Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
239s -
max time network
377s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
21/12/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
b.zip
Resource
win10ltsc2021-20241211-en
General
-
Target
b.zip
-
Size
446KB
-
MD5
9cefa111452fd3674d0d7e3e24ea076b
-
SHA1
c185f75dd1285e35ff59b2003ef855382d6a850f
-
SHA256
1806b7cc24522509cab563bea8d1dc6c9c992c9d5c575836de3f363a7b10a8cc
-
SHA512
b01413da6c974821b1365a264650f5daf6a6bddbf311df33c20b60fb654e6a33a070587edaa3e3f89d63ffaa14aa4ddb4b6c05ff8d2966df6561f7e4fef685ea
-
SSDEEP
12288:soutuJQIn872o78fwwHqo5C8nDDCLu/ou7I0ngv0q:shsJQo87QfUo5CkDOLr8bBq
Malware Config
Extracted
C:\Program Files (x86)\instructions_read_me.txt
blackbasta
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Renames multiple (210) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
Loads dropped DLL 5 IoCs
pid Process 4904 rundll32.exe 4688 rundll32.exe 1980 rundll32.exe 4368 rundll32.exe 1052 rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\omni.ja rundll32.exe File created C:\Program Files\Windows NT\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt rundll32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\7z.sfx rundll32.exe File opened for modification C:\Program Files\Internet Explorer\IEShims.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete rundll32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\sqmapi.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt rundll32.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui rundll32.exe File created C:\Program Files\Internet Explorer\it-IT\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\UpdateEnter.xlsm rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT rundll32.exe File opened for modification C:\Program Files\7-Zip\7z.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\nssckbi.dll rundll32.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt rundll32.exe File opened for modification C:\Program Files\Common Files\System\wab32.dll rundll32.exe File opened for modification C:\Program Files\UndoSave.wmv rundll32.exe File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml rundll32.exe File opened for modification C:\Program Files\Windows Defender\AMMonitoringProvider.dll rundll32.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.dll rundll32.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe rundll32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt rundll32.exe File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag rundll32.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll rundll32.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe rundll32.exe File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag rundll32.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui rundll32.exe File created C:\Program Files\Microsoft Office 15\instructions_read_me.txt rundll32.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html rundll32.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll rundll32.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe rundll32.exe File opened for modification C:\Program Files\Windows Media Player\mpvis.DLL rundll32.exe File created C:\Program Files\Common Files\DESIGNER\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\SkipProtect.temp rundll32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpAsDesc.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt rundll32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt rundll32.exe File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag rundll32.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt rundll32.exe File opened for modification C:\Program Files\ResetJoin.txt rundll32.exe File opened for modification C:\Program Files\DisconnectLimit.wav rundll32.exe File opened for modification C:\Program Files\InstallWait.html rundll32.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt rundll32.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui rundll32.exe File opened for modification C:\Program Files\DenyTest.3g2 rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe rundll32.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58\DefaultIcon rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7wdojib58\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5132 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4260 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 4260 7zFM.exe Token: 35 4260 7zFM.exe Token: SeSecurityPrivilege 4260 7zFM.exe Token: SeDebugPrivilege 4888 firefox.exe Token: SeDebugPrivilege 4888 firefox.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 4260 7zFM.exe 4260 7zFM.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe 4888 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 4904 1996 cmd.exe 97 PID 1996 wrote to memory of 4904 1996 cmd.exe 97 PID 1996 wrote to memory of 4688 1996 cmd.exe 98 PID 1996 wrote to memory of 4688 1996 cmd.exe 98 PID 1996 wrote to memory of 1980 1996 cmd.exe 99 PID 1996 wrote to memory of 1980 1996 cmd.exe 99 PID 1996 wrote to memory of 4368 1996 cmd.exe 100 PID 1996 wrote to memory of 4368 1996 cmd.exe 100 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 1596 wrote to memory of 4888 1596 firefox.exe 103 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 PID 4888 wrote to memory of 1040 4888 firefox.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\b.zip"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4260
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2808
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\rundll32.exerundll32 basta.dll,312⤵
- Loads dropped DLL
PID:4904
-
-
C:\Windows\system32\rundll32.exerundll32 basta.dll,entry2⤵
- Loads dropped DLL
PID:4688
-
-
C:\Windows\system32\rundll32.exerundll32 basta.dll,entry2⤵
- Loads dropped DLL
PID:1980
-
-
C:\Windows\system32\rundll32.exerundll32 basta.dll,main2⤵
- Loads dropped DLL
PID:4368
-
-
C:\Windows\system32\rundll32.exerundll32 basta.dll,#12⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:1052
-
-
C:\Windows\system32\rundll32.exerundll32 basta.dll,#22⤵PID:3196
-
-
C:\Windows\system32\rundll32.exerundll32 basta.dll,#32⤵PID:6128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1948 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad850851-9de6-4e26-bd25-af0ae2d6989b} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" gpu3⤵PID:1040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bf26cc4-8e18-44a5-82c8-a89813f36af8} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" socket3⤵PID:1400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 3160 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbce8c75-085a-4587-a4f5-c79bb915fe40} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:4788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3692 -childID 2 -isForBrowser -prefsHandle 3684 -prefMapHandle 3668 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0661a20c-4041-4909-878e-c6f7346133a7} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:3220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4512 -prefMapHandle 4508 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dde1eb10-e440-4ec9-95b2-45cc3df11de9} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" utility3⤵
- Checks processor information in registry
PID:1144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5340 -prefMapHandle 3672 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0aa74d-1c63-4488-86bc-993b0800f6dd} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5496 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1b0b64d-9c03-4487-aa0b-f7ab849f7181} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:2172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5760 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f435a70-2575-4520-9362-7dd31bacea8e} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:4284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 6 -isForBrowser -prefsHandle 6260 -prefMapHandle 6276 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33d26fda-6274-4da9-aa11-95a3686d529d} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:3976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 7 -isForBrowser -prefsHandle 6232 -prefMapHandle 4724 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {039d4bd8-b2e8-4326-9547-5f461b2450bd} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:4376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6724 -childID 8 -isForBrowser -prefsHandle 3900 -prefMapHandle 6668 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1124 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29eb74f7-0cdb-4353-80ed-9ed21effd388} 4888 "\\.\pipe\gecko-crash-server-pipe.4888" tab3⤵PID:1840
