hxxps://descarga[.]pw/como-descargar-e-instalar-clip-studio-paint-ex-1-12-0-2022-%F0%9F%91%8D-gratis-para-pc-windows/

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://descarga.pw/como-descargar-e-instalar-clip-studio-paint-ex-1-12-0-2022-%F0%9F%91%8D-gratis-para-pc-windows/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	firefox.exe
Token: SeDebugPrivilege	1736	firefox.exe
Token: SeDebugPrivilege	1736	firefox.exe
Token: SeDebugPrivilege	1736	firefox.exe
Token: SeDebugPrivilege	1736	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1736	firefox.exe
1736	firefox.exe
1736	firefox.exe
1736	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1736	firefox.exe
1736	firefox.exe
1736	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 2232 wrote to memory of 1736	2232	firefox.exe	83
PID 1736 wrote to memory of 316	1736	firefox.exe	84
PID 1736 wrote to memory of 316	1736	firefox.exe	84
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 224	1736	firefox.exe	85
PID 1736 wrote to memory of 3048	1736	firefox.exe	86
PID 1736 wrote to memory of 3048	1736	firefox.exe	86
PID 1736 wrote to memory of 3048	1736	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://descarga.pw/como-descargar-e-instalar-clip-studio-paint-ex-1-12-0-2022-%F0%9F%91%8D-gratis-para-pc-windows/
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://descarga.pw/como-descargar-e-instalar-clip-studio-paint-ex-1-12-0-2022-%F0%9F%91%8D-gratis-para-pc-windows/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.0.1448836430\1137801304" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {285671c3-c89a-4c92-8319-091bd5f8810d} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 1932 19f428e3258 gpu
    3⤵
    PID:316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.1.428523124\110187181" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {297fc274-6863-46ea-a6ac-3aff943e97f3} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 2440 19f35972958 socket
    3⤵
    PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.2.785721793\1619723626" -childID 1 -isForBrowser -prefsHandle 3236 -prefMapHandle 3212 -prefsLen 21789 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e1bed7b-1641-4ee9-a84d-2be436535db4} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 3248 19f467e2158 tab
    3⤵
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.3.1955263230\1807833399" -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2ed2a9b-780d-47a7-a1a2-2b8c441328fc} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 4028 19f35963b58 tab
    3⤵
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.4.1482673718\155097197" -childID 3 -isForBrowser -prefsHandle 4708 -prefMapHandle 4728 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b87816e0-09fe-4daf-85b8-44040f3617e4} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 4748 19f48ea7b58 tab
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.6.1253055956\432166226" -childID 5 -isForBrowser -prefsHandle 5032 -prefMapHandle 5048 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {645bf8c1-5865-4528-897a-0167b4091624} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 4712 19f4910bc58 tab
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.5.863433179\905687701" -childID 4 -isForBrowser -prefsHandle 4732 -prefMapHandle 4152 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b751d7d-987f-426b-a98e-b51c7dad224b} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 4712 19f4910a758 tab
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.8.276699954\360747548" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5508 -prefMapHandle 5504 -prefsLen 26578 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9768a717-44a0-41fd-b512-ac4765a77241} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 5592 19f49b20258 utility
    3⤵
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.7.1389101021\2066822225" -parentBuildID 20221007134813 -prefsHandle 5440 -prefMapHandle 4732 -prefsLen 26578 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ad337d5-97af-4765-bf2f-b89c0a1d2fdf} 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 5484 19f49b59658 rdd
    3⤵
    PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
146KB

MD5
5010a94cce082f51057a5d0472e3a632

SHA1
e17bcbdac93f9854591ffdedec07d48db07cdd3c

SHA256
3bad5046d4de2d42c043b9886bf61b715fc7319cf72fe21cf519af473d5c1ac9

SHA512
43a055ebc1971478cb5b268e870e03fc593532d36f7dd57007f1b76abc7a33a6919c41ce6f8b2e0d4df59bfbda86c4a8219077c45e3ac7ba7f3bf396472fbb6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
2a5012edaf5dcb0f6570ea910abb1881

SHA1
3e1a43f399c1e3b0a3a203511acc4a8fd3fde347

SHA256
33d06a16341c04a8820a1baa7f9c9beb7dd00848f254ad9418cc941ffabc74fc

SHA512
56311a892a21ed08651be5150abb4d08f7f34815bac42608f3edaa7e2e2c84c9969961f8fda14b7fce9f37777f0b84a755bc6ac7b3d5e8ed5070e7b210f69df3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
777dfeadc0fc341e3c765461e5a907e4

SHA1
c4c551b0aacfc81e3f8c752dfef19aca5b4e2727

SHA256
e8ffd9e409c60c914b5ee1fc8af994fd28b435f279f74c31519d7feee4caddb7

SHA512
4f1edbac03438239ff9ed419e2392e233c1ccfd1cacfe119120aecb462b95517b62610c8ec5755f27df2acb7041a80a16e0adfef88ec1a68191c907f6922a353

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
d092ed6e0c209934842b566ea003bf8a

SHA1
828580c9e1f1860e8c814f9381dc0dda5e1a4947

SHA256
212539a9998c399c3314a08cb87a318e8e5b3638a4e3f5d4bd62dc631bdd88b2

SHA512
556529a43e66a562e0068d13b06307132063d989a747989146d1141a65695775f58817d506cdcb941047d112b6aac2e8d78a4ab58232ecacd62e2a7b0fcff365

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
d15906f7f8d519cfecf1da2b47fdb6fc

SHA1
54e7b9e9a58c616e92f48356ad98925c14b24af4

SHA256
7450c3376bd3b7f04265259e17a9ac1312a4770c2a8772dd23ff3b89b98fe98e

SHA512
e1a730ebb725b4ca63430ba3918bf657eeb509fae847c2dc6a74b016e610c8821c72ad48a88e23ff57f799211065461e2caa29955b77e549c6c0cfe8024f73fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
2b9e09e95be3c152c5b77b964020db80

SHA1
90ffcb186d1ea6dd07224bb0b5370da67d36df09

SHA256
b82e2b30a3fbf619dfd892c14e17adef40bf1d126ada8deb8c61da68bd245a51

SHA512
45e9a830cfc3ce7464ee8965cc05e78495f02155285de70972ba7b42e3eef03b31f05aa658cb798ae5d90d6e48df68a369cf730e9d1ab75005636dd379d8cc1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
476c3371b33b7e48455ee15b9b49fc4a

SHA1
69e791a18589f50eaa3e2a21225b1cebf06cfa08

SHA256
1cec27ee748a4baa919dcac5ca5da60ca44113f85b4ae8493df77091c3fa0d27

SHA512
51d1abe1890dfe195311e279c5ca66ee45a38cbac4026cd56f3093c261a218e24aa00f8c04d19f4e14988aa439ff522fa6f2591fae0410d10ef85886191b1862

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
12fbddead3c89266d2c3c85ee890bd95

SHA1
4608735aab455cbc6623c7747fb95b1655ee5e6a

SHA256
2ab7c51b084215fa795273b2cce0352d0e6d9119a521941dd11d9842b99b9be7

SHA512
b036d1ef814707276d5fbedccb33c1411ad069f73696bd3d43d23648ca7f9578f74c3028104039612fe5b67ea4e48f810f723a0663d3f899d103f0737a83a06e

Download Submit