2056 1e9bb0a28b.exe 1388 d7fb74ccf3.exe 1532 41aa1a3660.exe 3188 625bcc1b39.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 4b7f3a7c48.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 1e9bb0a28b.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 41aa1a3660.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 625bcc1b39.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe -
Loads dropped DLL 11 IoCs
pid Process 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 2852 skotes.exe 2852 skotes.exe 2852 skotes.exe 2852 skotes.exe 2852 skotes.exe 2852 skotes.exe 2852 skotes.exe 2852 skotes.exe 3188 625bcc1b39.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 41aa1a3660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 41aa1a3660.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\41aa1a3660.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013599001\\41aa1a3660.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\4b7f3a7c48.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013596001\\4b7f3a7c48.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\1e9bb0a28b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013597001\\1e9bb0a28b.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\d7fb74ccf3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013598001\\d7fb74ccf3.exe" skotes.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000500000001a48b-76.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 2852 skotes.exe 1744 4b7f3a7c48.exe 2056 1e9bb0a28b.exe 1532 41aa1a3660.exe 3188 625bcc1b39.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b7f3a7c48.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage d7fb74ccf3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625bcc1b39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d7fb74ccf3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e9bb0a28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language d7fb74ccf3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41aa1a3660.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Kills process with taskkill 5 IoCs
pid Process 940 taskkill.exe 1912 taskkill.exe 1160 taskkill.exe 2260 taskkill.exe 1036 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 2852 skotes.exe 1744 4b7f3a7c48.exe 2056 1e9bb0a28b.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1532 41aa1a3660.exe 1532 41aa1a3660.exe 1532 41aa1a3660.exe 1532 41aa1a3660.exe 3188 625bcc1b39.exe 3188 625bcc1b39.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1036 taskkill.exe Token: SeDebugPrivilege 940 taskkill.exe Token: SeDebugPrivilege 1912 taskkill.exe Token: SeDebugPrivilege 1160 taskkill.exe Token: SeDebugPrivilege 2260 taskkill.exe Token: SeDebugPrivilege 892 firefox.exe Token: SeDebugPrivilege 892 firefox.exe Token: SeDebugPrivilege 1532 41aa1a3660.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 892 firefox.exe 892 firefox.exe 892 firefox.exe 892 firefox.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 892 firefox.exe 892 firefox.exe 892 firefox.