Summary | ZeroBOX

osupdater.exe

Generic Malware Malicious Library UPX Malicious Packer Code injection HTTP Escalate priviledges Http API Internet API persistence GIF Format PE64 Lnk Format PE File OS Processor Check AntiVM AntiDebug
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 28, 2024, 11:07 a.m. Oct. 28, 2024, 11:15 a.m.
Size 266.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 b611b18150ff90f659198e46c7f2b74f
SHA256 0fbad12595c3ecd37ed2249d25161c3935485a2c761c104e58973841becd0517
CRC32 2348E0A3
ssdeep 6144:ty72/oopck5kxnvEL3T0Lq5TmSqMLMHgo2TWnF+v:tyQoomYEg9qrHgo2anAv
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RtlPcToFileHeader+0x9b RtlCreateTimer-0x55 ntdll+0xce6b @ 0x76d3ce6b
GlobalAlloc+0xbc GlobalFree-0x34 kernelbase+0xbc7c @ 0x7fefd4fbc7c
GetModuleHandleExA+0x4d FreeResource-0x413 kernelbase+0x1b80d @ 0x7fefd50b80d
WSPStartup+0xbf inet_network-0xd361 mswsock+0x921f @ 0x7fefc9c921f
WahOpenApcHelper+0x20a send-0x236 ws2_32+0x7dca @ 0x7fefd697dca
__WSAFDIsSet+0xe02 WahCreateHandleContextTable-0xa2e ws2_32+0x5d22 @ 0x7fefd695d22
WSASendTo+0x1db WEP-0x75c5 ws2_32+0xef2b @ 0x7fefd69ef2b
WSAAddressToStringW+0x9d getnameinfo-0x73 ws2_32+0xe73d @ 0x7fefd69e73d
GetNameInfoW+0xdb accept-0x55 ws2_32+0xe9ab @ 0x7fefd69e9ab
getnameinfo+0xa2 GetNameInfoW-0x7e ws2_32+0xe852 @ 0x7fefd69e852
InternetOpenA+0xb24 IsHostInProxyBypassList-0x2524 wininet+0x1aac0 @ 0x76acaac0
InternetOpenA+0x23df IsHostInProxyBypassList-0xc69 wininet+0x1c37b @ 0x76acc37b
InternetOpenA+0x2171 IsHostInProxyBypassList-0xed7 wininet+0x1c10d @ 0x76acc10d
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetOpenA+0x210b IsHostInProxyBypassList-0xf3d wininet+0x1c0a7 @ 0x76acc0a7
InternetOpenA+0x1fdd IsHostInProxyBypassList-0x106b wininet+0x1bf79 @ 0x76acbf79
InternetOpenA+0x163c IsHostInProxyBypassList-0x1a0c wininet+0x1b5d8 @ 0x76acb5d8
InternetOpenA+0xba1 IsHostInProxyBypassList-0x24a7 wininet+0x1ab3d @ 0x76acab3d
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetOpenA+0x1161 IsHostInProxyBypassList-0x1ee7 wininet+0x1b0fd @ 0x76acb0fd
InternetOpenA+0x1bba IsHostInProxyBypassList-0x148e wininet+0x1bb56 @ 0x76acbb56
InternetInitializeAutoProxyDll+0x3ae1 InternetOpenA-0x83fb wininet+0x11ba1 @ 0x76ac1ba1
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetInitializeAutoProxyDll+0x4a7b InternetOpenA-0x7461 wininet+0x12b3b @ 0x76ac2b3b
InternetInitializeAutoProxyDll+0x4632 InternetOpenA-0x78aa wininet+0x126f2 @ 0x76ac26f2
InternetInitializeAutoProxyDll+0x458d InternetOpenA-0x794f wininet+0x1264d @ 0x76ac264d
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetInitializeAutoProxyDll+0x3458 InternetOpenA-0x8a84 wininet+0x11518 @ 0x76ac1518
InternetInitializeAutoProxyDll+0x3321 InternetOpenA-0x8bbb wininet+0x113e1 @ 0x76ac13e1
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetInitializeAutoProxyDll+0x2600 InternetOpenA-0x98dc wininet+0x106c0 @ 0x76ac06c0
InternetInitializeAutoProxyDll+0x1dee InternetOpenA-0xa0ee wininet+0xfeae @ 0x76abfeae
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
IsHostInProxyBypassList+0x647f InternetOpenUrlA-0x5b1 wininet+0x23463 @ 0x76ad3463
IsHostInProxyBypassList+0x643d InternetOpenUrlA-0x5f3 wininet+0x23421 @ 0x76ad3421
InternetOpenUrlA+0x986 InternetCrackUrlW-0x49a6 wininet+0x2439a @ 0x76ad439a
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetOpenUrlA+0x603 InternetCrackUrlW-0x4d29 wininet+0x24017 @ 0x76ad4017
InternetOpenUrlA+0x345 InternetCrackUrlW-0x4fe7 wininet+0x23d59 @ 0x76ad3d59
InternetInitializeAutoProxyDll+0x340 InternetOpenA-0xbb9c wininet+0xe400 @ 0x76abe400
InternetInitializeAutoProxyDll+0x25d InternetOpenA-0xbc7f wininet+0xe31d @ 0x76abe31d
InternetOpenUrlA+0x26a InternetCrackUrlW-0x50c2 wininet+0x23c7e @ 0x76ad3c7e
InternetOpenUrlA+0x65 InternetCrackUrlW-0x52c7 wininet+0x23a79 @ 0x76ad3a79
New_wininet_InternetOpenUrlA+0x62 New_wininet_InternetOpenUrlW-0x15e @ 0x7399c563
InternetOpenUrlW+0x109 InternetGetLastResponseInfoW-0x93 wininet+0x833c9 @ 0x76b333c9
New_wininet_InternetOpenUrlW+0x143 New_wininet_InternetOpenW-0x7d @ 0x7399c804
0x140003324
0x140003c57
0x140003f1a
0x14000ceca
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 41 8b 43 50 48 03 43 30 48 3b f8 73 c9 48 8b 73
exception.symbol: RtlPcToFileHeader+0x9b RtlCreateTimer-0x55 ntdll+0xce6b
exception.instruction: mov eax, dword ptr [r11 + 0x50]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 52843
exception.address: 0x76d3ce6b
registers.r14: 0
registers.r15: 0
registers.rcx: 23117
registers.rsi: 0
registers.r10: 3221225595
registers.rbx: 0
registers.rsp: 1244352
registers.r11: 0
registers.r8: 0
registers.r9: 1230088
registers.rdx: 5368709120
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 3221225595
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000046c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk
file C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\prefs.js
Time & API Arguments Status Return Repeated

SetFileAttributesW

file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\test22\AppData\Roaming\03BD451ED4621855818353\03BD451ED4621855818353.exe
filepath: C:\Users\test22\AppData\Roaming\03BD451ED4621855818353\03BD451ED4621855818353.exe
1 1 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk
cmdline C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Time & API Arguments Status Return Repeated

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: osupdater.exe
process_identifier: 2572
0 0

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: osupdater.exe
process_identifier: 2572
0 0

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: osupdater.exe
process_identifier: 2572
0 0

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: osupdater.exe
process_identifier: 2572
0 0

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x0000000000000098
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x00000000000000a8
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x00000000000000b4
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x00000000000000b4
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x00000000000000dc
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x00000000000000f4
process_name: svchost.exe
process_identifier: 2236
0 0

Process32NextW

snapshot_handle: 0x0000000000000114
process_name: svchost.exe
process_identifier: 2236
0 0
description Match Windows Http API call rule Str_Win32_Http_API
description Escalate priviledges rule Escalate_priviledges
description Communications over HTTP rule Network_HTTP
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names. rule vmdetect_misc
description Match Windows Inet API call rule Str_Win32_Internet_API
description Install itself for autorun at Windows startup rule Persistence
buffer Buffer with sha1: adbaf32077116caf21ff3079bb708fd4e3a3a65c
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Services reg_value C:\Users\test22\AppData\Roaming\03BD451ED4621855818353\03BD451ED4621855818353.exe
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk
Time & API Arguments Status Return Repeated

NtWriteFile

buffer: feec0-ffee-c0ff-eec0-ffeec0ffeec0"); user_pref("toolkit.telemetry.pioneer-new-studies-available", true); user_pref("toolkit.telemetry.previousBuildID", "20220922151854"); user_pref("toolkit.telemetry.reportingpolicy.firstRun", false); user_pref("trailhead.firstrun.didSeeAboutWelcome", true); user_pref("network.http.http2.enabled", false); user_pref("network.http.http3.enable", false); user_pref("network.http.version", 1); user_pref("network.http.http4.enable", false); user_pref("network.http.spdy.enabled", false); user_pref("network.http.spdy.enabled.v3", false); user_pref("network.http.spdy.enabled.v3-1", false);
offset: 0
file_handle: 0x00000000000000a4
filepath: C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\prefs.js
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: @
base_address: 0x000007fffffde010
process_identifier: 2236
process_handle: 0x000000000000022c
1 1 0
Time & API Arguments Status Return Repeated

NtWriteFile

