Analysis
-
max time kernel
2s -
max time network
32s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 14:46
Static task
static1
URLScan task
urlscan1
Sample
https://puntaarenas.cl/OIRS/OIRS/2014/.hu/hu/
Behavioral task
behavioral1
Sample
https://puntaarenas.cl/OIRS/OIRS/2014/.hu/hu/
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
https://puntaarenas.cl/OIRS/OIRS/2014/.hu/hu/
-
Sample
210113-24mawcjv6n
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4912 firefox.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4760 wrote to memory of 4912 4760 firefox.exe firefox.exe PID 4912 wrote to memory of 4264 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 4264 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe PID 4912 wrote to memory of 584 4912 firefox.exe firefox.exe
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://puntaarenas.cl/OIRS/OIRS/2014/.hu/hu/1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://puntaarenas.cl/OIRS/OIRS/2014/.hu/hu/2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.0.1372745750\248989349" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1544 -prefsLen 1 -prefMapSize 219511 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 1632 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.3.1749267891\32803041" -childID 1 -isForBrowser -prefsHandle 2252 -prefMapHandle 2276 -prefsLen 156 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 2264 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.13.1753690174\1767167830" -childID 2 -isForBrowser -prefsHandle 3240 -prefMapHandle 3236 -prefsLen 7013 -prefMapSize 219511 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 3224 tab3⤵