Analysis
-
max time kernel
151s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:32
Static task
static1
Behavioral task
behavioral1
Sample
RecoverKeysInstaller.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RecoverKeysInstaller.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
keyfinder.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
keyfinder.exe
Resource
win10v2004-20221111-en
General
-
Target
keyfinder.exe
-
Size
787KB
-
MD5
4187dfaf99e89cc211eb3f2bf6af81ca
-
SHA1
55fc92048228aaab920a9d164dff7ba92117ec82
-
SHA256
3cf64f198a3a58f608639823ae689cbff75dc475996cbd14ebd16550d9886f1c
-
SHA512
9ffc1e6f76ad4826abe7ece3dcf0a59c49564f03bb3ebde9a11d8dbaeb5f870cb5d9affcebd001ffe6d84aa6bd34fa8f94851de4d8f2a22e1941002e49b86d61
-
SSDEEP
12288:XQx8br+SgmYjgVobXcJTEjK25I3yWwR4C0Ecnb/Lxh+khPg85:PfQjUT/25a87inxIX85
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
keyfinder.exedescription ioc process Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Avira\AntiVir PersonalEdition Classic keyfinder.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 556 firefox.exe Token: SeDebugPrivilege 556 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 556 firefox.exe 556 firefox.exe 556 firefox.exe 556 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 556 firefox.exe 556 firefox.exe 556 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 1000 wrote to memory of 556 1000 firefox.exe firefox.exe PID 556 wrote to memory of 1336 556 firefox.exe firefox.exe PID 556 wrote to memory of 1336 556 firefox.exe firefox.exe PID 556 wrote to memory of 1336 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1444 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe PID 556 wrote to memory of 1492 556 firefox.exe firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\keyfinder.exe"C:\Users\Admin\AppData\Local\Temp\keyfinder.exe"1⤵
- Checks for any installed AV software in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.0.133535328\524867488" -parentBuildID 20200403170909 -prefsHandle 1176 -prefMapHandle 1168 -prefsLen 1 -prefMapSize 219933 -appdir "C:\Program Files\Mozilla Firefox\browser" - 556 "\\.\pipe\gecko-crash-server-pipe.556" 1260 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.3.1446230067\1901779282" -childID 1 -isForBrowser -prefsHandle 1736 -prefMapHandle 1828 -prefsLen 122 -prefMapSize 219933 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 556 "\\.\pipe\gecko-crash-server-pipe.556" 1804 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.13.2058592268\1898773439" -childID 2 -isForBrowser -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 6840 -prefMapSize 219933 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 556 "\\.\pipe\gecko-crash-server-pipe.556" 2372 tab3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB