1fc3cabbb795381877c9724be6c815e80890eee322dce82be1994a3cd9ec22ca

General

Target

favorites_10_30_20.html
Size

410B
MD5

dadb7dbc14491c4a8455a2f7c55807d7
SHA1

70665fce8130d091c50519e214f5423224eef0e8
SHA256

1fc3cabbb795381877c9724be6c815e80890eee322dce82be1994a3cd9ec22ca
SHA512

b05f0cb29422be6900a3f0129fa11a92268387d3f9ef30cf76dfb083f7a340dee3191ef408acf07b81d113cf8d743ebbaf6e31c036c7d73ac112877e4643e40f

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08e495b19b3d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1470767669"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40952a5b19b3d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000009c74199de5d26edd521cb64e1c948a371ed1caad0e1b12908295d18f3b482a05000000000e8000000002000020000000d46363f3356abecda5109c1fa1c2580a188afa5aeafa9396a9f37ed96c3b77b8200000002bb47936b7e2161250ab42297284193b323e9a3bbddd0b2b52daf649ab9a3c8740000000230257bb6a8025c028ac75d94def74952417f2929e1f07eb202e5fbbbcb24e33a7f05b446d77d6d77897f871f4bc2202e5e9a6257fb5e7c12567a24089d21e82	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82883A1F-1F0C-11EB-B59A-DE6DDC9D1B26} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30847769"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1470767669"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30847769"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000004bcd697f0c9b555b9f56056a971e9c63c2095538931e57f9a083f6a04f936980000000000e8000000002000020000000e05fc764c39478a6a58c80b150d12104048bfc012c8a86e77b81ce9dbb034467200000001dce751852550ce18098b3570acae96fc6eac02552a074631e94c03fc28b524d40000000813e5cccc212f3cc62ec8d02f57a87010b01c49a9b5a71ebc79afdf64e6a22d79521a9e234d5ce1656daaf264d1f12474d0ca2877af30514be740734782aaae7	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

576 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exefirefox.exe

pid process

576 iexplore.exe
576 iexplore.exe
3672 IEXPLORE.EXE
3672 IEXPLORE.EXE
3672 IEXPLORE.EXE
3672 IEXPLORE.EXE
3996 firefox.exe
3824 firefox.exe

pid	process
576	iexplore.exe

pid	process
576	iexplore.exe
576	iexplore.exe
3672	IEXPLORE.EXE
3672	IEXPLORE.EXE
3672	IEXPLORE.EXE
3672	IEXPLORE.EXE
3996	firefox.exe
3824	firefox.exe

Suspicious use of WriteProcessMemory 68 IoCs

Processes:

iexplore.exefirefox.exefirefox.exefirefox.exefirefox.exe

description	pid	process	target process
PID 576 wrote to memory of 3672	576	iexplore.exe	IEXPLORE.EXE
PID 576 wrote to memory of 3672	576	iexplore.exe	IEXPLORE.EXE
PID 576 wrote to memory of 3672	576	iexplore.exe	IEXPLORE.EXE
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 2180 wrote to memory of 3824	2180	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3152 wrote to memory of 3996	3152	firefox.exe	firefox.exe
PID 3996 wrote to memory of 1264	3996	firefox.exe	firefox.exe
PID 3996 wrote to memory of 1264	3996	firefox.exe	firefox.exe
PID 3824 wrote to memory of 580	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 580	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe
PID 3824 wrote to memory of 3012	3824	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\favorites_10_30_20.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:576 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3824.0.131080636\1059630136" -parentBuildID 20200403170909 -prefsHandle 1508 -prefMapHandle 1500 -prefsLen 1 -prefMapSize 219631 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3824 "\\.\pipe\gecko-crash-server-pipe.3824" 1588 gpu
3⤵
PID:580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3824.3.1402893932\1512955485" -childID 1 -isForBrowser -prefsHandle 2284 -prefMapHandle 2256 -prefsLen 501 -prefMapSize 219631 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3824 "\\.\pipe\gecko-crash-server-pipe.3824" 2312 tab
3⤵
PID:3012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3996.0.632764524\1920403183" -parentBuildID 20200403170909 -prefsHandle 1408 -prefMapHandle 1396 -prefsLen 1 -prefMapSize 214080 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3996 "\\.\pipe\gecko-crash-server-pipe.3996" 1492 gpu
3⤵
PID:1264