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe 1388 d7fb74ccf3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2852 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 30 PID 2568 wrote to memory of 2852 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 30 PID 2568 wrote to memory of 2852 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 30 PID 2568 wrote to memory of 2852 2568 b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe 30 PID 2852 wrote to memory of 1744 2852 skotes.exe 33 PID 2852 wrote to memory of 1744 2852 skotes.exe 33 PID 2852 wrote to memory of 1744 2852 skotes.exe 33 PID 2852 wrote to memory of 1744 2852 skotes.exe 33 PID 2852 wrote to memory of 2056 2852 skotes.exe 35 PID 2852 wrote to memory of 2056 2852 skotes.exe 35 PID 2852 wrote to memory of 2056 2852 skotes.exe 35 PID 2852 wrote to memory of 2056 2852 skotes.exe 35 PID 2852 wrote to memory of 1388 2852 skotes.exe 36 PID 2852 wrote to memory of 1388 2852 skotes.exe 36 PID 2852 wrote to memory of 1388 2852 skotes.exe 36 PID 2852 wrote to memory of 1388 2852 skotes.exe 36 PID 1388 wrote to memory of 1036 1388 d7fb74ccf3.exe 37 PID 1388 wrote to memory of 1036 1388 d7fb74ccf3.exe 37 PID 1388 wrote to memory of 1036 1388 d7fb74ccf3.exe 37 PID 1388 wrote to memory of 1036 1388 d7fb74ccf3.exe 37 PID 1388 wrote to memory of 940 1388 d7fb74ccf3.exe 39 PID 1388 wrote to memory of 940 1388 d7fb74ccf3.exe 39 PID 1388 wrote to memory of 940 1388 d7fb74ccf3.exe 39 PID 1388 wrote to memory of 940 1388 d7fb74ccf3.exe 39 PID 1388 wrote to memory of 1912 1388 d7fb74ccf3.exe 41 PID 1388 wrote to memory of 1912 1388 d7fb74ccf3.exe 41 PID 1388 wrote to memory of 1912 1388 d7fb74ccf3.exe 41 PID 1388 wrote to memory of 1912 1388 d7fb74ccf3.exe 41 PID 1388 wrote to memory of 1160 1388 d7fb74ccf3.exe 43 PID 1388 wrote to memory of 1160 1388 d7fb74ccf3.exe 43 PID 1388 wrote to memory of 1160 1388 d7fb74ccf3.exe 43 PID 1388 wrote to memory of 1160 1388 d7fb74ccf3.exe 43 PID 1388 wrote to memory of 2260 1388 d7fb74ccf3.exe 45 PID 1388 wrote to memory of 2260 1388 d7fb74ccf3.exe 45 PID 1388 wrote to memory of 2260 1388 d7fb74ccf3.exe 45 PID 1388 wrote to memory of 2260 1388 d7fb74ccf3.exe 45 PID 1388 wrote to memory of 1288 1388 d7fb74ccf3.exe 47 PID 1388 wrote to memory of 1288 1388 d7fb74ccf3.exe 47 PID 1388 wrote to memory of 1288 1388 d7fb74ccf3.exe 47 PID 1388 wrote to memory of 1288 1388 d7fb74ccf3.exe 47 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 1288 wrote to memory of 892 1288 firefox.exe 48 PID 892 wrote to memory of 2636 892 firefox.exe 49 PID 892 wrote to memory of 2636 892 firefox.exe 49 PID 892 wrote to memory of 2636 892 firefox.exe 49 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 PID 892 wrote to memory of 1936 892 firefox.exe 50 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe"C:\Users\Admin\AppData\Local\Temp\b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1013596001\4b7f3a7c48.exe"C:\Users\Admin\AppData\Local\Temp\1013596001\4b7f3a7c48.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\1013597001\1e9bb0a28b.exe"C:\Users\Admin\AppData\Local\Temp\1013597001\1e9bb0a28b.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\1013598001\d7fb74ccf3.exe"C:\Users\Admin\AppData\Local\Temp\1013598001\d7fb74ccf3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.0.1122566727\616523458" -parentBuildID 20221007134813 -prefsHandle 1268 -prefMapHandle 1260 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec80b2e5-8da2-4eca-bff4-857887093dfe} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1368 fdd5158 gpu6⤵PID:2636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.1.1525929124\856996976" -parentBuildID 20221007134813 -prefsHandle 1536 -prefMapHandle 1532 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4e9d393-d900-490d-b762-f0524d76b679} 892 "\\.\pipe\gecko-crash-server-pipe.892" 1548 41ed158 socket6⤵PID:1936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.2.1803356779\996919241" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84607ef2-04f3-42cc-99f7-b1dae11876c7} 892 "\\.\pipe\gecko-crash-server-pipe.892" 2092 19ca7c58 tab6⤵PID:1704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.3.556733014\25082666" -childID 2 -isForBrowser -prefsHandle 2816 -prefMapHandle 2812 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ada26fd-5517-4467-bfa5-d380d7aaabae} 892 "\\.\pipe\gecko-crash-server-pipe.892" 2832 d63658 tab6⤵PID:1140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.4.430945448\2123023908" -childID 3 -isForBrowser -prefsHandle 3728 -prefMapHandle 3724 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59806c7b-c256-4045-8d5e-dd623c92097a} 892 "\\.\pipe\gecko-crash-server-pipe.892" 3740 19c33058 tab6⤵PID:2688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.5.674008262\1795914333" -childID 4 -isForBrowser -prefsHandle 3848 -prefMapHandle 3852 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79d8aeac-08e0-4e3c-b53c-285984f97108} 892 "\\.\pipe\gecko-crash-server-pipe.892" 3836 207e1258 tab6⤵PID:1780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="892.6.752931283\1520592943" -childID 5 -isForBrowser -prefsHandle 4084 -prefMapHandle 4148 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 604 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5125afb7-d54b-4163-b91f-4c7aa84c0405} 892 "\\.\pipe\gecko-crash-server-pipe.892" 4136 207e3058 tab6⤵PID:2240
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013599001\41aa1a3660.exe"C:\Users\Admin\AppData\Local\Temp\1013599001\41aa1a3660.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\1013600001\625bcc1b39.exe"C:\Users\Admin\AppData\Local\Temp\1013600001\625bcc1b39.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\download[1].htm
Filesize1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp
Filesize31KB
MD565d0d323bde3a42db6613c44322ba635
SHA17e7478c6978997f2553a2656eb918e5b75e50065
SHA256886200a40ac0618e128cdb45d73ccd6a6bb41ce80d7c848cac750ce2e2164ea9
SHA5124c09153f2e2ca0ca28ddec0ad83e2e3a76c3acf224038b9bac185ed903dd33b4256afddde6f718e65e6ed9d956b80a9eb37a305847e1e98ece9525f6cce2a038
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
1.8MB
MD5430241ea54c659cd093cbf48a09f8324
SHA1b9c512490e4f96ad0851fae682719a51bd3088a6
SHA25688cf30a71ad167f40a9bf9b1cc7b8b68429c712bfda9afa3d495345394c3a76b
SHA5123dfde3ebab2d5f34d1d8a50b014dcb1ce15e3eb3eddfd7e3df5c4bc9ba533b510fd5e04f074d5bb68cf0608c91c1e8b223a4819c88a67f612c4eb0701055d739
-
Filesize
1.7MB
MD59083cdf00ff3295432676d6ee4c6c9f4
SHA12f83025aaf303478fb07cf9fd9630ca3874e6163
SHA25622a7b5fc61cf54485bd374a221386b1c2675f7eb4b1428677ff86b3add14238e
SHA512b1a3bd15d30dc60e6aa3bd027e39be463a7f026815f66b84a44bc93cb1b89e42211b5352b5cc44e2e46c7fa9f43f6d888c9678fa6cbe7679e2d8f1be35d8d942
-
Filesize
949KB
MD5b5811acb833a790513d5baab884cf1f7
SHA1a0b5690a5cbc8dfec6a0f6355ca3c4cc4890efc7
SHA25665378c55edffc59d371243cc8bb2f44def33e5f317993032189eb31b4ecf02bf
SHA5129668f726715d489acb1c57440ffa6c4bab4acb352c6f3f67115e2ec6b1e0b4d00ba4e41b062d596a872eea20e9f4702b2579c1a91c11e388fb9207b5f7c7db21
-
Filesize
2.7MB
MD554ac54d599adabb8aa9403177cdb635c
SHA1031afc5a647a7bd0379f277b819a35137a00fc79
SHA2567bd295999c86a6d00f670bee17c926ebddf85a7de84a93d9f944363bc3de96ee
SHA5120d92aa49fb0cbe67969604d8d1c09cc32d39c093d7f19a1d21cf0bd4a17cf6c8a80f28575c07995c573410e810625bdddd39e2e851aaea8b255c42dd3222d311
-
Filesize
1.9MB
MD5054b1e771a301c1e792397a683ed0a90
SHA1eb209469e0b66a485b135012cf43538ceb9dc96c
SHA2566b2391a7841833a3524f5034b7287e55f4c8fbec8678ecf7a6040ada9c07fde1
SHA51223317dcaf76cc1a9dc6c3dc5e551c88905163625617abc7aa389255dd17ee9ca330303521fabfb91c3a33bf1c2a650f2935a7a047eadf1814ea60e2ec387275e
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD5ec5c45f037fa5b7ab0bda5c5a1d78c2a
SHA1482e3addc5218e7560a5a2880aba9916eea01728
SHA2563707ad122a77e0873d745ea0dad44adeb592ca9325f5b19d16216468cff7ec68
SHA512266f6cf879c5815465f6c0341469c509b1c37eedc52962eebe290817b77c62a5805ccbf7c80335e891a5e1b23cc794949d4dadbe64fdf3d9531f812dbf60ad33
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\90e591a9-e08d-4282-98c5-c7466ea40f2c
Filesize733B
MD5d5fe7647815706a5f73291398a5ae7fb
SHA11f1cfae0aade5c4a552be3585e7d368718f0d824
SHA256ca1bf318199a822e25254ce140e6bf3cb5f51ac5c0d43970d0209e1803211074
SHA512e0b7ba7e43ea3636750ee6781b4fe2c3fcc9e73aa4f7d9430f7bfd7d3fb75f9a1cbca7348142df61eef3a14d64a18f381da25439b45ee28b3ff2ccde2d97bb8b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5cba0ca5627165162f61820c041dce855
SHA1d81fba8197f82653a4a53845c8ffceba74ca59b5
SHA25604cf32688ae604ba99330f87aadb95b43d08330f98a540a7730b7eb8af3ce6dc
SHA51252562ac1428b673f34218ea577fd0aa64c5f066cb2a625ace20daddb143435aa1909d570674e3b824bc968d99d44d75691172eb7707113a6a4f892f3fb8389aa
-
Filesize
7KB
MD579e72be9cae22eda67c4ade40d2fc150
SHA1a314e2a35f6f5bedd6b0a058105c79addff4ddb6
SHA256c955d64c2f3d74783f9fc459bcbc98f279909999c363ddc35a183fef6bdd6d7b
SHA51278ba1a8aceef6f07af3d04793f9842336936ff7669095efc099ace5d1b42e46fb754809c4367f3ae189f1560798625063127c4c926ff75476bcc1825f7ae7067
-
Filesize
7KB
MD5479ea10581b7d3e2bf1039698d82a629
SHA1ba67002f0db84fc98719e8a06d0c65c7915e4d65
SHA2568afd25221c3929ae3318673e22f1ebb0ae4e86a7bc7966cac3513c5aeabf6a40
SHA512219425289c54d37bf2371cb70d506a23baf95ffef9ecf4bca30a5bb3016a3a5fe1e8cfd1ce2bd5d610f73046b21d333e18575cb0795f072422e23ecba1792585
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5fded0d49c3d9758f87028c8c9aec0c5e
SHA186cc8b11024b09e10f6f919c264971a5977f767a
SHA2564565e4610dc1016eb7ada813b63698f7616911fa0690ceaa117aa2f406b19089
SHA5120a4029185cb3ea96e56797a9e4b04dbfff1b2a4c3d03cdb5e64455931990812c82b30bfd6a15da7624536839d44b6dedf040937a3c52e924154f416f7b84cf06
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD53dc733f51b6c47c0e57ae7035b9abacf
SHA1d4c28a6f9d4bae9e297440a46726a2cb3e2504ba
SHA256aafa700fb884f14becaf86a0eb9df79dfa15885b2ebe11cabe5f48a3a5d9e0e1
SHA512e02670f6fa626a21ad150e0e0e589ba9f1f7a1fb921dc28f4117dc0a30a337b9c9b165dd0a30da864fe4dbdf130372e846648792a0bcf5aad4e8d28118101067
-
Filesize
1.4MB
MD5a8cf5621811f7fac55cfe8cb3fa6b9f6
SHA1121356839e8138a03141f5f5856936a85bd2a474
SHA256614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c
SHA5124479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd
-
Filesize
3.1MB
MD59616371054857f390d2a2cefeb6fb9ea
SHA1e1b0ffc6f19b81ecd8552483986570a0acafe576
SHA256b0b56a92786831c7512288ff06c7691b61290eb97959dbe7fcab9daeda0cf442
SHA5121cefd75f8f84a5bdc2af9225f034a4cc9067287f674a64495f534f910d39ca45738a4736d650c5cb99824bce4ca9b3ff0371bc7f66651e525aa79e13103139a5