Analysis
- max time kernel
30s - max time network
32s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system - submitted
22/11/2023, 08:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://seeton.pro
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
30 seconds
General
- Target https://seeton.pro
- Sample231122-kcf6qabc47
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1716 firefox.exe Token: SeDebugPrivilege 1716 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1716 firefox.exe 1716 firefox.exe 1716 firefox.exe 1716 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1716 firefox.exe 1716 firefox.exe 1716 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1716 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 564 wrote to memory of 1716 564 firefox.exe 84 PID 1716 wrote to memory of 4008 1716 firefox.exe 85 PID 1716 wrote to memory of 4008 1716 firefox.exe 85 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 1236 1716 firefox.exe 86 PID 1716 wrote to memory of 2128 1716 firefox.exe 87 PID 1716 wrote to memory of 2128 1716 firefox.exe 87 PID 1716 wrote to memory of 2128 1716 firefox.exe 87 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://seeton.pro"1⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://seeton.pro2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.0.1450879800\1619318284" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1864 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca8e223-20cd-444c-a5c1-fa11f15852f6} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 1964 142d8eed558 gpu3⤵PID:4008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.1.932754648\1847764872" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 21754 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a787987-d3c6-4ef2-9c40-767e1c8b11d3} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 2392 142d8e04758 socket3⤵PID:1236
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.2.1549488998\726530116" -childID 1 -isForBrowser -prefsHandle 3628 -prefMapHandle 3568 -prefsLen 21857 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6386f12a-2a18-44ec-bff6-d3ed43044404} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 3460 142dcdd7958 tab3⤵PID:2128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.3.857900936\1848648611" -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 4000 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2d49003-e1f1-4d05-b731-74d8ad8348bd} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 3020 142cc661f58 tab3⤵PID:4416
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.6.1051900081\1430020938" -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce4462b6-a2e4-42b7-8b95-18a92523399d} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 5136 142df314158 tab3⤵PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.5.1002036316\769299040" -childID 4 -isForBrowser -prefsHandle 4960 -prefMapHandle 4964 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1dfea3f-ed71-4178-9870-0d227d0a9df6} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 4948 142df015f58 tab3⤵PID:540
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1716.4.145234117\1455718600" -childID 3 -isForBrowser -prefsHandle 4852 -prefMapHandle 4808 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c417ecd2-40c3-436e-a1a2-19cea897d708} 1716 "\\.\pipe\gecko-crash-server-pipe.1716" 4864 142df015658 tab3⤵PID:3688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\activity-stream.discovery_stream.json.tmp
- Size 22KB
- SHA256 4b57cd94bfe0f4d76f23e353b3ba7af8cdb6f0d6153da3668edb37ae20ae4540
- MD5 363724b95379367a0489117ed92cfe0c
- SHA1 1d530bd24e76f9d49434011c72f77081c0e33a94
- SHA512 bde3cc9db9b4654730d3e5a759dd8391904abe624d3215e71c6cfe8a7955d6d1b59033763b4aaacc2cee634610a6d80284f33967109ca416a42db31a9a442795
- SSDEEP 384:zsgSkKnbgtbeV6skCrjAl9ahXhi2l+zbq87zJT3JIR:zsN7nObeDj/+Xq87BJo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\doomed\16651
- Size 82KB
- SHA256 efed91dad6432ca140b66a3841843136b66092dfe9ce1efdd48f42fe33037545
- MD5 e15756d4a373df1b0ec68eff96cf15f8
- SHA1 9cbb1acca508da6c0a831e1ee6094d46f6663f06
- SHA512 cfd0c24de6324416fd2d790a57fdd481196709cadaebac96a94401f40f2136e6cd72892bc953edcd9c5bfc1f72499bd1181316359032e59ae81713f0e4d8a628
- SSDEEP 1536:BkX4DMqOV0gU6hvNQCLeZoXEEM/FIihX6Q8+VmL2wLRkXzhoJMnyNrXyFuhgLael:m4DMqOyeQCLeKXbMtrhp8wk22soJMMXi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\02DE2C16B8997D5835CE8476C15398006968D7AA
- Size 172KB
- SHA256 6c972a5a502955ef28d19a6e1dd60f06a9e58d52e0a871e00fe0493031e4c671
- MD5 03a2868d9b577607834f8b6524056504
- SHA1 09b5b9a53e7ff22836a0ad60535cf20c23ea4224
- SHA512 dc4c56783ff9ab2a73f309ea904e4d9eb036fd0a88d2f68f34c2db8d9119cf159fb86ead643bc3ba803aadd75768ca8d44fe393a9b213e76cacdcca67f49c195
- SSDEEP 3072:iObE+bAeJfKC0rMof59/10jtrmyh5agLgvn:iObwOSRvfPn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\1C47A2F1ADBC9C791F9D3618190802C31FC5D471
- Size 18KB
- SHA256 facf7821a6e528b8549a4ec9fb1364e4e5c76722310f5faa2ef427a2a9688255
- MD5 13dd89129acfef2224fb879e43d32505
- SHA1 e41915b14b9c28b6734a6ca2826a37ff2bbd39be
- SHA512 4728faf4a8f932948e3737ae8804fa7ea2abafc1b4fdaa1d083cee4479e9cfc0e2e1b3b4ffc58eed5a0cf941f3a81f9fefa4814e92434be499bbcc2653b22e97
- SSDEEP 384:vrn6IkMzMezFt+afoWPUdqdoYUAeXj+1hgLQ/q/yeMbUF0c939u/tGq:TLzMV4oW2qdGAeXj+1hgLQ/q/yeUUF0L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\358841DBC836F9C271FAADFC09A273C54E486C4A
- Size 129KB
- SHA256 f2b287708e62cb08097a3c8ff922ae661bb593915bcd2b91a4ef04123d499fc7
- MD5 2a03ab2694afa828613c345ce8cd3094
- SHA1 cbeb028f76b9dce1f901c1ae0d3ce760cd839a22
- SHA512 19118b20496340cb4e875156fdbd88dce7c26b2a9b1943d99ba85a15752e1e2a6756a3f7e634a6d6ce704d64c777136b0d5878f9a8ead0a9e21fd41866ecb9a0
- SSDEEP 3072:jfv/G242HZCQjs8UK/HDv+JZdWQ9GRUKxNLCxmQL3nOyhVkbagLgvt1R:jfvg2HNQ8xEWQURUKepn5hVkePp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\39B9D7E92958B31E0FD3FCC4EB0DCCAF7FE12E8E
- Size 170KB
- SHA256 accb4d2c0d7d4df1905ade243f01967ee90daf531e91b9ef3e7f8c8d2b1621b2
- MD5 1a03cb0c2a6b0b01653561e9ef29b77e
- SHA1 16dcfebb28c809942524aa6e9b69daddc1b41bd9
- SHA512 1dd0cb9e42d35cad04b75c0d0997dcb7688b73326f90d351e8e70d7b7ce9b5bd60f5ddc12f7726b5fad7f5eaf6cea8098a6deb7c5cec2450da1b1890e292d7f9
- SSDEEP 3072:wKhcxCEuK3htC71qE5rmyDgdpNdOEagLgvI:w6ELA/PI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\440DD7F82158DB8A069A7A2E3DB43BE9EEF23120
- Size 38KB
- SHA256 8018f0bb4c2e14d5aa4d3846ed9368a6a31e5ff8b30bb872a1e00a51901c503d
- MD5 0fdf923d30b7df8d564138fc27cf598d
- SHA1 7dd039f3ea6a903ac038360d44fb88cd8ad8bbed
- SHA512 7c904a05c89cc007c3232843846d185838ff6eef983bf61690cc34ad381b4718fda98a1771ac5613dc7734d08dc44771262f10bf55533ee24fbb9cb0dc864465
- SSDEEP 768:sLPP47Mh2bm3VNSsDmCVqAU/AwfZNVsHpaQzBY0AeXj+1hgLQ/q/yeUUF0czu/p:DMcKlYePg3//vWHRluhgLae72cz4p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\A8FD31D8F4420375895B4FAC44123C510CE2F9C0
- Size 169KB
- SHA256 41e78912666eae61e0d7576bef495cf78bb590e85a575afc2e7c802e53a574df
- MD5 fcdb4a4f687f4abd50ba4b249005eff1
- SHA1 b388afd459ff1e0414dadb69dd5fb35c4f4c9942
- SHA512 ba31aeabd21acc453ddb8974cd4bfc7f03213e353a1229bb729aba3389f1de2cf8f95f261263a43f1c3d57971e9ef2cc7069ef6788ed8f8aee48d97fb7a93ab9
- SSDEEP 3072:LI1F7BqT9R+9SvfBpCqAJ+SagiR3J+S03YmHyeL7fJm8GqKqb1s3BY3yASU5agLH:L/4fzfFYPA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3tq1igo7.default-release\cache2\entries\BDB35F67C49502E852D8AC866B0983F623E1C130
- Size 171KB
- SHA256 2e24f5bbf322c34e9fa36ba80b3ea86a2bcdb68cc060ed9f505d8e038ee5760b
- MD5 d6a7ac37e748fa9f47e1de01d159e702
- SHA1 0ac7884a9d3c229a7aa2b948fe73c0347f174c3f
- SHA512 91e64aa29655dd012a213c80bee3423d87c56f9108a6cd6d5f3f18338e63ec065a252d7a6137641f846ba9a6fc376d47d4b75aaf8ee92a70c7cc7d1075ee75c1
- SSDEEP 3072:IIJN9WPZ8Wu8EskmVbc1q71khqrmy8bKujBNagLgvH:IuWu+Vbc0PH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3tq1igo7.default-release\prefs.js
- Size 6KB
- SHA256 b97218ac7ce06bd79645039075bfa57a94c5339f21d3c803e80bfdd2d9513313
- MD5 9dbbbb74aa376da92c30a5e0fe21f7f7
- SHA1 2a5f243884f168359593d17c1e63d5e96390e219
- SHA512 41f0871c9bbf54f9cc2f37c4afd16189142964220e75613dc28646cb84ad37f39a7f8bf3ced9066054a0f328a0f1994c70ad3177ea0f06757ddb2ecc98815659
- SSDEEP 96:xHf5nUTUdqGq6dKUxmeOTzSBCPXAnpj1HG6wCGBw8V2c+v:B5nQR6dNxmeCPXun+Bw8V6v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3tq1igo7.default-release\prefs.js
- Size 6KB
- SHA256 3bc1dcfdbfc5af9090e53882370856472f94fa3b15be00c73975d87b854b4683
- MD5 4797422ebe8b9ab12d538f489638bea0
- SHA1 3805c7cb050b03191c0369d5d4d783a5f0f02f3a
- SHA512 d4a5f984877664d2d4441f8ee8d99be129d19c6fcc3a8ed2c785b0e614929ae4b5a90353ac934fdefae61f7fbb0f57a0d48b1b92e8f3228770f4bf140e904e83
- SSDEEP 96:xHf5nUTUdqGq6dKU/seOTzS6PXAnpjQHG6wCbBw8H2c+v:B5nQR6dN/seMPXtnzBw8H6v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3tq1igo7.default-release\sessionstore-backups\recovery.jsonlz4
- Size 2KB
- SHA256 9c8f31253747dd65a6b4589d1a20baee49dfd6410649d027e2cfbe4b2bb261d6
- MD5 961108c50bf4b2426e80a9bee726a288
- SHA1 d959a68c8e83c5d691d983bd0c62150bd9d7e08d
- SHA512 3e5bf8c540e1467db86326465b6bd915808ea38b05c049dab79d67429557367635fbf26ce3c56069f77be99980b891aca9319e7ecb31483dc10aa3e4e4292366
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3tq1igo7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 176KB
- SHA256 ce7097683cf04296938c4818347dffde6aca3b0c14954faee6fd49b58fc9735e
- MD5 ec368fcc528eafb8e2af023c57c4a326
- SHA1 53e8e48a6c2bd4d534106c032e6ca6aad37f3a5f
- SHA512 d6c58683057b63c436711ef703c9a67b9871bef2237cf5840e5bffac031f29c14de4c0fdd48b259b5f6cec2a18c0ac45f07847c2946f9b421e594771a15d533e
- SSDEEP 1536:U6S6glG6luwHeH+cH3EjNvuFPV3y3l8asbPP9wRyap6xJO9taqaZvChColv8Aes:doeH+cH3SvuFPV3y3s396yap6xMkxnTs
- MD5 SHA1 SHA512 SSDEEP