Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
11-11-2021 15:33
Static task
static1
Behavioral task
behavioral1
Sample
ATT0002644.htm
Resource
win7-en-20211104
General
-
Target
ATT0002644.htm
-
Size
429B
-
MD5
9d950526df17880d6dd9a2c062460514
-
SHA1
6ba6d639957de2090e11c846267b16f1f653069b
-
SHA256
43fcc0500664221ce892a5ce713e27935b478389e463e8bc209880960acbdd83
-
SHA512
f08731f68ad62fd50398bf0bd66d602700f2f2b53bc4fae9412cc0eb7494419eeb13d439733d2f49c67ce93214a96c8027e4170bb9ef36beccacd545e80af157
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3460 1740 WerFault.exe iexplore.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\voiplogger0365.xyz\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "125" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0259a58b9d6d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000f823c80e9d33329f63dc9668ca994d051a61b1e20c6c2296538ea18be17e1689000000000e8000000002000020000000123f8f89b2fb58e334189700fc88109cbc5f363ca67d36985d1eaf6c7726e64cf000000084c79e13a3bf3fe6deb9409dab6b2f83eb2028edd991c7e487f8518ad19c977ed25eb0b9d3fcde8fa9af8777d88237c36607d036d3a7a27d3c3433bc8d50ed7db8f2437248f57c9f951a35eaba18a1bf5fab26648e9f1fd6e66c613207090b1f9c7c422ce4de928a9dc6afb811e3060b2020271222c59e2890bb40dd91fb6463c8c11fafff076b1daba32252050e9bf470ae9399dc94318891f2c11b0c58e71f6e66690c8ac124edd750ef0329b329040d7ef87d8bd4a5dfe56fc415d9e5d47429da75b29a8fd01a221226807b7070a58c04566c4f1dbff7c1a834958115cceb79453a6f7de5c26b0a9161a216d1f1a34000000067f72e925483097aadb3408d52d4fe8678178077a07e594f7ee52ce7c6e3e6215ef9a27e80222530597b28a5898db4f26048383ab19a976dba1381b2fb5dd62c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "343388490" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\voiplogger0365.xyz IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\server.voiplogger0365.xyz\ = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "343420482" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\voiplogger0365.xyz\Total = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000cc4bd8cc3ea28bc4fa12f5bed9e0bd42212d0288554c649ef52c13d0da71a6b5000000000e80000000020000200000008ce7aed9947447cef3e21a03d84c3916428ae71c2e8211324977a337f3de8d8820000000996480a678c2e0407e2183858747e9fd016428e1880fbc57ce3a6648825017ff400000009be3d8c31f2d8111fa5cc4255840a11ed559496bc55d6f7b2ff1996f762494ff439a11f3c38221fad72d124015c1167d8f7dc62fcd36e787cb0f9aef52d34dcc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "232" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343371896" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D7A9F9E-4560-11EC-B34F-C211F579740E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c3000000000200000000001066000000010000200000000508d2b44be7fd6c73f0304c98d7fdb67f44413a82861afa4c0cd75544e8f026000000000e800000000200002000000036a621c23ac5e8efaa0294550711f37c2dd9a0a72131a4dab8acc3175008de34f00000005b97d54f743fd238e433ce182861a8188ff208c61fc39f0c13942b02f67d212cd469713052494e51ff15a5184790090158576d20767609f29555f8f09bf141f28b994a657df235d35af11bef3878e2468eb38c978fad70ba42f2b6a64cc25085558d5862c9df59a7b3c74390a1954ca62a2e533b265a7136ba55295188b06091fc7c54bea4df70bb8f6b951ed90019ec1026503f92c87085989f92165a6a5a8a57515d56e0a5a2e5526a5f1aed816724b5610de2a1c8c712cecf9ab1a825b78e47dea3dbb54198ce7ceab12f07f51ba7c59d6965ac7f97d267b1b42ca88164a78a1155df84efaa793ba56f4620d2d0ce40000000ee0e12fecd30f63712adf02fe08bc569e8e55dc59e915800e05c81ec35ee7c81ff8e6b5e99598014d30a144a31bb58a2e58928be3a9eaccc1d439b8a5776a400 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "64" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1430068663" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30922425" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\server.voiplogger0365.xyz IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "232" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60593089b9d6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009acbbc286be63c4682a409f320de94d7 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "64" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30922425" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1454756481" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe 3460 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3688 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exefirefox.exedescription pid process Token: SeDebugPrivilege 3460 WerFault.exe Token: SeDebugPrivilege 2272 firefox.exe Token: SeDebugPrivilege 2272 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
iexplore.exefirefox.exepid process 3688 iexplore.exe 2272 firefox.exe 2272 firefox.exe 2272 firefox.exe 2272 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2272 firefox.exe 2272 firefox.exe 2272 firefox.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
iexplore.exeIEXPLORE.EXEfirefox.exepid process 3688 iexplore.exe 3688 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2272 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exefirefox.exefirefox.exedescription pid process target process PID 3688 wrote to memory of 2000 3688 iexplore.exe IEXPLORE.EXE PID 3688 wrote to memory of 2000 3688 iexplore.exe IEXPLORE.EXE PID 3688 wrote to memory of 2000 3688 iexplore.exe IEXPLORE.EXE PID 3688 wrote to memory of 1740 3688 iexplore.exe iexplore.exe PID 3688 wrote to memory of 1740 3688 iexplore.exe iexplore.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 496 wrote to memory of 2272 496 firefox.exe firefox.exe PID 2272 wrote to memory of 2444 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 2444 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 3516 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1428 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1428 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1428 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1428 2272 firefox.exe firefox.exe PID 2272 wrote to memory of 1428 2272 firefox.exe firefox.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ATT0002644.htm1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3688 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3688 CREDAT:82952 /prefetch:22⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1740 -s 25163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.0.846629470\746175827" -parentBuildID 20200403170909 -prefsHandle 844 -prefMapHandle 1188 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 1596 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.3.1647593271\942490845" -childID 1 -isForBrowser -prefsHandle 1204 -prefMapHandle 2172 -prefsLen 122 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 2256 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.13.1661904599\1074364222" -childID 2 -isForBrowser -prefsHandle 3372 -prefMapHandle 3368 -prefsLen 6979 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 3388 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.20.1660247219\720831353" -childID 3 -isForBrowser -prefsHandle 4044 -prefMapHandle 4076 -prefsLen 7750 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 4028 tab3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6E58CA2D9A27F7D92CBCA0E41E1B2D28MD5
ac2b6a2375bb8989cb68df25a63184ca
SHA127b5d5dfdd4b90ebe1a75ee21ddf8add76b4b000
SHA256efaeef0faa17d83d84130fe824c76a809f32b4b7552da030f9bece78e01619c1
SHA5126148d31dd5dc90ad23bf52201e919207758f61236403c2367157123730ca44b190fbff1453d1962c7e64eb9646288ed340e02228dec09ec22ed9f0047bc544ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
189cf116bf3713a9e49bf51bc7bfc49a
SHA13ab63a8339c980b837751c853e59c6ec3217c562
SHA256f6bf6c9521ecd07410816f060578a5c8b60500821a95b728ba72de438ebf121f
SHA51224334290b79fba800b6f87c595839f07144f5f05ef1023214070155ffd78f01aeb794842dd7764b35b7528203fb9618edb7ad0903808bd721e864caea2f29363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
db18101ea166c91b3847998b98510ea3
SHA1bd51b2f7ad8ccbc1d39a9363566eb23f26463fea
SHA256247618ac0e6a2be7860015dd4e1b80be7b1df9bcd23d9f7926bd07fa26867d1f
SHA51277d0a16f23a2c69726972ebf3fbd45e408a8442dedf1750b4110c4d9de0719cd65ceba7f00505a49c2db4ad7f91fd5e5d40408b71cf5576f9a35680322bfe7d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E58CA2D9A27F7D92CBCA0E41E1B2D28MD5
741a111511106582cd2271b4679a0332
SHA17e3d6d3f66b2a7f872ce1dbdef3a323619dca4cf
SHA2565e0203d65a87d07c5934a4edb1bf6ae833c3737cc8a096c4553bb2be723e3e76
SHA512efd48b48bda531bd685080b269fcd5a5378a09a652713bd37255083ca87b6b23f7e076f00e1d4b5beec5acdd1a6c752c2f51010b57ba684e5c6c72ad6ad3a61b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
4631b695ca9fbe1b6aee880353cef492
SHA1f00c5ab3733560a4c4b9775277c20ddeb027c5aa
SHA256708a0699784b4a83d3a1acb41bda29b5dd21b98935b74b3425a54ad601789ccc
SHA512dc67340e85f931fc9e5ae6506f90ee1969b50ab202c0114780fe8be2ce943584858d68ad52c5662ee24e5c91a39baaa5cdee0c800d089332b57449809ab5b0e5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5MHROLO1.cookieMD5
acf24924f447b1d1b8deb78086d0cf22
SHA15263ddc725760cf5cac2704902da081f78881ce5
SHA25687ca67e31afda51fcecaf1fcc7f60b45bb438fd4eff564ea441f516c4755d168
SHA5125af2098cb451a00719c9a465ccff2c590e36ab32e49bb497564ff436f5867e8cd3201471540f8489ddc4f84da5e475fc886db0d4ac84e0debbaed5ace41cb8e5
-
memory/1740-201-0x0000000000000000-mapping.dmp
-
memory/2000-144-0x0000000000000000-mapping.dmp
-
memory/3688-141-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-154-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-125-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-126-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-127-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-128-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-130-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-131-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-132-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-134-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-135-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-136-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-138-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-139-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-140-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-123-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-143-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-146-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-148-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-149-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-151-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-124-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-153-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-155-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-159-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-160-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-161-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-167-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-168-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-169-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-170-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-171-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-172-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-122-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-120-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-119-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-118-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-176-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-178-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-181-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB
-
memory/3688-182-0x00007FFB50200000-0x00007FFB5026B000-memory.dmpFilesize
428KB