hxxps://code[.]jquery[.]com/jquery-3[.]6[.]0[.]min[.]js

Analysis

max time kernel
25s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://code.jquery.com/jquery-3.6.0.min.js

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	firefox.exe
Token: SeDebugPrivilege	2212	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2212	firefox.exe
2212	firefox.exe
2212	firefox.exe
2212	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2212	firefox.exe
2212	firefox.exe
2212	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2212	firefox.exe
2212	firefox.exe
2212	firefox.exe
2212	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 4416 wrote to memory of 2212	4416	firefox.exe	92
PID 2212 wrote to memory of 3708	2212	firefox.exe	93
PID 2212 wrote to memory of 3708	2212	firefox.exe	93
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 3900	2212	firefox.exe	94
PID 2212 wrote to memory of 4368	2212	firefox.exe	95
PID 2212 wrote to memory of 4368	2212	firefox.exe	95
PID 2212 wrote to memory of 4368	2212	firefox.exe	95

C:\Windows\system32\wscript.exe
wscript.exe https://code.jquery.com/jquery-3.6.0.min.js
1⤵
PID:2628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.0.503954171\1482090409" -parentBuildID 20221007134813 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c197411-8ef1-4254-aa22-be0e7d80f619} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 1996 16344acd058 gpu
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.1.1657224349\1871251433" -parentBuildID 20221007134813 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 20896 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac3d7751-39db-41a0-aed0-20582f6a70b0} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 2412 16338170d58 socket
    3⤵
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.2.53298443\695406951" -childID 1 -isForBrowser -prefsHandle 3340 -prefMapHandle 3336 -prefsLen 20999 -prefMapSize 232645 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74fcb938-1582-47ef-a917-484c630102aa} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 3108 16348aab958 tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.3.1561677474\512589871" -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 3620 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7798752c-04d7-47e1-a3a5-55f552b0b4fd} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 3632 16338162258 tab
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.4.2107069196\1267527417" -childID 3 -isForBrowser -prefsHandle 4100 -prefMapHandle 4092 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {311d072e-55c6-4424-bf9e-7d73dda50384} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 3540 16349c43758 tab
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.5.716509048\1472412908" -childID 4 -isForBrowser -prefsHandle 5072 -prefMapHandle 5056 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a636a298-5b31-474e-9d5e-a2a062e706c8} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 5076 1634aa41a58 tab
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.7.872109261\51946155" -childID 6 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e996ad3-648b-45bc-a6db-b0dc05e75157} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 5356 1634aa43e58 tab
    3⤵
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2212.6.655868375\1757279596" -childID 5 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf6764ed-c4eb-46d3-9500-598ffef0c7be} 2212 "\\.\pipe\gecko-crash-server-pipe.2212" 5164 1634aa40b58 tab
    3⤵
    PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\05ypapi5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
138KB

MD5
6df19d473e2abf2c9fff123b98af44ca

SHA1
7bc4173b210d9acec15177ced348d257858bb0c4

SHA256
9f3ece8026b9265b8c52e2daee28c1f48a671e108e24e5560dde2356a5baa3a6

SHA512
7bc6c3d443078d8f49dccdee7647e557fb554008ffb50cc65cc1df803eb3174ece326c521ff50814f7f2bfd18a471fc343fe3c6b09264b9164a09afd403ee3d6

Download Submit