buffer: // Mozilla User Preferences // DO NOT EDIT THIS FILE. // // If you make changes to this file while the application is running, // the changes will be overwritten when the application exits. // // To change a preference value, you can either: // - modify it via the UI (e.g. via about:config in the browser); or // - set it within a user.js file in your profile. user_pref("app.installation.timestamp", "133087271025332031"); user_pref("app.normandy.first_run", false); user_pref("app.normandy.migrationsApplied", 12); user_pref("app.normandy.user_id", "2855b7b1-3af9-4497-acb5-686dcaa31c47"); user_pref("app.shield.optoutstudies.enabled", false); user_pref("app.update.auto.migrated", true); user_pref("app.update.background.lastInstalledTaskVersion", 3); user_pref("app.update.background.previous.reasons", "[\"app.update.auto=false\",\"app.update.langpack.enabled=true and at least one langpack is installed\"]"); user_pref("app.update.background.rolledout", true); user_pref("app.update.lastUpdateTime.addon-background-update-timer", 0); user_pref("app.update.lastUpdateTime.background-update-timer", 1664253878); user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1664253533); user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1664253765); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1664253506); user_pref("app.update.lastUpdateTime.search-engine-update-timer", 1664253649); user_pref("app.update.lastUpdateTime.services-settings-poll-changes", 0); user_pref("app.update.lastUpdateTime.telemetry_modules_ping", 1664253561); user_pref("app.update.lastUpdateTime.telemetry_untrustedmodules_ping", 0); user_pref("app.update.lastUpdateTime.xpi-signature-verification", 0); user_pref("app.update.migrated.updateDir3.308046B0AF4A39CB", true); user_pref("app.update.service.enabled", false); user_pref("browser.bookmarks.addedImportButton", true); user_pref("browser.bookmarks.restore_default_bookmarks", false); user_pref("browser.contentblocking.category", "custom"); user_pref("browser.contextual-services.contextId", "{45d8cf56-f6a3-47b5-90bb-f1357160be28}"); user_pref("browser.download.viewableInternally.typeWasRegistered.avif", true); user_pref("browser.download.viewableInternally.typeWasRegistered.webp", true); user_pref("browser.laterrun.bookkeeping.profileCreationTime", 1664253506); user_pref("browser.laterrun.bookkeeping.sessionCount", 1); user_pref("browser.laterrun.enabled", true); user_pref("browser.launcherProcess.enabled", true); user_pref("browser.migration.version", 128); user_pref("browser.newtabpage.activity-stream.impressionId", "{58eea94c-a09e-4f5e-9166-73e6a44cdef7}"); user_pref("browser.newtabpage.storageVersion", 1); user_pref("browser.pageActions.persistedActions", "{\"ids\":[\"bookmark\"],\"idsInUrlbar\":[\"bookmark\"],\"idsInUrlbarPreProton\":[],\"version\":1}"); user_pref("browser.pagethumbnails.storage_version", 3); user_pref("browser.proton.toolbar.version", 3); user_pref("browser.region.update.updated", 1664253506); user_pref("browser.safebrowsing.malware.enabled", false); user_pref("browser.safebrowsing.phishing.enabled", false); user_pref("browser.safebrowsing.provider.google4.lastupdatetime", "1664253568000"); user_pref("browser.safebrowsing.provider.google4.nextupdatetime", "1664255363000"); user_pref("browser.safebrowsing.provider.mozilla.lastupdatetime", "1664253603826"); user_pref("browser.safebrowsing.provider.mozilla.nextupdatetime", "1664275203826"); user_pref("browser.search.region", "KR"); user_pref("browser.sessionstore.resume_session_once", true); user_pref("browser.sessionstore.resuming_after_os_restart", true); user_pref("browser.shell.checkDefaultBrowser", false); user_pref("browser.shell.didSkipDefaultBrowserCheckOnFirstRun", true); user_pref("browser.startup.couldRestoreSession.count", 1); user_pref("browser.startup.homepage_override.buildID", "20220922151854"); user_pref("browser.startup.homepage_override.mstone", "105.0.1"); user_p
offset: 0
file_handle: 0x00000000000000a4
filepath: C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\prefs.js
1 0 0

NtWriteFile

buffer: ef("browser.theme.content-theme", 1); user_pref("browser.uiCustomization.state", "{\"placements\":{\"widget-overflow-fixed-list\":[],\"nav-bar\":[\"back-button\",\"forward-button\",\"stop-reload-button\",\"customizableui-special-spring1\",\"urlbar-container\",\"customizableui-special-spring2\",\"save-to-pocket-button\",\"downloads-button\",\"fxa-toolbar-menu-button\"],\"toolbar-menubar\":[\"menubar-items\"],\"TabsToolbar\":[\"tabbrowser-tabs\",\"new-tab-button\",\"alltabs-button\"],\"PersonalToolbar\":[\"import-button\",\"personal-bookmarks\"]},\"seen\":[\"save-to-pocket-button\",\"developer-button\"],\"dirtyAreaCache\":[\"nav-bar\",\"PersonalToolbar\"],\"currentVersion\":17,\"newElementCount\":2}"); user_pref("browser.urlbar.placeholderName", "Google"); user_pref("browser.urlbar.quicksuggest.migrationVersion", 2); user_pref("browser.urlbar.quicksuggest.scenario", "history"); user_pref("datareporting.healthreport.uploadEnabled", false); user_pref("datareporting.policy.dataSubmissionPolicyAcceptedVersion", 2); user_pref("datareporting.policy.dataSubmissionPolicyNotifiedTime", "1664253511607"); user_pref("distribution.iniFile.exists.appversion", "105.0.1"); user_pref("distribution.iniFile.exists.value", false); user_pref("doh-rollout.doneFirstRun", true); user_pref("doh-rollout.home-region", "KR"); user_pref("dom.disable_open_during_load", false); user_pref("dom.forms.autocomplete.formautofill", true); user_pref("dom.push.userAgentID", "5e5437fe26414c41b76f8040665ea28f"); user_pref("extensions.activeThemeID", "default-theme@mozilla.org"); user_pref("extensions.blocklist.pingCountVersion", 0); user_pref("extensions.databaseSchema", 35); user_pref("extensions.getAddons.databaseSchema", 6); user_pref("extensions.lastAppBuildId", "20220922151854"); user_pref("extensions.lastAppVersion", "105.0.1"); user_pref("extensions.lastPlatformVersion", "105.0.1"); user_pref("extensions.pendingOperations", false); user_pref("extensions.pictureinpicture.enable_picture_in_picture_overrides", true); user_pref("extensions.systemAddonSet", "{\"schema\":1,\"addons\":{}}"); user_pref("extensions.webcompat.enable_shims", true); user_pref("extensions.webcompat.perform_injections", true); user_pref("extensions.webcompat.perform_ua_overrides", true); user_pref("extensions.webextensions.ExtensionStorageIDB.migrated.screenshots@mozilla.org", true); user_pref("extensions.webextensions.uuids", "{\"formautofill@mozilla.org\":\"8e2d33b7-435a-4346-9d8d-ce724460e4f0\",\"pictureinpicture@mozilla.org\":\"7f4301d4-df3b-4412-a32b-ad7cc761aba6\",\"screenshots@mozilla.org\":\"cdbc4c93-5383-4dc3-ad89-02a1afb93438\",\"webcompat-reporter@mozilla.org\":\"43cde495-6686-4b84-a44d-f7c14a03a583\",\"webcompat@mozilla.org\":\"4721c04f-a670-47a8-8dfd-f82f0506f354\",\"default-theme@mozilla.org\":\"7b8eacfd-7c90-4135-ad55-a4b796c42901\",\"addons-search-detection@mozilla.com\":\"57af4285-ce03-4ac5-ab7b-6f4ced9a3fd9\",\"google@search.mozilla.org\":\"a1b4383b-9a99-4c23-9131-de1a180c7511\",\"amazondotcom@search.mozilla.org\":\"f163c254-409d-413b-9e64-fd9f74401062\",\"wikipedia@search.mozilla.org\":\"c7b7235c-db2c-40ea-bb61-9f0ec6cde8c0\",\"bing@search.mozilla.org\":\"a1dc61e9-c342-4250-9d43-a11e93fdcb2e\",\"ddg@search.mozilla.org\":\"01ccae4b-2e5b-4707-8f7e-8e355288e169\"}"); user_pref("fission.experiment.max-origins.last-disqualified", 0); user_pref("fission.experiment.max-origins.last-qualified", 1664253511); user_pref("fission.experiment.max-origins.qualified", true); user_pref("gecko.handlerService.defaultHandlersVersion", 1); user_pref("intl.locale.requested", "en-US"); user_pref("media.gmp-gmpopenh264.abi", "x86_64-msvc-x64"); user_pref("media.gmp-gmpopenh264.lastDownload", 1664253832); user_pref("media.gmp-gmpopenh264.lastInstallStart", 1664253832); user_pref("media.gmp-gmpopenh264.lastUpdate", 1664253833); user_pref("media.gmp-gmpopenh264.version", "1.8.1.2"); user_pref("media.gmp-manager.buildID", "20220922151854"); user_pref("media.gmp-manager.lastCheck", 1664253832); user_pref("media.gmp-widevinecdm.abi", "x86_64-msvc-x64"); u
offset: 0
file_handle: 0x00000000000000a4
filepath: C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\prefs.js
1 0 0

NtWriteFile

buffer: d", 1664253833); user_pref("media.gmp-widevinecdm.lastInstallStart", 1664253833); user_pref("media.gmp-widevinecdm.lastUpdate", 1664253833); user_pref("media.gmp-widevinecdm.version", "4.10.2449.0"); user_pref("media.gmp.storage.version.observed", 1); user_pref("media.hardware-video-decoding.failed", false); user_pref("network.cookie.cookieBehavior", 0); user_pref("pdfjs.enabledCache.state", true); user_pref("pdfjs.migrationVersion", 2); user_pref("privacy.sanitize.pending", "[]"); user_pref("privacy.trackingprotection.cryptomining.enabled", false); user_pref("privacy.trackingprotection.fingerprinting.enabled", false); user_pref("privacy.trackingprotection.pbmode.enabled", false); user_pref("sanity-test.device-id", "0xbeef"); user_pref("sanity-test.driver-version", "6.1.7600.16385"); user_pref("sanity-test.running", true); user_pref("sanity-test.version", "20220922151854"); user_pref("security.OCSP.enabled", 0); user_pref("security.sandbox.content.tempDirSuffix", "{bce5b85f-de16-4587-81fd-6cd99c368775}"); user_pref("services.settings.blocklists.addons-bloomfilters.last_check", 1664253847); user_pref("services.settings.blocklists.gfx.last_check", 1664253847); user_pref("services.settings.clock_skew_seconds", -16); user_pref("services.settings.last_etag", "\"1664249251749\""); user_pref("services.settings.last_update_seconds", 1664253847); user_pref("services.settings.main.addons-manager-settings.last_check", 1664253847); user_pref("services.settings.main.anti-tracking-url-decoration.last_check", 1664253847); user_pref("services.settings.main.cfr.last_check", 1664253847); user_pref("services.settings.main.devtools-compatibility-browsers.last_check", 1664253847); user_pref("services.settings.main.devtools-devices.last_check", 1664253847); user_pref("services.settings.main.doh-config.last_check", 1664253847); user_pref("services.settings.main.doh-providers.last_check", 1664253847); user_pref("services.settings.main.fxmonitor-breaches.last_check", 1664253847); user_pref("services.settings.main.hijack-blocklists.last_check", 1664253847); user_pref("services.settings.main.language-dictionaries.last_check", 1664253847); user_pref("services.settings.main.message-groups.last_check", 1664253847); user_pref("services.settings.main.nimbus-desktop-experiments.last_check", 1664253847); user_pref("services.settings.main.normandy-recipes-capabilities.last_check", 1664253847); user_pref("services.settings.main.password-recipes.last_check", 1664253847); user_pref("services.settings.main.password-rules.last_check", 1664253847); user_pref("services.settings.main.pioneer-study-addons-v1.last_check", 1664253847); user_pref("services.settings.main.public-suffix-list.last_check", 1664253847); user_pref("services.settings.main.query-stripping.last_check", 1664253847); user_pref("services.settings.main.search-config.last_check", 1664253847); user_pref("services.settings.main.search-default-override-allowlist.last_check", 1664253847); user_pref("services.settings.main.search-telemetry-v2.last_check", 1664253847); user_pref("services.settings.main.sites-classification.last_check", 1664253847); user_pref("services.settings.main.top-sites.last_check", 1664253847); user_pref("services.settings.main.url-classifier-skip-urls.last_check", 1664253847); user_pref("services.settings.main.websites-with-shared-credential-backends.last_check", 1664253847); user_pref("services.settings.main.whats-new-panel.last_check", 1664253847); user_pref("services.settings.security-state.cert-revocations.last_check", 1664253847); user_pref("services.settings.security-state.intermediates.last_check", 1664253847); user_pref("services.settings.security-state.onecrl.last_check", 1664253847); user_pref("services.sync.clients.lastSync", "0"); user_pref("services.sync.declinedEngines", ""); user_pref("services.sync.engine.addresses.available", true); user_pref("services.sync.globalScore", 0); user_pref("services.sync.nextSync", 0); user_pref("services.sync.tabs.lastSync", "0"); user_pref("toolkit.startup.last_success", 1664
offset: 0
file_handle: 0x00000000000000a4
filepath: C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\prefs.js
1 0 0

NtWriteFile

buffer: feec0-ffee-c0ff-eec0-ffeec0ffeec0"); user_pref("toolkit.telemetry.pioneer-new-studies-available", true); user_pref("toolkit.telemetry.previousBuildID", "20220922151854"); user_pref("toolkit.telemetry.reportingpolicy.firstRun", false); user_pref("trailhead.firstrun.didSeeAboutWelcome", true); user_pref("network.http.http2.enabled", false); user_pref("network.http.http3.enable", false); user_pref("network.http.version", 1); user_pref("network.http.http4.enable", false); user_pref("network.http.spdy.enabled", false); user_pref("network.http.spdy.enabled.v3", false); user_pref("network.http.spdy.enabled.v3-1", false);
offset: 0
file_handle: 0x00000000000000a4
filepath: C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\prefs.js
1 0 0
Process injection Process 2572 called NtSetContextThread to modify thread in remote process 2236
Time & API Arguments Status Return Repeated

NtSetContextThread

registers.r14: 0
registers.r15: 0
registers.rcx: 5368762124
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 0
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 0
registers.rdx: 8796092882944
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x00000000000000b8
process_identifier: 2236
1 0 0
Process injection Process 2572 resumed a thread in remote process 2236
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x00000000000000b8
suspend_count: 1
process_identifier: 2236
1 0 0
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 2232
thread_handle: 0x00000000000000b8
process_identifier: 2236
current_directory:
filepath:
track: 1
command_line: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
filepath_r:
stack_pivoted: 0
creation_flags: 134217740 (CREATE_NO_WINDOW|CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x000000000000022c
1 1 0

NtMapViewOfSection

section_handle: 0x00000000000000b4
process_identifier: 2236
commit_size: 0
win32_protect: 2 (PAGE_READONLY)
buffer:
base_address: 0x0000000140000000
allocation_type: 0 ()
section_offset: 0
view_size: 299008
process_handle: 0x000000000000022c
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000b8
1 0 0

NtSetContextThread

registers.r14: 0
registers.r15: 0
registers.rcx: 5368762124
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 0
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 0
registers.rdx: 8796092882944
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x00000000000000b8
process_identifier: 2236
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000b8
1 0 0

WriteProcessMemory

buffer: @
base_address: 0x000007fffffde010
process_identifier: 2236
process_handle: 0x000000000000022c
1 1 0

NtResumeThread

thread_handle: 0x00000000000000b8
suspend_count: 1
process_identifier: 2236
1 0 0
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Androm.m!c
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.Androm
Skyhigh Artemis!Trojan
ALYac Trojan.Generic.36892069
Cylance Unsafe
VIPRE Trojan.Generic.36892069
Sangfor Backdoor.Win32.Androm.Vllf
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Trojan.Generic.36892069
K7GW Trojan ( 005b776e1 )
K7AntiVirus Trojan ( 005b776e1 )
Arcabit Trojan.Generic.D232EDA5
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Agent.EAQ
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Kaspersky Backdoor.Win32.Androm.vsub
Alibaba Trojan:Win64/Nekark.7be4fea5
MicroWorld-eScan Trojan.Generic.36892069
Rising Backdoor.Androm!8.113 (TFE:5:uGYVIXwGFbQ)
Emsisoft Trojan.Generic.36892069 (B)
F-Secure Trojan.TR/AD.Nekark.bnyag
DrWeb Trojan.Siggen29.57557
TrendMicro Trojan.Win64.AMADEY.YXEJWZ
McAfeeD ti!0FBAD12595C3
Trapmine malicious.moderate.ml.score
CTX exe.trojan.androm
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.b611b18150ff90f6
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AD.Nekark.bnyag
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Kingsoft malware.kb.a.947
Gridinsoft Ransom.Win64.Wacatac.sa
Xcitium Malware@#22ml15uqhw2se
Microsoft Trojan:Win32/Sabsik.FL.A!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.Generic.36892069
AhnLab-V3 Trojan/Win.Tnaket.C5685982
McAfee Artemis!B611B18150FF
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.798652179
Ikarus Trojan.Win64.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win64.AMADEY.YXEJWZ