Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 16:12
Static task
static1
General
-
Target
☎️_▶_🔘───────_Fraserhealth_Voice-Attchment.919-340-XXXX.wav_.html
-
Size
263B
-
MD5
a39e4e3b9e3f0ad84b795eb04bac2a21
-
SHA1
c5151306e5ab5bc66b08f714a24dcf5e885a63e7
-
SHA256
48bf7f2dc623f8387c567420c029eebcb1c90a501e07145b997d8d96f80b7189
-
SHA512
4aae23b99e6443d4d9432a114aebf9d8b1aa04e5d2937e622929282486f95de69bc04a4c31f97d6be281d782af1d7c957fc73623cc3dded37be41555ea7017c7
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exesvchost.exedescription pid process Token: SeDebugPrivilege 748 firefox.exe Token: SeDebugPrivilege 748 firefox.exe Token: SeManageVolumePrivilege 1548 svchost.exe Token: SeDebugPrivilege 748 firefox.exe Token: SeDebugPrivilege 748 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 748 firefox.exe 748 firefox.exe 748 firefox.exe 748 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 748 firefox.exe 748 firefox.exe 748 firefox.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
firefox.exepid process 748 firefox.exe 748 firefox.exe 748 firefox.exe 748 firefox.exe 748 firefox.exe 748 firefox.exe 748 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 4196 wrote to memory of 748 4196 firefox.exe firefox.exe PID 748 wrote to memory of 4884 748 firefox.exe firefox.exe PID 748 wrote to memory of 4884 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3588 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe PID 748 wrote to memory of 3412 748 firefox.exe firefox.exe
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\AppData\Local\Temp\☎️_▶_🔘───────_Fraserhealth_Voice-Attchment.919-340-XXXX.wav_.html1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\AppData\Local\Temp\☎️_▶_🔘───────_Fraserhealth_Voice-Attchment.919-340-XXXX.wav_.html2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.0.558206576\1512059205" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 748 "\\.\pipe\gecko-crash-server-pipe.748" 1800 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.3.771797527\602494850" -childID 1 -isForBrowser -prefsHandle 2516 -prefMapHandle 2512 -prefsLen 112 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 748 "\\.\pipe\gecko-crash-server-pipe.748" 2524 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.13.557178360\1787065527" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 897 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 748 "\\.\pipe\gecko-crash-server-pipe.748" 3432 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.20.642855229\1320800620" -childID 3 -isForBrowser -prefsHandle 3972 -prefMapHandle 3968 -prefsLen 6894 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 748 "\\.\pipe\gecko-crash-server-pipe.748" 3980 tab3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken