hxxp://pdfdocument-1160a[.]web[.]app/#/

General

Target

http://pdfdocument-1160a.web.app/#/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509f8d7a55ddd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372246184"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "372262779"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989653"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012068ee23372fe41af7eabde7907acf0000000000200000000001066000000010000200000008e098d561ca9b3ef164a0d8c1f497fa6a35c0245b7be25038a384cd8c65c6ba2000000000e80000000020000200000005d3ba4da1fd21f9af186dcb03b8bb3bce962c703109c49f79f8d62bf86af81da200000002a337a5dc7c07f0da10c73fec79a565bf96cbdfa1427ceb1a2fe879a23fcb96740000000b3c4ce432498c8ac7d28f5490afadabd2d46a6496c400ebf31d34bd881c0f6ccdcaf342b97b85ce14142fcc1fdb48e4db3e0b0721abd7b348add68577c013943	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2142983784"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a7648355ddd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 5c89698355ddd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30989653"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "372294770"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A78805C7-4948-11ED-A7A3-E6969348A192} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012068ee23372fe41af7eabde7907acf000000000020000000000106600000001000020000000d2dbc40272c83a3717df2e99df4691b58bab9a42b814b62b09ac2bb07f620864000000000e8000000002000020000000d995eb5cde4c1832280fc7b77b825a5ede72babbff71c0bf84b7b6dc50474f082000000005db0d1f83b9e7e43331c9bdf7033fa5d6fddacc0916fcfc08070138819c7dc0400000000de180c68fb3b812a40e6c32f02541a60ba4eb98d6c3b90bbb612a71e256126040d6b9ec4ede59fd6640e231bc0b04a5e07fbf527c72583c16f3da596eb821fd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2118764923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://pdfdocument-1160a.web.app/#/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 48e1947a55ddd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989653"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2118764923"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings firefox.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 5052 firefox.exe
Token: SeDebugPrivilege 5052 firefox.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exefirefox.exe

pid process

2424 iexplore.exe
2424 iexplore.exe
5052 firefox.exe
5052 firefox.exe
5052 firefox.exe
5052 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

5052 firefox.exe
5052 firefox.exe
5052 firefox.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid process

2424 iexplore.exe
2424 iexplore.exe
1712 IEXPLORE.EXE
1712 IEXPLORE.EXE
1712 IEXPLORE.EXE
1712 IEXPLORE.EXE
5052 firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	firefox.exe

description	pid	process
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	5052	firefox.exe

pid	process
2424	iexplore.exe
2424	iexplore.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

pid	process
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

pid	process
2424	iexplore.exe
2424	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
5052	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2424 wrote to memory of 1712	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 1712	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 1712	2424	iexplore.exe	IEXPLORE.EXE
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 2200 wrote to memory of 5052	2200	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4684	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4684	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4268	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe
PID 5052 wrote to memory of 4828	5052	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://pdfdocument-1160a.web.app/#/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.0.452322384\1234612034" -parentBuildID 20200403170909 -prefsHandle 1528 -prefMapHandle 1508 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 1612 gpu
3⤵
PID:4684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.3.1915153691\777504158" -childID 1 -isForBrowser -prefsHandle 2240 -prefMapHandle 2236 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 2264 tab
3⤵
PID:4268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5052.13.1136470974\1855977285" -childID 2 -isForBrowser -prefsHandle 3292 -prefMapHandle 3248 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5052 "\\.\pipe\gecko-crash-server-pipe.5052" 3308 tab
3⤵
PID:4828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
fceed7a5f76725fb398c6a91ff552899

SHA1
237aec000ae7c7c35a639664b1ad6c0d842a0749

SHA256
2888c66a6908f10474313b2fef31aeeff40cffe1bcbd19b84b29334ff6a71383

SHA512
adfba4e72523d38395c13122d6498d9b48d93b2967858f0208549e3830c9b47ee3e98249b98fe585aeeeffe491a6985a98c80a3be581abccf4239bad4d1cdef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
fc8f9a4658ed2a521c4b93a1f48da98b

SHA1
bbca4496698ee614b8f43dc7323b612a221eb632

SHA256
314322062cdc70177b86e482e544af75a219ab3e5acf16626b3035b2d6c00297

SHA512
46d83791867e91038f4dbb7626bf608e581ed00ab69ef7b26e377fd75aee49705b982b40b98c6466fa174e077a46a2bc91d2bd9b3e79a6bea1e774d087792559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0KGYNYAV.cookie
Filesize
615B

MD5
5589de4bb46a30d591d8d0666a66b6c8

SHA1
104a5b3a812c7d14ee069d62b3731c2875e9b117

SHA256
3e1e38782bb1f867beac6a3400d44aadca1a914a7968b8d8402f9cd1db71ee20

SHA512
235656d39163944e79adb176a017423bdac311405d5d269ddd5946b378a14a741401a94f28b567656e02d2390a6777814655833c814b7bb1861ce5e7f23eac94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\KTGSJLTC.cookie
Filesize
615B

MD5
335659cf8f58426ffd7c6cf5e4fe472f

SHA1
111b90e24ef0b20b8dbcf90816b1bf591d06b1c4

SHA256
d4473b6a4e8a9677f60d7f42645aa0a9311e4241fc0889fec0b4920af3f78d1b

SHA512
b0677ed73be377e6e5c34f490f71fd9e064c4a18e310326aa2112c92e0d18a80f203ac9c4fd347b820e7676d4c7fc839809b303f1c03686dc63f75e4585a8920

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads