Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2023 18:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://router.charmelite.ru
Resource
win10v2004-20230915-en
General
-
Target
http://router.charmelite.ru
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5024 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 4900 wrote to memory of 5024 4900 firefox.exe 44 PID 5024 wrote to memory of 4856 5024 firefox.exe 87 PID 5024 wrote to memory of 4856 5024 firefox.exe 87 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 1152 5024 firefox.exe 88 PID 5024 wrote to memory of 3432 5024 firefox.exe 89 PID 5024 wrote to memory of 3432 5024 firefox.exe 89 PID 5024 wrote to memory of 3432 5024 firefox.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://router.charmelite.ru1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.0.1786778171\1104624267" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90468006-d773-421f-811b-d4fb5c69072b} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 1960 287a12d5358 gpu2⤵PID:4856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.1.605583135\420319945" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a83c4673-c9cc-4e19-94d9-e87343517d54} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 2392 28794871f58 socket2⤵PID:1152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.2.818484879\1998812818" -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 3088 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cb0c0ea-b171-4cba-b36c-395c2322acab} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 3104 287a52e1858 tab2⤵PID:3432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.3.1137918404\647524146" -childID 2 -isForBrowser -prefsHandle 3860 -prefMapHandle 3856 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a42b6be-7ac4-4fa0-8590-7baf56f13ec2} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 3872 28794867b58 tab2⤵PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.4.1791732065\1377711916" -childID 3 -isForBrowser -prefsHandle 4920 -prefMapHandle 4912 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae34b3de-fc54-464e-bc67-bd60d818de90} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 4928 287a719da58 tab2⤵PID:1908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.6.1806588142\739274182" -childID 5 -isForBrowser -prefsHandle 5308 -prefMapHandle 5312 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87a1d4aa-e1e7-434c-9400-0fac5c2df4fb} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 5212 287a75fee58 tab2⤵PID:4692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5024.5.1611429888\319858188" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a37453-e309-459d-b1b6-7ce5e03afff8} 5024 "\\.\pipe\gecko-crash-server-pipe.5024" 4960 287a75fc758 tab2⤵PID:1840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://router.charmelite.ru"1⤵
- Suspicious use of WriteProcessMemory
PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\activity-stream.discovery_stream.json.tmp
Filesize22KB
MD520999f4b077a80c85948875d8e417304
SHA1f8f4ce3ceb609237bf0eb8d9247af81c4d9b9713
SHA25676217b39dd422a35f8f18150f23573ac3fddc8b80eea620ae48e360a54b98f85
SHA5126b14d823066e698fe68171b118972103200e37479d1aefef950f7d78a2895a01044d843ca4455441c73ef033409d760ce6f9d21e7653752ca6e9e9d78e93f721
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\cache2\entries\58A756A796A86993036E1F0F79183245EE2ABF58
Filesize13KB
MD58408b3ff38f4570fe3890a1acc0a96c2
SHA1edf20e9616d1852c91d8f8f9de3f679cf53d7206
SHA256830a2e1f1b280c2004aa1d698ea486153bb2a2073a8ecb01f493b03bcab98899
SHA512b670910d8b1013a2cd5583462749c8e93ffe76f2bf57401c127256e335070458f591b0e216d77930021e1e4284ecee81318783a610abdfa73897d704162e9de3
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
8KB
MD5efa7848f0f12b4db6645be3abd000c44
SHA118a7fc7ce768317f3d6991f00b1f29393e050956
SHA256e4bdf513f3a8547fbe0d1d67d997bfe0d2dc52d6a41683f5e07a04fca7bb54f0
SHA5128b45648db22607c340d56ed1d941571a4c5b57b413bf757dd34d0eb46305682fe8f4aa0c417a93d18e308af6f21b187c068c206a24be57d96969dea4d6410767
-
Filesize
6KB
MD5dcd8f8799de8dc47fd9e79151cdc186c
SHA153ebb97fc27dc8ce6939a6e39db6d331a68b47ca
SHA256a5b8778e533bb1bff0ae6db2eed5fd7826f043d0b5b70f7c2c85a55fa834acff
SHA512517363cc0014a2e1d94ae110067bb62c06aeee44559a086f0b1962c468aa0a11b4c62e48737efa965e6b1172395c6c38b48b141a60ebef0a84b5687500c4ba7f
-
Filesize
6KB
MD5f385966395dccc7b9eb72ae2550bd236
SHA10472fb8bece19b69122746dbb8165684cfa6a91a
SHA256413e2fdd1a8a1713510d563e3169dae461937870f130df59406ffbc646af2804
SHA5127724f6666f55f5bcee9f4dfd62f254c1807eb8aeb82c86bfe6acbd7d51f917ed1a1cafa7ad58a8e5e6521d9df1fd9e58e32022cde3a4ca88f6cc0c9bf111a081
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\sessionstore-backups\recovery.jsonlz4
Filesize990B
MD5162fc6ad9244e8a97c5779a2a049abc1
SHA1daf6fa4e4d9b98a5e4117a0067ad42edf7791d43
SHA256ab26b574c3c616d55296342ac62760a592e8b068eb03a7375476cd195601795f
SHA512a96cfb76861f4dbeee1e498a83141889da73b01f740d118c7048e79acf4bd96092d6bee4c658241e6177a4a83cfcf7491230fca78078f85466c701eb9ff872ea
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b7jtu2fw.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5cd23c731bd5572182f67e4faf15525d8
SHA1bbec5e360a7889e238a985799650d7cacce58509
SHA2567745450b08e5e6bcd9dc85fde8174778e8e6d3c3ff511ffd64bd3b1117db2c59
SHA512af387ee0a7320d653c6b0a139ed1619b85f743c07107bafb9f23b7d8e07b522bca834eff61d3af261f6ec9ce9c87d59e2207ea46a6e4bf6445539e949b8dde96