43fcc0500664221ce892a5ce713e27935b478389e463e8bc209880960acbdd83

General

Target

ATT0002644.htm
Size

429B
MD5

9d950526df17880d6dd9a2c062460514
SHA1

6ba6d639957de2090e11c846267b16f1f653069b
SHA256

43fcc0500664221ce892a5ce713e27935b478389e463e8bc209880960acbdd83
SHA512

f08731f68ad62fd50398bf0bd66d602700f2f2b53bc4fae9412cc0eb7494419eeb13d439733d2f49c67ce93214a96c8027e4170bb9ef36beccacd545e80af157

Score

6^/10

microsoft phishing

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3460 1740 WerFault.exe iexplore.exe
Detected potential entity reuse from brand microsoft.
phishing microsoft

pid	pid_target	process	target process
3460	1740	WerFault.exe	iexplore.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\voiplogger0365.xyz\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "125"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0259a58b9d6d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000f823c80e9d33329f63dc9668ca994d051a61b1e20c6c2296538ea18be17e1689000000000e8000000002000020000000123f8f89b2fb58e334189700fc88109cbc5f363ca67d36985d1eaf6c7726e64cf000000084c79e13a3bf3fe6deb9409dab6b2f83eb2028edd991c7e487f8518ad19c977ed25eb0b9d3fcde8fa9af8777d88237c36607d036d3a7a27d3c3433bc8d50ed7db8f2437248f57c9f951a35eaba18a1bf5fab26648e9f1fd6e66c613207090b1f9c7c422ce4de928a9dc6afb811e3060b2020271222c59e2890bb40dd91fb6463c8c11fafff076b1daba32252050e9bf470ae9399dc94318891f2c11b0c58e71f6e66690c8ac124edd750ef0329b329040d7ef87d8bd4a5dfe56fc415d9e5d47429da75b29a8fd01a221226807b7070a58c04566c4f1dbff7c1a834958115cceb79453a6f7de5c26b0a9161a216d1f1a34000000067f72e925483097aadb3408d52d4fe8678178077a07e594f7ee52ce7c6e3e6215ef9a27e80222530597b28a5898db4f26048383ab19a976dba1381b2fb5dd62c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "343388490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\voiplogger0365.xyz	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\server.voiplogger0365.xyz\ = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "343420482"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\voiplogger0365.xyz\Total = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000cc4bd8cc3ea28bc4fa12f5bed9e0bd42212d0288554c649ef52c13d0da71a6b5000000000e80000000020000200000008ce7aed9947447cef3e21a03d84c3916428ae71c2e8211324977a337f3de8d8820000000996480a678c2e0407e2183858747e9fd016428e1880fbc57ce3a6648825017ff400000009be3d8c31f2d8111fa5cc4255840a11ed559496bc55d6f7b2ff1996f762494ff439a11f3c38221fad72d124015c1167d8f7dc62fcd36e787cb0f9aef52d34dcc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "232"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343371896"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D7A9F9E-4560-11EC-B34F-C211F579740E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c3000000000200000000001066000000010000200000000508d2b44be7fd6c73f0304c98d7fdb67f44413a82861afa4c0cd75544e8f026000000000e800000000200002000000036a621c23ac5e8efaa0294550711f37c2dd9a0a72131a4dab8acc3175008de34f00000005b97d54f743fd238e433ce182861a8188ff208c61fc39f0c13942b02f67d212cd469713052494e51ff15a5184790090158576d20767609f29555f8f09bf141f28b994a657df235d35af11bef3878e2468eb38c978fad70ba42f2b6a64cc25085558d5862c9df59a7b3c74390a1954ca62a2e533b265a7136ba55295188b06091fc7c54bea4df70bb8f6b951ed90019ec1026503f92c87085989f92165a6a5a8a57515d56e0a5a2e5526a5f1aed816724b5610de2a1c8c712cecf9ab1a825b78e47dea3dbb54198ce7ceab12f07f51ba7c59d6965ac7f97d267b1b42ca88164a78a1155df84efaa793ba56f4620d2d0ce40000000ee0e12fecd30f63712adf02fe08bc569e8e55dc59e915800e05c81ec35ee7c81ff8e6b5e99598014d30a144a31bb58a2e58928be3a9eaccc1d439b8a5776a400	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "64"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1430068663"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30922425"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\server.voiplogger0365.xyz	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "232"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60593089b9d6d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009acbbc286be63c4682a409f320de94d7	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "64"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30922425"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1454756481"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe
3460	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3688 iexplore.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exefirefox.exe

description pid process

Token: SeDebugPrivilege 3460 WerFault.exe
Token: SeDebugPrivilege 2272 firefox.exe
Token: SeDebugPrivilege 2272 firefox.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exefirefox.exe

pid process

3688 iexplore.exe
2272 firefox.exe
2272 firefox.exe
2272 firefox.exe
2272 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2272 firefox.exe
2272 firefox.exe
2272 firefox.exe

description	pid	process
Token: SeDebugPrivilege	3460	WerFault.exe
Token: SeDebugPrivilege	2272	firefox.exe
Token: SeDebugPrivilege	2272	firefox.exe

pid	process
2272	firefox.exe
2272	firefox.exe
2272	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
3688	iexplore.exe
3688	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2272	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3688 wrote to memory of 2000	3688	iexplore.exe	IEXPLORE.EXE
PID 3688 wrote to memory of 2000	3688	iexplore.exe	IEXPLORE.EXE
PID 3688 wrote to memory of 2000	3688	iexplore.exe	IEXPLORE.EXE
PID 3688 wrote to memory of 1740	3688	iexplore.exe	iexplore.exe
PID 3688 wrote to memory of 1740	3688	iexplore.exe	iexplore.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 496 wrote to memory of 2272	496	firefox.exe	firefox.exe
PID 2272 wrote to memory of 2444	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 2444	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 3516	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 1428	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 1428	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 1428	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 1428	2272	firefox.exe	firefox.exe
PID 2272 wrote to memory of 1428	2272	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ATT0002644.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3688 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3688 CREDAT:82952 /prefetch:2
2⤵
- Modifies Internet Explorer settings
PID:1740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1740 -s 2516
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.0.846629470\746175827" -parentBuildID 20200403170909 -prefsHandle 844 -prefMapHandle 1188 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 1596 gpu
3⤵
PID:2444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.3.1647593271\942490845" -childID 1 -isForBrowser -prefsHandle 1204 -prefMapHandle 2172 -prefsLen 122 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 2256 tab
3⤵
PID:3516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.13.1661904599\1074364222" -childID 2 -isForBrowser -prefsHandle 3372 -prefMapHandle 3368 -prefsLen 6979 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 3388 tab
3⤵
PID:1428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2272.20.1660247219\720831353" -childID 3 -isForBrowser -prefsHandle 4044 -prefMapHandle 4076 -prefsLen 7750 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2272 "\\.\pipe\gecko-crash-server-pipe.2272" 4028 tab
3⤵
PID:3556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
54e9306f95f32e50ccd58af19753d929

SHA1
eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

SHA256
45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

SHA512
8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6E58CA2D9A27F7D92CBCA0E41E1B2D28
MD5
ac2b6a2375bb8989cb68df25a63184ca

SHA1
27b5d5dfdd4b90ebe1a75ee21ddf8add76b4b000

SHA256
efaeef0faa17d83d84130fe824c76a809f32b4b7552da030f9bece78e01619c1

SHA512
6148d31dd5dc90ad23bf52201e919207758f61236403c2367157123730ca44b190fbff1453d1962c7e64eb9646288ed340e02228dec09ec22ed9f0047bc544ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
189cf116bf3713a9e49bf51bc7bfc49a

SHA1
3ab63a8339c980b837751c853e59c6ec3217c562

SHA256
f6bf6c9521ecd07410816f060578a5c8b60500821a95b728ba72de438ebf121f

SHA512
24334290b79fba800b6f87c595839f07144f5f05ef1023214070155ffd78f01aeb794842dd7764b35b7528203fb9618edb7ad0903808bd721e864caea2f29363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
db18101ea166c91b3847998b98510ea3

SHA1
bd51b2f7ad8ccbc1d39a9363566eb23f26463fea

SHA256
247618ac0e6a2be7860015dd4e1b80be7b1df9bcd23d9f7926bd07fa26867d1f

SHA512
77d0a16f23a2c69726972ebf3fbd45e408a8442dedf1750b4110c4d9de0719cd65ceba7f00505a49c2db4ad7f91fd5e5d40408b71cf5576f9a35680322bfe7d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E58CA2D9A27F7D92CBCA0E41E1B2D28
MD5
741a111511106582cd2271b4679a0332

SHA1
7e3d6d3f66b2a7f872ce1dbdef3a323619dca4cf

SHA256
5e0203d65a87d07c5934a4edb1bf6ae833c3737cc8a096c4553bb2be723e3e76

SHA512
efd48b48bda531bd685080b269fcd5a5378a09a652713bd37255083ca87b6b23f7e076f00e1d4b5beec5acdd1a6c752c2f51010b57ba684e5c6c72ad6ad3a61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
4631b695ca9fbe1b6aee880353cef492

SHA1
f00c5ab3733560a4c4b9775277c20ddeb027c5aa

SHA256
708a0699784b4a83d3a1acb41bda29b5dd21b98935b74b3425a54ad601789ccc

SHA512
dc67340e85f931fc9e5ae6506f90ee1969b50ab202c0114780fe8be2ce943584858d68ad52c5662ee24e5c91a39baaa5cdee0c800d089332b57449809ab5b0e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5MHROLO1.cookie
MD5
acf24924f447b1d1b8deb78086d0cf22

SHA1
5263ddc725760cf5cac2704902da081f78881ce5

SHA256
87ca67e31afda51fcecaf1fcc7f60b45bb438fd4eff564ea441f516c4755d168

SHA512
5af2098cb451a00719c9a465ccff2c590e36ab32e49bb497564ff436f5867e8cd3201471540f8489ddc4f84da5e475fc886db0d4ac84e0debbaed5ace41cb8e5

Download Submit
memory/1740-201-0x0000000000000000-mapping.dmp

Download
memory/2000-144-0x0000000000000000-mapping.dmp

Download
memory/3688-141-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-154-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-125-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-126-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-127-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-128-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-130-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-131-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-132-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-134-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-135-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-136-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-138-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-139-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-140-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-123-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-143-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-146-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-148-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-149-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-151-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-124-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-153-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-155-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-159-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-160-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-161-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-167-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-168-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-169-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-170-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-171-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-172-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-122-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-120-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-119-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-118-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-176-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-178-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-181-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download
memory/3688-182-0x00007FFB50200000-0x00007FFB5026B000-memory.dmp

Filesize
428KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads