Overview
overview
10Static
static
RRCG61.zip
windows10-1703-x64
1RRCG61.vhd
windows10-1703-x64
3RR.lnk
windows10-1703-x64
10System Vol...gs.dat
windows10-1703-x64
3unutterabl...ns.cmd
windows10-1703-x64
1unutterabl...ed.cmd
windows10-1703-x64
1unutterabl...le.txt
windows10-1703-x64
1unutterably/swam.dll
windows10-1703-x64
10Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08-12-2022 16:20
Static task
static1
Behavioral task
behavioral1
Sample
RRCG61.zip
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
RRCG61.vhd
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
RR.lnk
Resource
win10-20220901-en
Behavioral task
behavioral4
Sample
System Volume Information/WPSettings.dat
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
unutterably/felons.cmd
Resource
win10-20220812-en
Behavioral task
behavioral6
Sample
unutterably/offered.cmd
Resource
win10-20220812-en
Behavioral task
behavioral7
Sample
unutterably/satiable.txt
Resource
win10-20220812-en
General
-
Target
RRCG61.zip
-
Size
319KB
-
MD5
353410090167036754a9f6bd372a8909
-
SHA1
56bfe14cf94a47d31d52f954822b42d9f8c1a955
-
SHA256
2ebaeeec8d4f6b267d466e1ea0cbcd3e356f422c76f063c26d56131f951d5723
-
SHA512
118412975687e005dc3eb92764357cb81ef02dc5864d84a57a0b129c2cc3269da1d4d3b3ac3af2a022f03da888b04254e024d5af55d620643ae263477eacd300
-
SSDEEP
6144:195jJ6PcEjEOyYW/FcPyY/Z7acNXcTlhMCCZp0HnPZRXD7jwKixNSCCqpiQ8C7P:13AItP/FnY/hLMrMCCZp4nRdD7j7i6K1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
firefox.exepid process 4264 firefox.exe 4264 firefox.exe 4264 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 4264 firefox.exe 4264 firefox.exe 4264 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4264 firefox.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 1992 wrote to memory of 4264 1992 firefox.exe firefox.exe PID 4264 wrote to memory of 3364 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 3364 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe PID 4264 wrote to memory of 4748 4264 firefox.exe firefox.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\RRCG61.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4264.0.427745738\679046051" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1544 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4264 "\\.\pipe\gecko-crash-server-pipe.4264" 1176 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4264.3.748826249\194508440" -childID 1 -isForBrowser -prefsHandle 2184 -prefMapHandle 2180 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4264 "\\.\pipe\gecko-crash-server-pipe.4264" 2196 tab3⤵