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\instructions_read_me.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54ba06d41a13bc5f4ddc71cf6a48cf231
SHA1d83c4640b36339549130fcb008c6f5c8a6d67676
SHA2568e29eb9f02be51cbdc99f8ec9b90fb29f47806f9ca804590de548d5e06f47db5
SHA5129fe3e0546ece1c74b2b3f188fafb024309bb1048ce997c334a6fed9b9638f11aa0dc99784546241fc28893b207a239ed21f8189a51bd801bc65334bd082da88c
-
Filesize
655KB
MD5470443e44566ecfc7ac2ddbec240a73f
SHA127bb8d2fc02cd2bbc184d07357aaa9903d88b425
SHA256006652da0745d8672ec56598368c1f8a4896cd4a0aa5b61499d574870f94b705
SHA51222c9bc36874abb015a7e1a28e26f186f2abbd559aad53fdcf493f2178dbc6cfe5a7324d0acadcf4a641028e61787d2f4237a8c034a3a7a6d0a7162f31e05a618
-
Filesize
967KB
MD582958c604717fc0a15052e03a927cfa4
SHA1829a7eb23147c31d9746ddaa30201b7127515416
SHA256948818942a29cf21260ba389c2fdf3c001d77851500a7124c1f6a3290b8f826c
SHA51270e5118dd760e7dc86f3641da57dad00f02b703e53230bc13e0e9e21fddcba75d3e70445d90d9f13988956e4ba20e7b54ebbdaaed18c3e7aa75a4214c2e2aff9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg4xad17.default-release\activity-stream.discovery_stream.json
Filesize18KB
MD5e6391306c8678cf9d91c8868a51b0fa3
SHA13c914d26bf26ddebedc36baa5261731a78aa6189
SHA256635795decdb5b7857b024eaae4efcaee3285eb4acedad94af9c72467e3a9023d
SHA51223ccfb3cb58ba6a7969e4296ec80644f121eebb03b8ca59d5073c6f5458cfc31450a4450f04ea9daa49048cd8135125601344765a02825bdfdfc239cba163f1b
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\AlternateServices.bin
Filesize7KB
MD5d5cf8ff54d7b6b14f96de558b15bdb75
SHA1051ec0be2dad04926880e137984370690a98c0d3
SHA25670cd6beaa10539f8dc9841f6827d95fff2b82e4dcc4a4300bfc075c2fb3c72ec
SHA512a259ba884bb1eea66566192bc672a691a6d2cea5c6f34e82b8e48e3f029885a3759d456de413c03e48d43b06c325d0e32512f21535a0dcade1aeea0e13700c20
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\AlternateServices.bin
Filesize12KB
MD58fac9b89aa03271a2d3c13753a921041
SHA18c924fa53a6db97b564b1db256d3e7e60e82ab4e
SHA256c531dc3d659338e41ead4f7d5dbcc26e837ab578fa5f1d07430e9b841c7720af
SHA5128d6350de22b812455d44a8dc9a7c9c962686d89887fbe7149509f1d6405c2c6df0bc6a548421d7bfef82f1858d84f4d818bac1096ff057101ba3347b7de0ead7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5aef97928bc23cc3ac99f8cbb65a1ba16
SHA1dd1998c62f9530c67136802ce5707b08dd1602ca
SHA2560c359a136adc0382515eaf85f077d7c980784fe89860c2f551383858b6f731b0
SHA512652a43b5b1dbe72b55c70ccbe98dd975437073718f3840e8af87d5eb4224be9e12b22c503ddc0007fe5315162059290e9e937350fdf70b6ab82031fc9142be5c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp
Filesize16KB
MD5a554473a9ba8db7665167d9b77bdbcb7
SHA195d735753cb61eca3c143e4f73883d09fa817dbe
SHA25685df651bc25afd26405292a3097f630e10c216068406dc0e6827232c44281b3b
SHA512f661041318adb90e0622f0f6aba767ca06887d014bbba1854a509d12ad99ed0a363dc7e7bed6206c62ba6fd6216f54010e5c14559f5d5053379ff8c6c11c6e52
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\4db13cd2-325b-4114-bd9b-d8fa007dba10
Filesize982B
MD50cdbddfbdb9080c1d56ff88bb001f332
SHA119fb2d5ff080485080c3a8e80080939a33f5d934
SHA256855387d01873228d1f3e3d99a23d27dafd402ea9369b597a8a9ffcc510a6eab3
SHA51213785ba4b37ed4509deb69915fdba09f0eb287a107c8d54e8bff2f9718d8464f23169372db6ebbddb17f5fde96e06ba5b04664d5e6d2e1af949742b35fc41c1b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\86e22a91-e902-4e79-9f4e-39c30660a42e
Filesize671B
MD5b685e1694d5d8911025a7120a83f30fb
SHA121ca360fe9e476721b0be29c9c1e081109723123
SHA2569df6c4d855e161f0658b26526f66128b204affdf7a621555bf352fab949cbd15
SHA5122b6e0d6b6966d248d8b53e3fa543851f284a3d1ae05cafad9f32ff3d7105dbd77838e284083a8965adbaf4a0a63065f1ea21b328874f0ee3281ec0e9acb7bf02
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\a8ca14c3-df33-4675-b26e-2e7a38634c3b
Filesize25KB
MD52e4cb755e405e5677c1b3f0ca6c1dc3a
SHA1f62599a1fd6f3fe2f785bb89367716aa3c6b5f84
SHA256b23c9d6e032d5a760b27a15d44c2e7e649440873e21d060ea83d1074d997e3ec
SHA512b4336a042dc8ce411667afa43f83164f8e94f206a360565a610cba852994d59c53d1803a0c93f79b18070d46c5388360f39193036e13f013ffadaf33e74e7e7a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD5d0fe3aecb848a6fef69470c7081d668e
SHA10e75d3403f9be5386961fa94a25418a3c9655f93
SHA2569c05c30917dd998904e1c711eac45cf4813dda6104b7d7caef638ba7a61f2d84
SHA51291810e9f07a999c43b48a427e4a8130cd11e13e896926f2877fc98d52c6bec8e702df1983435dfd098900ba5d3fce39e0001c0e682fa3e7dea63da3d95be6e25
-
Filesize
11KB
MD538018b64385d0c1ef65c7923cc64282b
SHA1c9bd9aa9a81159a5ac7b65e22ff8c4f7447c8310
SHA25661cc39de97dec39039658a3e2c74b5ad774459b0b950add312100cbe7faf0bdd
SHA512cf4346ca43ea6906bc47a5a26985a6fa31454cbc9a7884cd7ecc6fa83284de6df9df0f1ad888d1c4e6d19e9b16ab532f909e4f66f310aed5b86a350a64628dcc
-
Filesize
10KB
MD5c2859826b80f6f8d76311960f9551a8c
SHA1d1fc3650fa5fcbe902333db7a1e904fba0b96f0a
SHA2561952d60da9f37222bfc332e451f158aaf054efde13f42c649fa5bccc79009417
SHA512da87004346a155c8388c720914518276b403df4c6cbd84bc47b68d3d006de3a1cc6bd9fb2a723cea826d9e83a1e0cf4312a3c0453e5e58c8919708205861956e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize1KB
MD5bb8b8b4d30c87ccda10f7c43232cd353
SHA1f74c44c84e7018c424802d6951e225f4957e70e4
SHA2567ac1fce19d2a3f031200e9d9502020153663954ad5e65ed92a560ac2797b6e5c
SHA51206bcdc6298bbc9a121c86137acc0f4442874793ef4cf45a3fefe9b2f8311be698f3f40d4755a7afa6e869ee73ad3219016d780621aaa09aa16510f516e7dfd87
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize6KB
MD52215fa4a1153806c209f3a430a85a0ef
SHA11835e60473166a78fa9073018fe9f717eed9f8bd
SHA256450a91b87f992b9b19408406a9c041a1dd3cb13ecdaddef81ee534515a9b87bd
SHA512d5846ec14c1eab9a724ba45d25e7ba3268ded8c70a3481391cd3db62a503dfdf3ee54697bdbe2d641596892021161258a60d11538837f2bf1be5e585a194a85d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize8KB
MD58959e8d3eb5b85f04ffd1750342faf15
SHA191f310cdc163f7fe4cffa73f3509ec001e2a39bb
SHA2568b469bea81bcfa98a90806ed4a8d3fe89c4bda74f18537f79fb637a3f3bf54fc
SHA5126ffe638331ca1f91881347374bc9a852855ed8d221299a7079ba289d5b28a885601117c02dd2831ab58ab424556ce82f9daa38eda58d0a72e74b68f3f84e6c58
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize5KB
MD5f7239801953111cb6341bf1c1a31c4fe
SHA115a252ef6d8cb5e853158dd174bbe6fd60fc8aec
SHA256511274f4a955f90359ab51c0751b6f78c44907b7584f279462d967d03c666732
SHA512557913c8525e1888c1a07e13cf21185631ad6b2715c238a7dd769300829e5116ccbdb5e62c0133f490dc87da93ceea24a88d3f1ab90d993fc9612fd035830733
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD53bbc3876b7ac1337be0e633c0c3e716c
SHA1330b2e05733690f8f0c55937545feedcbcbfc3b3
SHA2569720d276e71970a0df8a3c26e093d5ede6bf6e5ad279e2171feddfa859b5c605
SHA512fa25d05b50ac383274dcf48922e8d79431a870a8f19bff28679437e84b8a151e3cf0967931e4ecb1e1a8d040309bdebd080a0d0f8d75fdacc08091fcd29ab227
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize8KB
MD52da7cb0d3690ddd216284c55d0f54b37
SHA16ef895c3ee38f7b5723348b6d5ba6884987bb8df
SHA2567fcf5294dffa34ebf8a91f9cd8d13eb4c1ee3aa94725f78aa1e5a2704b1fe4c2
SHA512070ec7e80e436971e107691f820c20ef3884a95b03fe0bf62fc1c44250e3a50d307dfd1a7abb2fdc1367bafbdbdac0d8b87fb9767a83ff7f5e85f4082638e274
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4
Filesize4KB
MD57f1be722f324b243fb8293962ed6df08
SHA1ac262f4ad9a4717c2e4584db3e458b50bf4540d9
SHA25620359646cd0ee84a4276b0906e60f17211f2bbab1a93c1ba9cfa51db25534a69
SHA512655ac93a07773c4f4efe63da1cc8aaac7f69d83e3b9971e2504be7c9d9ee14d9c7eb3c5c1b7348eaa6cfc7392c81362783e0e5999369929080eb67730b35866f
-
Filesize
1023KB
MD508378cd36fdbf69dba24d14393ad564d
SHA1c698e08ff114499e9fecf39fcbf23f652f1cdad8
SHA256764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786
SHA512ef831fc12ad4831e180c9e5e9babbf1a2d8675a918992fc6f5306447b30e12de63e5034124e31a2d9517db4322e7aaf4a01cecf3239f2c6f6d459358849ef197
-
Filesize
97KB
MD5e47bd5a40495d4d754e2204dd76eb059
SHA14b14d26ef936233bfe7fca3b779c450273f04e45
SHA2563b36211aadd352af6af3da8f1ee4ad32ab84023b5b1e7a756f0d385c71efa5b8
SHA5129f5c47a462ed7508de6a0dc6a78212d7a83a93a00fec53265282bcb4cb38823b19c000c0cdeed3ca236e683cee318f5d7126ac9d2cfd9ba168e02ec2756a0dc5