Analysis
-
max time kernel
330s -
max time network
327s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 21:03
Static task
static1
Behavioral task
behavioral1
Sample
Document_37_Dec1.html
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
Document_37_Dec1.html
-
Size
221KB
-
MD5
3be804323d8ab42ec08a0d4422610087
-
SHA1
9ecd7fc9ac30ee972ef5437ba822d09c840205ee
-
SHA256
b0523c2b7ac08e53ec8868e1c1e7575905a43ab3a3be92b259d299233b919291
-
SHA512
5bcb5c6f1b4ee8bf75747285a7daa3102be6ce9c3587f88ea8e9fea3b2f68485813ca3c321e4730862cb3ad7cf02dd38f5eb8ca1c0ede31554930c00f54acc76
-
SSDEEP
6144:Qih/ffNwPfOD9NuUNSem3N/DkSf3Yx1VJSxt+ooYuwps:PfNwXxYoAK3Yx3JSxcYZs
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\attachment.zip:Zone.Identifier firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2296 firefox.exe Token: SeDebugPrivilege 2296 firefox.exe Token: SeDebugPrivilege 2296 firefox.exe Token: SeDebugPrivilege 2296 firefox.exe Token: SeDebugPrivilege 2296 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
firefox.exepid process 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe 2296 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 1332 wrote to memory of 2296 1332 firefox.exe firefox.exe PID 2296 wrote to memory of 5092 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 5092 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1316 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe PID 2296 wrote to memory of 1536 2296 firefox.exe firefox.exe
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\AppData\Local\Temp\Document_37_Dec1.html1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\AppData\Local\Temp\Document_37_Dec1.html2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.0.498098182\811074730" -parentBuildID 20200403170909 -prefsHandle 1692 -prefMapHandle 1684 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 1772 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.3.1324198068\532069151" -childID 1 -isForBrowser -prefsHandle 2240 -prefMapHandle 2236 -prefsLen 112 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 2444 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.13.961574910\577461123" -childID 2 -isForBrowser -prefsHandle 3728 -prefMapHandle 3544 -prefsLen 1602 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 3716 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.20.948879228\1829023765" -childID 3 -isForBrowser -prefsHandle 3984 -prefMapHandle 3608 -prefsLen 7991 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 4292 tab3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