amadey | 5ff744962f24ff19c76f45bf704b1a3b31c73269989565c888dc74ad04a61dbe

Virtualization/Sandbox Evasion

Processes:

explorti.exe585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exe585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

Executes dropped EXE 6 IoCs

Processes:

explorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exe

pid process

1860 explorti.exe
2076 explorti.exe
2996 explorti.exe
4500 explorti.exe
4252 explorti.exe
2036 explorti.exe

pid	process
1860	explorti.exe
2076	explorti.exe
2996	explorti.exe
4500	explorti.exe
4252	explorti.exe
2036	explorti.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

explorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exe585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exe

pid process

4564 585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
1860 explorti.exe
2076 explorti.exe
2996 explorti.exe
4500 explorti.exe
4252 explorti.exe
2036 explorti.exe
Drops file in Windows directory 1 IoCs

Processes:

585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

description ioc process

File created C:\Windows\Tasks\explorti.job 585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explorti.job	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exeexplorti.exe

pid	process
4564	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
4564	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
1860	explorti.exe
1860	explorti.exe
2076	explorti.exe
2076	explorti.exe
2996	explorti.exe
2996	explorti.exe
4500	explorti.exe
4500	explorti.exe
4252	explorti.exe
4252	explorti.exe
2036	explorti.exe
2036	explorti.exe

Suspicious behavior: LoadsDriver 14 IoCs

Processes:

pid

4
4
4
4
4
656
4
4
4
4
4
4
4
4
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 3364 firefox.exe
Token: SeDebugPrivilege 3364 firefox.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

3364 firefox.exe
3364 firefox.exe
3364 firefox.exe
3364 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3364 firefox.exe
3364 firefox.exe
3364 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

3364 firefox.exe

pid
4
4
4
4
4
656
4
4
4
4
4
4
4
4

description	pid	process
Token: SeDebugPrivilege	3364	firefox.exe
Token: SeDebugPrivilege	3364	firefox.exe

pid	process
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe

pid	process
3364	firefox.exe
3364	firefox.exe
3364	firefox.exe

pid	process
3364	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4564 wrote to memory of 1860	4564	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe	explorti.exe
PID 4564 wrote to memory of 1860	4564	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe	explorti.exe
PID 4564 wrote to memory of 1860	4564	585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe	explorti.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 2252 wrote to memory of 3364	2252	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 940	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe
PID 3364 wrote to memory of 5008	3364	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe
"C:\Users\Admin\AppData\Local\Temp\585dad4590d9a7722a93434b59d8c37a5d21ff9deb0d5fff0b242d8b8268db98.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1860

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2996

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.0.260948173\1979891318" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfcc10b9-9037-48c2-93fe-f59d5891c274} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 1680 23029d10c58 gpu
3⤵
PID:940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.1.1170796260\1388674210" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {885b5649-2667-4436-82bf-5300146087e9} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 2416 23015b8a258 socket
3⤵
- Checks processor information in registry
PID:5008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.2.85485476\1449938347" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {755904f7-c9d8-4080-be42-b018040a5614} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 2996 2302c7df858 tab
3⤵
PID:2408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.3.1173037990\1054850465" -childID 2 -isForBrowser -prefsHandle 4224 -prefMapHandle 2748 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d6b8b31-ca2a-4d12-b640-5611088c6a36} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 4236 2302cf2f058 tab
3⤵
PID:3152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.4.1188718637\264586918" -childID 3 -isForBrowser -prefsHandle 5060 -prefMapHandle 5056 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee2c066-7994-4995-8ce1-9958f2faa4aa} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 5004 23030b4da58 tab
3⤵
PID:2184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.5.1010350377\225415804" -childID 4 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {403d639a-3790-498f-9352-b533e6a57c51} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 5204 23030b4e058 tab
3⤵
PID:4624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.6.1369747729\699943154" -childID 5 -isForBrowser -prefsHandle 5408 -prefMapHandle 5412 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {552541f2-7eca-4b12-838d-90b6d2fb5795} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 5396 23030bf9758 tab
3⤵
PID:3944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3364.7.1173630689\834058976" -childID 6 -isForBrowser -prefsHandle 5876 -prefMapHandle 5872 -prefsLen 28172 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17a3f4ad-0e14-4a7d-9ab5-f850e5f90fdd} 3364 "\\.\pipe\gecko-crash-server-pipe.3364" 5884 23030bf9458 tab
3⤵
PID:2432

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4252

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery