2ef69f36d3a99e423ae6b8de52168fd26656d0c274845270000b013043daac7e

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mmc-stable-windows.zip
Size

13.4MB
MD5

45373f75c382eca0c44cba6915d7f6b7
SHA1

34ed4532d48a8d58bb845f5c6a5927aaa260fab9
SHA256

2ef69f36d3a99e423ae6b8de52168fd26656d0c274845270000b013043daac7e
SHA512

34d27b7cc81f8f2ac4ff73c340e608f32dc8af16c899b17018c40305fd1cf1d7b75264f9b9a4ec79a1b74836eeea872bed25a99a7e57a2c5445b2cb7fa3aa1f8
SSDEEP

196608:9Zkgd/mcKTMG3GS6iw+7WLqB8114REWkcJXTkHAhWsWxCNqm567aQvsLB0Sqdpfz:Ay/mqG3GVinAqB818h6H/xRm56Wh9+V

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\mmc-stable-windows-1.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: 33	2536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2536	AUDIODG.EXE
Token: 33	2536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2536	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
852	firefox.exe
852	firefox.exe
852	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
852	firefox.exe
852	firefox.exe
852	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 1488 wrote to memory of 852	1488	firefox.exe	29
PID 852 wrote to memory of 1448	852	firefox.exe	31
PID 852 wrote to memory of 1448	852	firefox.exe	31
PID 852 wrote to memory of 1448	852	firefox.exe	31
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1652	852	firefox.exe	32
PID 852 wrote to memory of 1928	852	firefox.exe	33
PID 852 wrote to memory of 1928	852	firefox.exe	33
PID 852 wrote to memory of 1928	852	firefox.exe	33
PID 852 wrote to memory of 1928	852	firefox.exe	33
PID 852 wrote to memory of 1928	852	firefox.exe	33
PID 852 wrote to memory of 1928	852	firefox.exe	33
PID 852 wrote to memory of 1928	852	firefox.exe	33

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\mmc-stable-windows.zip
1⤵
PID:952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="852.0.1768169559\1115075827" -parentBuildID 20200403170909 -prefsHandle 1172 -prefMapHandle 1164 -prefsLen 1 -prefMapSize 219933 -appdir "C:\Program Files\Mozilla Firefox\browser" - 852 "\\.\pipe\gecko-crash-server-pipe.852" 1256 gpu
    3⤵
    PID:1448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="852.3.745460934\1920400097" -childID 1 -isForBrowser -prefsHandle 1584 -prefMapHandle 1576 -prefsLen 156 -prefMapSize 219933 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 852 "\\.\pipe\gecko-crash-server-pipe.852" 1556 tab
    3⤵
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="852.13.2062427168\818970426" -childID 2 -isForBrowser -prefsHandle 2608 -prefMapHandle 2604 -prefsLen 6938 -prefMapSize 219933 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 852 "\\.\pipe\gecko-crash-server-pipe.852" 2620 tab
    3⤵
    PID:1928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x580
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads