Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14/03/2023, 00:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.amazon.com.au/gp/r.html?C=12A33WSA94F8A&K=Z1HLO6YYZTMD&M=urn:rtn:msg:202303121154213982e8b63b294333bd55956e2250p0fe&R=2VXELGJ5LTWW9&T=C&U=https%3A%2F%2Fwww.amazon.com.au%2Fref%3Dpe_19115062_429591322_TE_logo&H=X4ZHCAZNU2A3DAOGLKVEPSDSJSSA&ref_=pe_19115062_429591322_TE_logo
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
https://www.amazon.com.au/gp/r.html?C=12A33WSA94F8A&K=Z1HLO6YYZTMD&M=urn:rtn:msg:202303121154213982e8b63b294333bd55956e2250p0fe&R=2VXELGJ5LTWW9&T=C&U=https%3A%2F%2Fwww.amazon.com.au%2Fref%3Dpe_19115062_429591322_TE_logo&H=X4ZHCAZNU2A3DAOGLKVEPSDSJSSA&ref_=pe_19115062_429591322_TE_logo
Resource
win10v2004-20230220-en
General
-
Target
https://www.amazon.com.au/gp/r.html?C=12A33WSA94F8A&K=Z1HLO6YYZTMD&M=urn:rtn:msg:202303121154213982e8b63b294333bd55956e2250p0fe&R=2VXELGJ5LTWW9&T=C&U=https%3A%2F%2Fwww.amazon.com.au%2Fref%3Dpe_19115062_429591322_TE_logo&H=X4ZHCAZNU2A3DAOGLKVEPSDSJSSA&ref_=pe_19115062_429591322_TE_logo
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 824 firefox.exe Token: SeDebugPrivilege 824 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 824 firefox.exe 824 firefox.exe 824 firefox.exe 824 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 824 firefox.exe 824 firefox.exe 824 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 2040 wrote to memory of 824 2040 firefox.exe 28 PID 824 wrote to memory of 1680 824 firefox.exe 29 PID 824 wrote to memory of 1680 824 firefox.exe 29 PID 824 wrote to memory of 1680 824 firefox.exe 29 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 2036 824 firefox.exe 30 PID 824 wrote to memory of 1620 824 firefox.exe 31 PID 824 wrote to memory of 1620 824 firefox.exe 31 PID 824 wrote to memory of 1620 824 firefox.exe 31 PID 824 wrote to memory of 1620 824 firefox.exe 31 PID 824 wrote to memory of 1620 824 firefox.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.amazon.com.au/gp/r.html?C=12A33WSA94F8A&K=Z1HLO6YYZTMD&M=urn:rtn:msg:202303121154213982e8b63b294333bd55956e2250p0fe&R=2VXELGJ5LTWW9&T=C&U=https%3A%2F%2Fwww.amazon.com.au%2Fref%3Dpe_19115062_429591322_TE_logo&H=X4ZHCAZNU2A3DAOGLKVEPSDSJSSA&ref_=pe_19115062_429591322_TE_logo1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.amazon.com.au/gp/r.html?C=12A33WSA94F8A&K=Z1HLO6YYZTMD&M=urn:rtn:msg:202303121154213982e8b63b294333bd55956e2250p0fe&R=2VXELGJ5LTWW9&T=C&U=https%3A%2F%2Fwww.amazon.com.au%2Fref%3Dpe_19115062_429591322_TE_logo&H=X4ZHCAZNU2A3DAOGLKVEPSDSJSSA&ref_=pe_19115062_429591322_TE_logo2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.0.245308185\211620182" -parentBuildID 20221007134813 -prefsHandle 1184 -prefMapHandle 1176 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85fb7170-8179-41f3-9793-43e8808c3df9} 824 "\\.\pipe\gecko-crash-server-pipe.824" 1272 f217158 gpu3⤵PID:1680
