hxxp://1music-online[.]me/

Analysis

max time kernel
273s
max time network
230s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
11/09/2022, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://1music-online.me/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	firefox.exe
Token: SeDebugPrivilege	2208	firefox.exe
Token: SeDebugPrivilege	2208	firefox.exe
Token: SeDebugPrivilege	2208	firefox.exe
Token: SeDebugPrivilege	2208	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2208	firefox.exe
2208	firefox.exe
2208	firefox.exe
2208	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2208	firefox.exe
2208	firefox.exe
2208	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2132 wrote to memory of 2208	2132	firefox.exe	66
PID 2208 wrote to memory of 3728	2208	firefox.exe	68
PID 2208 wrote to memory of 3728	2208	firefox.exe	68
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 3608	2208	firefox.exe	70
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71
PID 2208 wrote to memory of 4160	2208	firefox.exe	71

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" http://1music-online.me/
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" http://1music-online.me/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2208.0.687046446\886170187" -parentBuildID 20200403170909 -prefsHandle 1536 -prefMapHandle 1528 -prefsLen 1 -prefMapSize 219938 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 1612 gpu
    3⤵
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2208.3.1253694272\1724630480" -childID 1 -isForBrowser -prefsHandle 2208 -prefMapHandle 2056 -prefsLen 122 -prefMapSize 219938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 2220 tab
    3⤵
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2208.13.98471433\1006911655" -childID 2 -isForBrowser -prefsHandle 3396 -prefMapHandle 3392 -prefsLen 6904 -prefMapSize 219938 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 3412 tab
    3⤵
    PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\pipe\chrome.2208.10.170547288

Filesize
232B

MD5
13e535cd09cf14a18988a4d76d313eb8

SHA1
1763eccc04c49b412b2742f13f642a70505e6887

SHA256
96d0ba035055c6744e8f0bfaeae740e51cb02a486e8041262d3843ba4836e905

SHA512
9ea1c396e8a967340df9d92bed6ac910014f8f1060b657dfa83974bb9c86fcd5e68cc40710ddc71979cb8a9d00e9df01d2e42680deb587abd3968b9c3b4749f4

Download Submit