Overview
overview
8Static
static
1firefox/br...org.js
windows10-1703-x64
8firefox/crashreporter
windows10-1703-x64
1firefox/de...efs.js
windows10-1703-x64
1firefox/firefox
windows10-1703-x64
1firefox/firefox-bin
windows10-1703-x64
1firefox/gm...key.so
windows10-1703-x64
3firefox/li...iv3.so
windows10-1703-x64
3firefox/li...rts.so
windows10-1703-x64
3firefox/li...ibs.so
windows10-1703-x64
3firefox/li...dec.so
windows10-1703-x64
3firefox/li...til.so
windows10-1703-x64
3firefox/libmozgtk.so
windows10-1703-x64
3firefox/li...box.so
windows10-1703-x64
3firefox/li...te3.so
windows10-1703-x64
3firefox/li...and.so
windows10-1703-x64
3firefox/libnspr4.so
windows10-1703-x64
3firefox/libnss3.so
windows10-1703-x64
3firefox/libnssckbi.so
windows10-1703-x64
3firefox/li...il3.so
windows10-1703-x64
3firefox/libplc4.so
windows10-1703-x64
3firefox/libplds4.so
windows10-1703-x64
3firefox/libsmime3.so
windows10-1703-x64
3firefox/li...kn3.so
windows10-1703-x64
3firefox/libssl3.so
windows10-1703-x64
3firefox/libxul.so
windows10-1703-x64
3firefox/mi...alyzer
windows10-1703-x64
1firefox/pingsender
windows10-1703-x64
1firefox/pl...tainer
windows10-1703-x64
1firefox/updater
windows10-1703-x64
1Analysis
-
max time kernel
366s -
max time network
1578s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
17-04-2023 23:47
Static task
static1
Behavioral task
behavioral1
Sample
firefox/browser/features/[email protected]
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
firefox/crashreporter
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
firefox/defaults/pref/channel-prefs.js
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
firefox/firefox
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
firefox/firefox-bin
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
firefox/gmp-clearkey/0.1/libclearkey.so
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
firefox/libfreeblpriv3.so
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
firefox/libipcclientcerts.so
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
firefox/liblgpllibs.so
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
firefox/libmozavcodec.so
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
firefox/libmozavutil.so
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
firefox/libmozgtk.so
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
firefox/libmozsandbox.so
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
firefox/libmozsqlite3.so
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
firefox/libmozwayland.so
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
firefox/libnspr4.so
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
firefox/libnss3.so
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
firefox/libnssckbi.so
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
firefox/libnssutil3.so
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
firefox/libplc4.so
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
firefox/libplds4.so
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
firefox/libsmime3.so
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
firefox/libsoftokn3.so
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
firefox/libssl3.so
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
firefox/libxul.so
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
firefox/minidump-analyzer
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
firefox/pingsender
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
firefox/plugin-container
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
firefox/updater
Resource
win10-20230220-en
General
-
Target
firefox/libfreeblpriv3.so
-
Size
802KB
-
MD5
6dc34556bdb1e7721b1525af59ef59e5
-
SHA1
b7729576bf4ee9c47f7fece06d5f65d1563386c4
-
SHA256
7325e595a7dfe5d6bd461dbe55f423bc17490eaec691c77cf2115fe96cafe80e
-
SHA512
ceaaf940a7b6e7ea83ae300710234cd1a4f066555cf3839649be631d4eb0cd7bb8b5db233be4108c49798fbdaf4424853f7422ef711c4ad89947c5f79c582238
-
SSDEEP
12288:PWN19C+h7voqgHj9zEk+UNx8li1MrHi1AGClhIx2CBU2Zl8qnhY:PW447v/Y9gAMrHjZhIxra2I+hY
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2464 OpenWith.exe