Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2025, 15:46

General

  • Target

    https://steamtickets100.com/s/KQRA

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM. 1 IoCs
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://steamtickets100.com/s/KQRA"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://steamtickets100.com/s/KQRA
      2⤵
      • Detected potential entity reuse from brand STEAM.
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99a969b5-f30e-4d8f-a90d-6ed1a49b37e9} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" gpu
        3⤵
          PID:4984
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e0c859f-8102-4fd7-9cdc-965b948c5bc3} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" socket
          3⤵
            PID:3792
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2956 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bd12435-1864-4637-b328-3bc4ea907e2e} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
            3⤵
              PID:3960
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4048 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4008 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ba24d1a-eb67-4c45-86c8-5d4e1c07aa29} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
              3⤵
                PID:4744
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4664 -prefMapHandle 4736 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3fee766-85ae-4c73-9082-3e36ba86587f} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" utility
                3⤵
                • Checks processor information in registry
                PID:4728
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2ad5fd9-e05f-44a4-b8eb-7c5b9dc5af65} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
                3⤵
                  PID:2684
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4668 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5500 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {387f6485-79fd-407d-b4b6-7aa8286493bf} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
                  3⤵
                    PID:4792
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5636 -prefMapHandle 5736 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0f19e19-df33-4a5c-beaa-011e986d8d7c} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
                    3⤵
                      PID:4292
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6012 -childID 6 -isForBrowser -prefsHandle 5932 -prefMapHandle 5940 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81d1810-f4b5-468c-aac4-481406295dc6} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
                      3⤵
                        PID:4768

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json

                    Filesize

                    21KB

                    MD5

                    5ecf1edf5c6d1f8d0403b9a08a5e16ed

                    SHA1

                    3180d33b152405dbf9a34dff0d6b96ac35751077

                    SHA256

                    b76c21c3ad9405344a053090976e032ecaf71b82b637a88da89190e3e73df1bb

                    SHA512

                    dc3304d12c016aed8745e68779121de8f55be9d75a5eeb7d67d1987d7b3ef2b053afda9cec54b539d6f64064fddc14d5e1b56ea14d41ee123a73d1277452c965

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\86254BE5C4605A6368B6E91A664F0C6BB10599B0

                    Filesize

                    118KB

                    MD5

                    d715210fbf89b33ff01758297b95d3e5

                    SHA1

                    4fe011adbba412b5771ea80ccd1ee6bd873743b5

                    SHA256

                    e50e65a5eef9dfc06e31f9c814f98ee563671936c2f65c81601d85570235589e

                    SHA512

                    f47609c68f0282b0dc50e732c3f63287b39b0c336910ee732042676f591403ebf118924c76e983589ba0ec790880bd8ace4671d0c7327b8bce537499170fe3ef

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\BDBFAF694C30FC9FD0B5D03F0456B4CA5FF7B159

                    Filesize

                    34KB

                    MD5

                    01ee11616d231adcaa47482515ce4a9c

                    SHA1

                    cca5dbe9897d061954ef0abc2db0ffadcf0cbf6b

                    SHA256

                    a16c1d79dda071aee6bbd757584108ecf93d1ff4110239fc66c8a9e1309812e8

                    SHA512

                    cdab8b5dfaaf7e17ba96bad3b6d67e56cac000bdb451281db5655dee0d6b478da583324c4b32fbf42544c5f2de599fb4a9d719d2680a06a647fa5eb7b8158077

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

                    Filesize

                    13KB

                    MD5

                    68d058d97aea80c6d09426bf8dcc7f00

                    SHA1

                    d86826c27c842f5045aa7b113b457598631357f7

                    SHA256

                    6884c6e19cf9f20a99b0200b1944b2fb5d3f2cbae62ddd0c1e2e5a7f458c25f1

                    SHA512

                    abe252dbf0beaa7ec92b599812b2cb7aeed745e7c8aaa95d18f9b69292078a249c9b65d9e37b0bf0660dc046c29dd9acfe7a04cd52d5bc7b3c4e7aa41ff3d9d4

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                    Filesize

                    15KB

                    MD5

                    96c542dec016d9ec1ecc4dddfcbaac66

                    SHA1

                    6199f7648bb744efa58acf7b96fee85d938389e4

                    SHA256

                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                    SHA512

                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    17389126997c36641fbd183050f1cf44

                    SHA1

                    e613e747bb4486242a28aceb28a3b0514f131295

                    SHA256

                    0551955b7a78860389459975754c0507700c1edacc2209e93a8ea4c226831335

                    SHA512

                    c494e4e94132b9cec3e005ac52ec6f16d61738807fd82f7e5ec1c356ec9481db9f3f90a16787a9f682580774980b6cb1af7712206063cad5775ce71b48cf6d53

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

                    Filesize

                    8KB

                    MD5

                    b4d15a604f111c41801c77ea6434c47b

                    SHA1

                    6a7eeded41d35d855e8133715344a30e66f06a23

                    SHA256

                    9f9cfe28dcea173e29000bbb4686bb86b5db9f2504c99b6e20ce32937566ccb5

                    SHA512

                    1f029c403791f2454057d9ed8a003b3031a65838a6132323743c6ebd66009b3aa19b5d873a7d2b0ec4563bbd4e7fc62bcd008431d5753ef5e2ad7ba1396abd35

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    ae770ad509a60394139d1f937cc83abd

                    SHA1

                    86c610646f55c20a8d9145de4000cd2d511c84f1

                    SHA256

                    45959ad9c379eedb77c5af6eb63f28cb1b44c09d0cd3516e1adf1f90eec94e03

                    SHA512

                    fc38f149c597c7866ccb026300ea04b58f7aca4e3d31774809d148c899283d2c886bbede2960b516a2c41016c5e834811042efa91668db04a7ca822452ad8c89

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    15KB

                    MD5

                    4edccc399b1323aa381ed31ccbb25930

                    SHA1

                    e6786681d1ac0aa4e43c0ddd2b6d5cb8e8f6f177

                    SHA256

                    654fa0f6df30fe9112e93438e4681407abf340f38a36afcdd3bc5308df9e5d33

                    SHA512

                    f22e7aff06cc82cf9fdb860d58f8b99ff35d298c133dcdfc637d990878bf766535423ad311c490dc660c98285508339d0b905fc5975b2dad3aa5b2a4009c0a9a

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\58c6f5bd-07b9-4eb3-b717-90da5aba689a

                    Filesize

                    982B

                    MD5

                    fe2c9a1c061c94f5574a61b947bf722d

                    SHA1

                    9fe7094a0e4efbbea6a1281b82eebc516b538e57

                    SHA256

                    b0b4bb9d633a69f51bc26472aab98634f9c0ce1e2d7261017f2f9ab823ed8e25

                    SHA512

                    2e6082a5911681bfa80bf9345ee8f46f81ea9f117cc92442700b45f3d890aa2f2229b40badbad41c2b8614e58bcdc5c0919d99113b828a4945da7bb5018ddc35

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\90706441-c2e8-4e87-b4f3-ef0795fd5d26

                    Filesize

                    26KB

                    MD5

                    39c9446a07be36589f5a91effb1ecc5e

                    SHA1

                    416952d75ed02363fb3440cf5fbe4f4701192ebb

                    SHA256

                    994b8961faa6901517873d35ef617d55dec97985465c55e658728d187f137dff

                    SHA512

                    7803dbd5fcd8f7aa67602aecd7487c699beabcf8f083604d53ec36d8c1fe6607d9b23377ce300e7e53b9328056c8f621cb77b17f50c05141110651d9e4b9cc1b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\d55b3037-1830-4d65-86b3-788b4802fd09

                    Filesize

                    671B

                    MD5

                    324a28c4f2c0169d21b7e559b52d383e

                    SHA1

                    31d6d08d4a0f22739c61dc4a38d6df32e377f162

                    SHA256

                    91a987344004602474e3f606dcb4f9340160ec7d17a779f3b123629b128d1fcb

                    SHA512

                    dbbe1fa2f7f211ed3854842c785998dea35be5c13ec99a9611b821b47142a715ec46fb0f35dc02020999422a3d150556c3765bb0649d01fdcea21540ebc70e68

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

                    Filesize

                    10KB

                    MD5

                    bb8ea65dd410eb00bac1531bf318d1e4

                    SHA1

                    aa11b1337c1bcb25334afc36e957002dff96fbe9

                    SHA256

                    68f58898cc960f8327ade850183075fcc372cbed3891a15c1e832e95ce955aa3

                    SHA512

                    264c95370d16a40539f062e2950b9eec6636ab770657534b4c20a602b9127ba9b7ded46b46c292587626405128c815edffa1c9d64f4ad9135e4e97f0ef9b9c34

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

                    Filesize

                    14KB

                    MD5

                    e9baf37985503e2f23fa1b1e3ad27f52

                    SHA1

                    0d4e3b5a2052002c9ca84cba4797d7095ab65eb1

                    SHA256

                    09435d06b232506bf504dab69144fa25e3c5dede943cb06ee8b2e069915be164

                    SHA512

                    8ac936068cc704ffa67af97b230bd59f577f7f11aa253f0f36d98617bcc23e2efa8d08c8e63cac19370edf015966de0322baa507a543b4428401f0adb3b94a91

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

                    Filesize

                    11KB

                    MD5

                    40c2357278d1e4613532b2da21a84704

                    SHA1

                    177a9aa6bf3e213be223936e52474363ebaec196

                    SHA256

                    b54e80b4b75eb012daaa292e565eb2ca2f8d517a27b73d85f9bc1331ec8ca8c4

                    SHA512

                    e0f132f49849f1e1fc61da772fa824b8e27a166e702d3ea3ac451fe26ba7c456a516d0718d5d4a70cab7632982be8022ccb5b28e6737a37a8e22d6b7732c2c6c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    40KB

                    MD5

                    c9a52752f1f138088fd6228c8e3be266

                    SHA1

                    a626a088189d76f08487beb1d8215f258d4b095c

                    SHA256

                    408a9dc6ac96bc5a769c26437227f189f1f70f9f1e03845a1dad897fd319cbde

                    SHA512

                    c105e454c97b2aa5292fa932c991b31421ef5b7a2b2923517e672f3a6a5f6c4e1d00b26aae81d8e723104aa6eb98ec92364e3257bc0c048a9ffc5f4ad207f55b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\default\https+++stor-steampowered.com\ls\usage

                    Filesize

                    12B

                    MD5

                    cdd578b59a5e7d64e1d6bf0b98b3e81d

                    SHA1

                    280b1d7aae0947a448c68e6ec22d9b68a0a005c0

                    SHA256

                    043cc32ecdbb208c7481c554e8165c85d89eb1385f5541929dadd5ef6bcc3486

                    SHA512

                    b6f04959ec6eff93b6adc9b610aed13926d0e2c767bf335c2e3da2ab5bb6901ce1bfe7be3ca619c6a8f86e4b301cc9b39511ab959d0b388d38dd87bbe066327b