Resubmissions
09/08/2023, 01:24
230809-bsqwesab6z109/08/2023, 00:23
230809-app92saa4w109/08/2023, 00:13
230809-ah91waaa2y1Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2023, 00:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://x8b29c273nrymtb4mpvp.8kih.ru/z4ku6/
Resource
win10v2004-20230703-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target https://x8b29c273nrymtb4mpvp.8kih.ru/z4ku6/
- Sample230809-ah91waaa2y
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1732 firefox.exe Token: SeDebugPrivilege 1732 firefox.exe Token: SeDebugPrivilege 1732 firefox.exe Token: SeDebugPrivilege 1732 firefox.exe Token: SeDebugPrivilege 1732 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1732 firefox.exe 1732 firefox.exe 1732 firefox.exe 1732 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1732 firefox.exe 1732 firefox.exe 1732 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1732 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 536 wrote to memory of 1732 536 firefox.exe 83 PID 1732 wrote to memory of 4544 1732 firefox.exe 84 PID 1732 wrote to memory of 4544 1732 firefox.exe 84 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 3304 1732 firefox.exe 85 PID 1732 wrote to memory of 1436 1732 firefox.exe 86 PID 1732 wrote to memory of 1436 1732 firefox.exe 86 PID 1732 wrote to memory of 1436 1732 firefox.exe 86
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://x8b29c273nrymtb4mpvp.8kih.ru/z4ku6/"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://x8b29c273nrymtb4mpvp.8kih.ru/z4ku6/2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.0.1067591343\1299897124" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1864 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fc4d276-da47-4fbf-9a16-c2cd364037c2} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 1988 1c1fa1d0558 gpu3⤵PID:4544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.1.991402258\129095043" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2539900-a019-4f7b-bcda-403f56c84605} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 2416 1c1f9941758 socket3⤵PID:3304
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.2.967194081\1868458166" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 3032 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4588687d-a652-4e9c-b742-ec41b6ed773d} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 3160 1c1fdbec758 tab3⤵PID:1436
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.3.407789257\609044585" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f69634d1-4a77-4229-9ef2-4a61e28abe55} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 3648 1c1fef1c958 tab3⤵PID:2556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.5.877967878\394747875" -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a87061b-9660-40d6-956f-fa2e83703d95} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 5140 1c200243e58 tab3⤵PID:1952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.6.2030455132\581607146" -childID 5 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e904c27a-d107-4cb8-8f33-9187e5f96008} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 5228 1c200256858 tab3⤵PID:1048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.4.217168315\418664981" -childID 3 -isForBrowser -prefsHandle 4992 -prefMapHandle 4988 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {349a5e15-8ef1-4421-9af4-e0f1ab33e459} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 5004 1c200242058 tab3⤵PID:4456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1732.7.637866515\699866357" -childID 6 -isForBrowser -prefsHandle 5792 -prefMapHandle 5788 -prefsLen 26752 -prefMapSize 232675 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe6163e-c59f-4357-b9b5-62f596f73f12} 1732 "\\.\pipe\gecko-crash-server-pipe.1732" 5804 1c200118858 tab3⤵PID:656
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ezoxz0hs.default-release\activity-stream.discovery_stream.json.tmp
- Size 142KB
- SHA256 402b3d0daecfd0061af1504e294b0495a6f236e60323e6d19a55170d38473cfa
- MD5 d85f176fee8f7b2961f7970807ebad1b
- SHA1 a33733eee834c133d9834ff96ebde1b9b28b8ef6
- SHA512 8ae5645ac7ddfe699a800086ece67faf1175ad9d8612932c3090cef44858a0371ddbee7d7a1b4249c1d03b4a3e572cb330779beee2f062782f65f001e5156432
- SSDEEP 3072:4oHG3HCpFKCrF8cqCPCjehxokaCX1G7cWc/:4oFH8cHFucWc/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ezoxz0hs.default-release\prefs-1.js
- Size 6KB
- SHA256 d7a32e49b8c49aabf357c7bd9c2e14fb74f74fe89ef5323b2b699946839ddf58
- MD5 186b94ec5a8b13cbb69a0b168c9294aa
- SHA1 6f9e86b12b7033b9d407d65f228bf408a0d34835
- SHA512 4097587d57a7e27e36a8ce13c1fe2bd88e6eba3fe488d5e9e43fe81c0c67f4c95a51a11ca32aa15de6c816952e9c50b9b299fe4ca154fd88ff1ffef28fb953bc
- SSDEEP 96:xHi5nUTUL8qGq4deuJeOTzSXPXAnpjXHSzPVcBw8HPkv:k5n7R4deuJelPXIyGBw8Hsv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ezoxz0hs.default-release\prefs-1.js
- Size 7KB
- SHA256 24c57525a307926471e4008349fa1eb0916e035b4db7357edc3ac3e40844fdf1
- MD5 0ae53d90e193fee11301d4ccec056b22
- SHA1 8d6cda1156003238bbba91c289e51d564d4126c1
- SHA512 3e80fda1cd9044320d106a8f1fffe644c7c92dbe393709835f4021c334f6d8976fa53e450378ce6bd96daf8e61dc8a257ac744b1cd4e5f1b17a8fc098e4b42d6
- SSDEEP 96:xHihnUTUL8qGq4deuJeOTzSXPXAnpjXHSzPVcBw8HPqv:khn7R4deuJelPXIyGBw8HCv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ezoxz0hs.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 0c6928f84010dd23bc9e756f049c5971acd8d6f7de4a8b479dc78563433cbc7a
- MD5 d0862fab07fa8d433934870b70d4ff53
- SHA1 25c6cfdb55cd719ebde06c08c9abe7b930910e57
- SHA512 0cdfb668f5cee81b9a0872d3dd67d82c20c7d18f8cb689ab15ab882ab14c639cb76bb9972cffa57534b58473effed84c0bf298f25b35f1034b4e51e90bc75d15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ezoxz0hs.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 d90fb0e152a2d7a89996a63fd532dd77316305f020b5bd07492be6ff423f97b5
- MD5 ec60eb3698576e4da31fb082b72ad726
- SHA1 b98ef8c894b90870bc87e4f9e04b1edc241dad74
- SHA512 b0a3cb3e1818e4d838f5cb4c21adfd8eb362615b9f64beb07f50df696fcedbf3802d12b6d1cbba4f83e542337345d9ee9b3629bc8d5b90e8288470fe91b65aea
- MD5 SHA1 SHA512