Analysis
-
max time kernel
200s -
max time network
203s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
17-12-2022 02:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ikoa-cf54f.firebaseapp.com/finishSignUp?cartId=aboqvj1t&linkPP=aHR0cHM6Ly9vay5tZS9xMEw2MQ%3D%3D&apiKey=AIzaSyDegLtqP1QIDBqF8AdwiVd62vRla3MY1e0&oobCode=crVJ9U2jP-uGLmjagEykbCJxw1wCv9uNMMN3BtQaYrMAAAGEo46p-w&mode=signIn&lang=ru
Resource
win10-20220901-en
windows10-1703-x64
8 signatures
600 seconds
General
-
Target
https://ikoa-cf54f.firebaseapp.com/finishSignUp?cartId=aboqvj1t&linkPP=aHR0cHM6Ly9vay5tZS9xMEw2MQ%3D%3D&apiKey=AIzaSyDegLtqP1QIDBqF8AdwiVd62vRla3MY1e0&oobCode=crVJ9U2jP-uGLmjagEykbCJxw1wCv9uNMMN3BtQaYrMAAAGEo46p-w&mode=signIn&lang=ru
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0dfdbb4bd11d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E396885A-7DB0-11ED-9424-FA5541988DC1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://ikoa-cf54f.firebaseapp.com/finishSignUp?cartId=aboqvj1t&linkPP=aHR0cHM6Ly9vay5tZS9xMEw2MQ%3D%3D&apiKey=AIzaSyDegLtqP1QIDBqF8AdwiVd62vRla3MY1e0&oobCode=crVJ9U2jP-uGLmjagEykbCJxw1wCv9uNMMN3BtQaYrMAAAGEo46p-w&mode=signIn&lang=ru" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0a3b7127112d04b992f67ff803cd58f00000000020000000000106600000001000020000000808f6ea7cbad51e6b68c40e41cd3222e738eb2730f6f626ad81c0685738f69f5000000000e8000000002000020000000d6c5f6a3cd74219e69c020353cda8a708015aa82ce62b130d04e44d5edde70bf40020000068f688eebb6dc5e228f6d5fa50f2c5387964da165a46da9d9ea83f16fa50b4f1a42ca2d8080e23e3762ec1e06e0faf1fb87997b44020336f5630fce44d463e7de55ac11f0a7d384d7e280a48245cb7e1dab16f3558e6d8bd09f1b8e641466fdc9312950b65d57f489849300a3b18f0331d3501f491d9ed639b498d17280ba2ff8bc6d5584aedd004125d01a54bdce1da267afc2d6fe1af9497502d46ab417b81012804ef7103097d03ba9852d06f0c40e51ddc764a5db6413bf6b6ddbed82b3f3d809c8d4bf12f66c739b93ed426f56b40c63a8915c05e23887431b8ec94982e10a0ba7673c42b1863779a7a4c52209b877b94f31ca14b4b4746d04c274126737f1ed4019ea7d87c59fff4119add3dda9dfc1f87d021e765fe57239baee9c4c7b043a24c3d53722f69533332f93d3a22e8ada4f1b1423370e331c70c80fa29e5b5b06532d4f34c6b2463b18aad85350ddc741391fcbd8aa1412b9ee09bcb27bcb7f1fd17cb394ff5894909fee6b75b668d1958cfe3475093c955f7cbd00cfe985afc3941ecd087b4db68923f665bf95bb7e330f85123f33e64adf3e5fffbd7a8dda60351f2065500c2c9b29297f11bec03693d5c9d88d90dcf2a058b65b9097453fda2fdd0292a75381d511b429f451fd31e8117525fcde519b8b7b55ffcd7db56cb13df987b865901d33ef6b93cf138d6a3a1122a1e8b3790b5ee326c45dfd308d6e5de8cc4a781dd35536773b1b9e207cf7704521282832084ea558c529eac34375b9eff2fd4b6f19abe77e68d32dc871d24fbb10e8219941ebfbcd2c468d40000000f139a5ce288ef5bcfaea13314f37c4a362ed5e7d6b9a12e2f824151dabfeafad29512925c05c1aef8b38ff0f37a0b5da6337a1f93e7c5aea9a1efa7985af8d51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3087906335" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31003069" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3087906335" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0a3b7127112d04b992f67ff803cd58f000000000200000000001066000000010000200000005046feca833e3a6a878041c078ad7bd16d5bdc4c97bcbe22b9df67c76ccc4fa6000000000e800000000200002000000015dcf368d484374be3483684bdffba16dae99aa33e7000d48274df3ba923d9be20000000d9f41ad5b9b6817092ba959637c93e5421bf4f4b492952fe327c4eab8296b47340000000e49b53fdea8fb7907469e3d67fd6b73425d4de60ebc28b478152b6dca1ae2031894bbf7d1b288535f96eef64e5fbddde7f79b3c6842128b5e469cf69d0360884 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3096682115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31003069" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 97b2b1b9bd11d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378008395" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0a3b7127112d04b992f67ff803cd58f00000000020000000000106600000001000020000000fcb54e767cc4ba02c9b5993e0fec559a081fa2a73bc85c40315e32ae4f1a48a7000000000e800000000200002000000090e0709d38de512746c6502028e87e2c685fffb1c89b3bfb76f30f6137ed25ac40020000eb3e03b9b9f07da27cf6933fd4111fce9410bb3cdfc0518bf48a4be6d84e6cebb26dc18ebfaad3644065a13aa26f8022e045ba5eaffed00b000cbd0ae9850f7cd50ad35ec34f288e55eac63962e5026535d6e5db4c487f74abb51aa1f2354a7a7e39bb1eb7ec6968f7e6b922edb62a9af283abf4613abd518da8f9dc6527a187fa6b8766cf42751438175dd259e7aa0804912e2985f091eaa4b1efb89792ff58da6596777b8103109882508814badee7283128a375e029c3558c8394e40a45a2da61d76c4e6135d9698d261d99545da57910683298b83cc8e00daccff77b1fb408cfa8b44aea67b66b7f4755c9b8935e093c9b7e535bd29562c628620c5988a2b78c64bd4be0d701c8e50ef042b90dbbe0ddbc801efb44466ee313c6e861a3bca9818cf9a411f964609652e143053335c24b97b2d00157db5835ffe841a2364a968d794161e7cb3b05885428da7e05c83f2d9dafb1c4c61681206132dee53e3da3528d3e9ee894fac86652ddbe7ed3d53feac620f62b53d18dd2f2fc8323afed7d8fdc6752a900dbf5b0a5d36d53c11f4455366176236072b3d0d732576ba3a1d28ea4128eff22c3e2d70b2924c91a8096f0502960313d109c136b27f31b8c4c0330eb3f60ad56bea5733c1bc4104e84eb7cf2ebd47027098ede2dc8e7f13c0d7e43c97d756190de8d20f159cb62b0fec02bf532e9121f357ba79b3ec5f9a8e284291c2254c694cdcc5b38233bfc0fbbd54de0aff5187f0ee073a4c5d4657800a531c05bea20eda22b1232af3a48c168a172370a8b11f2d51a498a08810b1b0b400000009629c9491ec66669ffb248b6828ba537632029cfa66a2eb7f9da623c75d793386bf8817565592de90cb727a709ab49ad4d6a0591c31f270eef105f6ca4ebb7a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 7283c6b4bd11d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0a3b7127112d04b992f67ff803cd58f000000000200000000001066000000010000200000002c9d59dd03c763937b49e9a5f53b67a96754f402b58685617e3b30e8d0b6f3df000000000e8000000002000020000000d97cbd864bc1888b3a7b86278f37c09e325d3cbfaa2c973203e957c631dc5a1e400200005b21345e927c3c1295c03522f5263d592571b9697f3031056ffa00876022a31623c648bef44083ea79da590b9a3eacb68b917d91cc538056e31908f3ed779d325346e2a7b9ce5f8fc7184265c58f9887f9e9a7ff20146f3485e442a14ed5b8c1f01866ea344b920b0a3661bd0896d8ec1e0ce76cc5e780f9f388a513af57618543635452efbcf20e098c839ae6e1dfa9d5196b4498687f39d87bccef3750a6e27ab705905352989b983020a38341cd28517227a67239507c8d758047eb7643f753cd8ca5c9b56b8606a34c75797c2907710e5d55cf69ac8167b0987de21ddda23faf36e4b934c23ddf6435b1d5a03656ac495e2819dd4d89c997004e0ebc7900405b086c685a9fec1d39ecb78df77d578ab607863c70a5b6b3ed89738fe949af343bda91dc7d402300e05effd1b65e80d1c40c18028c0d98b2fbee7e0c5e7fba1fcf892f7f397a7bfa39060ac61ef8807522fcd24299c13f0dab2f1cd854c8bbea0ec15c23fc58914871b10817252e67be831b727f04a0ec3f166ddd874b9add1f4dbd37be7329c24e2d2d98bba39eec26efae3be987aa050f6344c86ff1c41130f9fe360f76e98d64cfcfab12ea629d7dbfc380fbf75592731218f07830b56a76916c55c3e477a9b3bb43e36d63f9e2596d27e3df0356c9410ada62d779dff6946fcd68f038a21c7ffc82232f8f0e871d30020a87cdd661d8f0977fca263e88df3b4f4e6cb31bd99d18f55af87afb4195bd7bb4bd4e85f223e8e7d802a85616335eeee5be3be72c2dc7bc1293688ddf0ed4451b02be69b9a8948896d9a8d3bb400000005575a2b11555638265962f6f618593299c8339fc89e3d8baa45a14bb8494dcec6f87537631336b8a1a71841d9a45188b9be6b1d5440cdd93f068d23b3a9fcb4b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "378056981" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31003069" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "378024989" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4372 firefox.exe Token: SeDebugPrivilege 4372 firefox.exe Token: SeDebugPrivilege 4372 firefox.exe Token: SeDebugPrivilege 4372 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1796 iexplore.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE 1724 IEXPLORE.EXE 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe 4372 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1724 1796 iexplore.exe 66 PID 1796 wrote to memory of 1724 1796 iexplore.exe 66 PID 1796 wrote to memory of 1724 1796 iexplore.exe 66 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4896 wrote to memory of 4372 4896 firefox.exe 70 PID 4372 wrote to memory of 744 4372 firefox.exe 72 PID 4372 wrote to memory of 744 4372 firefox.exe 72 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4340 4372 firefox.exe 73 PID 4372 wrote to memory of 4228 4372 firefox.exe 74 PID 4372 wrote to memory of 4228 4372 firefox.exe 74 PID 4372 wrote to memory of 4228 4372 firefox.exe 74 PID 4372 wrote to memory of 4228 4372 firefox.exe 74 PID 4372 wrote to memory of 4228 4372 firefox.exe 74 PID 4372 wrote to memory of 4228 4372 firefox.exe 74 PID 4372 wrote to memory of 4228 4372 firefox.exe 74
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://ikoa-cf54f.firebaseapp.com/finishSignUp?cartId=aboqvj1t&linkPP=aHR0cHM6Ly9vay5tZS9xMEw2MQ%3D%3D&apiKey=AIzaSyDegLtqP1QIDBqF8AdwiVd62vRla3MY1e0&oobCode=crVJ9U2jP-uGLmjagEykbCJxw1wCv9uNMMN3BtQaYrMAAAGEo46p-w&mode=signIn&lang=ru1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4372.0.997380416\1590409155" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1544 -prefsLen 1 -prefMapSize 219987 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4372 "\\.\pipe\gecko-crash-server-pipe.4372" 1652 gpu3⤵PID:744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4372.3.819535867\576958227" -childID 1 -isForBrowser -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 156 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4372 "\\.\pipe\gecko-crash-server-pipe.4372" 2344 tab3⤵PID:4340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4372.13.1265300151\489957686" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3500 -prefsLen 6938 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4372 "\\.\pipe\gecko-crash-server-pipe.4372" 3468 tab3⤵PID:4228
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5dff28f86d6e163ffec6b9ecb9d4f5a26
SHA19547379496b2ff6c6f9d67738fa2308add044b49
SHA2566633c7fa10b503c5736e426b9872954a3c87c8b386997ba38e072870e35a8885
SHA51246c4420cbf2e6a7efd218c160737f340a48f6e3c571b4f37fed2fdc9849d5ac8663143ad071244d4c30b16db0811cf65e72ff7e92226039f23ea99b74b8d548f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5ef882f1932c9dd68c8afda2ebc27364b
SHA14593fc073e078220e8d3e5fb6cf205430119c058
SHA2565144288105e9dfc259e9526551a92ff8f2edf2c15f395c4b3948930139bece23
SHA512abed9efc412039e8364507af7c857e2bb88ded864ef4d7754e6b4ea4ea750217954a672efb3a6c663498858e5c7660a33b02891f0f0d2b11a9616bd7c138931c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13
Filesize724B
MD5c2b8d818b9f50cec7f6e36c8339706de
SHA17349d467eb76c1db706505f7b1b06fa630a3c99d
SHA256f130c8e6a09836d838d7273b2c8bac823b3bc3b21d150343ea4b406aa4b399dd
SHA512a2597ab221b44ff5e416788dea012bebf31852f172ff4f1c456fe3760ddf879b30ae812b49de62262c8f7db4ac5b89e423fb17062365721d77907a33c0fe8d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5fb42041f7c3c1dbfe2efd06a34d466e5
SHA100f0a0efd10a2ea5d8d1fcd6277b7b6b809abfb8
SHA25678090f58c822068dbd5e11be070c3550a23d79992dd15d67d8a8e628ac8251c8
SHA512d0408501f828352f0420debcca7a708a375ed4c9e9582119924ee1bc61e8b1dac2f8fd0a1f16cbfe53c9743067a2c48313274120cb218e133f0333bc3020dd34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD525765d95fab3e91f9051ccc08a5e56f9
SHA1997b4e316143b36377bb18b3e22da56b623db456
SHA256ce24efc9305e9585bec95bd93b77fc2979ae0ddcc65ee1f8697e9c2dc28cb5e5
SHA51222e11a39c3dba5c99eef4f1a0ba5ea08ccf7a922d7e9afa0681ae823301e31f49640f04bd59e58da8f937bc8a6707107579b4d8f87d5993af8e5a2bf60c55394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13
Filesize392B
MD55fedf816d3f679467fe82053fa5f8380
SHA15036363fe68f20fb2e86f32df6db9354c6fd280d
SHA256fa7d501fbd89aaa9880547886c252ef8a37b3d6dd427a3232b3545c834c7855e
SHA5121e15d1996b950409a53c285e3b502384fec299661c7ca60f50d8c0b6bf5f3eda5560ea0b8910fe0ab5664e0349d97df946a5e7ec1ca59d5f48dafa7242b970c0
-
Filesize
615B
MD500c534d50916ad8155e9515507883803
SHA1ae389b9630d22b7fe73a6b7468ef0292292fc052
SHA256405bb4f38ec7173a2206f59753597bc064f9463e4de03011b5dd408dbe9c656b
SHA512bd847a10e7ffcdac59e9c1e8e2e778079ce8d3184701be98fe9ff6a6f870d39d910327d9e4b9878c4731c3187f4ad4d34a30d3cbde008711bd84bc03800604da
-
Filesize
615B
MD58736553eb0837a59eb5f7f788e42b333
SHA1e31a3e37a5c6f58c4b3ad1123a656a043911efb9
SHA256d8945ff3b75b9e609864d517e73ecf9ac828d47be53a04bfdcc997072e622f34
SHA512b8c531b00c9a19995951b75f6d4619f0f3120c093555a1c3b9166c636fc60964633ddae9b3f7210effe326b8a17a3f585a04b5c77c61a7d5fe0ee9dfa3316b54