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.1.138708923\1505951354" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18d8f176-92e4-49d5-9e29-952cbed3ddfa} 824 "\\.\pipe\gecko-crash-server-pipe.824" 1476 e75c58 socket3⤵PID:2036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.2.1132702495\868541557" -childID 1 -isForBrowser -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 21834 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b201adfb-d62e-4da9-81b6-1a950c6bc30c} 824 "\\.\pipe\gecko-crash-server-pipe.824" 1896 1a29c558 tab3⤵PID:1620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.3.1665518547\1499263079" -childID 2 -isForBrowser -prefsHandle 2728 -prefMapHandle 2724 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be0543c-46ff-4588-a8e9-063b153122f3} 824 "\\.\pipe\gecko-crash-server-pipe.824" 2740 1b747b58 tab3⤵PID:1140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.4.838602363\1226482433" -childID 3 -isForBrowser -prefsHandle 3464 -prefMapHandle 3468 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {898b90f3-6e5a-4b18-b4b9-105009c5999a} 824 "\\.\pipe\gecko-crash-server-pipe.824" 3248 1d46c458 tab3⤵PID:2280
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.5.504605020\165325935" -childID 4 -isForBrowser -prefsHandle 3580 -prefMapHandle 3584 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe729b2e-d7ef-4259-8d8d-39ef02290c4e} 824 "\\.\pipe\gecko-crash-server-pipe.824" 3568 1d46e858 tab3⤵PID:2288
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="824.6.1174845261\338790873" -childID 5 -isForBrowser -prefsHandle 3744 -prefMapHandle 3748 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 876 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ec9093e-936b-421c-8f64-aa4eb59bde89} 824 "\\.\pipe\gecko-crash-server-pipe.824" 3732 1d46d658 tab3⤵PID:2304
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\841yyxv3.default-release\activity-stream.discovery_stream.json.tmp
Filesize148KB
MD5ed0185198805f8ca8678c6e915e2ab0b
SHA1b3a9824a4f490ba3f8bc9465e761609adb9508f0
SHA256bae61212492d009e454fcd8c81153c8996662d171ac719fff38bb4707cf11f5f
SHA5122b44441c1383ebf3164f968b5847c2c11f0e88c2cafcc06b73afa01bf0b04a37f643a7daf95f883e582f9ae387e86d85fddeae5f66515dd8b14ca8684d18179c
-
Filesize
6KB
MD5af5e0d0f83969aaeb4fa6e78d6f95a24
SHA12bd8d80e93e21ac00bcd76ace582b012c30a7e66
SHA256ea920c40489f3fe7fc1e02d86070da051c38ac5ef6950a15955116f7bf2e0891
SHA5127124e5e077ff990e53c23f8b4c87ccb485ea2f7e28b1e465846aa2f1b4190fc1ccd905a8a2d10b7c7373f0bb5e4a4f0b37da769e5fb877099b61201fbed50b52
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\sessionstore-backups\recovery.jsonlz4
Filesize937B
MD5eb9d1cbbc336f05cfd61ddabf5194647
SHA1c7e9d0f821c32f2747a473b8362e216f679e4cbb
SHA256a1f41f7acfba27e724cfdd354e9c6b0dea6ab8266812f71ce52d558ac355afa6
SHA512acc3f24e0170d7955c5e7465fc1c434d551b0fbdede38a80f4e706b973716aa8db8b702d9e0289a3f5082fb6024d0862b59ae0ccfad8b5f12191a20308451d8a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD52a48c93f6e80d3db2dbb31544e1772ee
SHA19bece495f40849902266b2074287b1390c66563f
SHA25684148e2e5162bb191feb358bad138ed7eeac5d059ce8bf29ade690359218416e
SHA5121dff93d2b80db14e1acf5b43524598554dc3a75fd73e668c550a62d66dd59b3eeb657d06a1f8344765bdf6dab230c83fe894a0f9e416ea2c7392ec254833c009