Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
25/02/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
tinytask.exe
Resource
win10-20240221-en
General
-
Target
tinytask.exe
-
Size
35KB
-
MD5
8fd3551654f0f5281ddbd7e32cb73054
-
SHA1
9b1c9722847cd57cd11e4de80cd9e8197c3c34cd
-
SHA256
75e06ac5b7c1adb01ab994633466685e3dcef31d635eba1734fe16c7893ffe12
-
SHA512
a716f535e363fc1225b1665e1c24693e768d13699ea37bdf57effe4fea24b4b30a2181174f66c35e749b9c845b07f82eecbf282ee5972de0426f847293d46b4b
-
SSDEEP
768:sAzGzd0LnFjuwY6QlVwvHI1pSgNEl/MYoeAW:5zGzd0wXlVwv0SgNQXoeAW
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4100 tinytask.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4680 firefox.exe Token: SeDebugPrivilege 4680 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4100 tinytask.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe 4680 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 5112 wrote to memory of 4680 5112 firefox.exe 75 PID 4680 wrote to memory of 4268 4680 firefox.exe 76 PID 4680 wrote to memory of 4268 4680 firefox.exe 76 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1380 4680 firefox.exe 77 PID 4680 wrote to memory of 1568 4680 firefox.exe 78 PID 4680 wrote to memory of 1568 4680 firefox.exe 78 PID 4680 wrote to memory of 1568 4680 firefox.exe 78 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tinytask.exe"C:\Users\Admin\AppData\Local\Temp\tinytask.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4100
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.0.1124220371\731879272" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1720 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {892da328-5786-447c-b1ba-f2c538230ff2} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 1812 16e910d3758 gpu3⤵PID:4268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.1.727900672\118399395" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60f80cb2-f42f-4de3-9730-b7126eca4d71} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 2168 16e90ffc858 socket3⤵PID:1380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.2.1410287957\1037333187" -childID 1 -isForBrowser -prefsHandle 2812 -prefMapHandle 2888 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf333ddf-0502-4579-8d3f-24f635d93131} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 3044 16e9105ae58 tab3⤵PID:1568
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.3.1035888583\1933281056" -childID 2 -isForBrowser -prefsHandle 3436 -prefMapHandle 1260 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5331b3c4-ad20-4509-8acc-05f65521d034} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 3448 16e93ba8b58 tab3⤵PID:3876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.4.250430409\585874572" -childID 3 -isForBrowser -prefsHandle 4160 -prefMapHandle 4156 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00a4dd04-d4e3-4856-8d24-d01d12cf0b8a} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 4172 16e96814258 tab3⤵PID:2288
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.7.1359365476\106356358" -childID 6 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae0a4c59-c0b3-4c60-8805-9fcd4d8266cb} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 5212 16e97587658 tab3⤵PID:1608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.6.1028725424\1193921889" -childID 5 -isForBrowser -prefsHandle 5036 -prefMapHandle 5040 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1eff239-33a9-4520-a978-be21e2ba6a07} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 4784 16e97585e58 tab3⤵PID:1048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.5.629190611\731497062" -childID 4 -isForBrowser -prefsHandle 4892 -prefMapHandle 4884 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {290d5aa9-f044-4e56-8a1b-8a57bc8fe4c4} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 4900 16e973d2658 tab3⤵PID:3692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.8.685628815\1308177632" -childID 7 -isForBrowser -prefsHandle 5632 -prefMapHandle 5672 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb767572-f084-4e76-9ac5-417e8a629d21} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 5588 16e992ead58 tab3⤵PID:2068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4680.9.869435196\1280217037" -childID 8 -isForBrowser -prefsHandle 2704 -prefMapHandle 2712 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65584acb-53dd-4914-a946-7d177c0db78b} 4680 "\\.\pipe\gecko-crash-server-pipe.4680" 4948 16e983bde58 tab3⤵PID:796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD52c2c3dd6f2fdce5d5d3282a1c4ce577b
SHA1a990dd05e0716e345cfd854b657dd76b62220daf
SHA256bf8251b2c44800d362548687cf4d03870352433706d4fe6d6d948c960d031709
SHA512b350a187f823e44b1b5544157e6f08050a1a897613b3c9377fe34500aff73e84f49cfd2171bd0baebc19fd6ef2cbbda50a4f8a85fac45854302a1ad3ac41fa5e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cnkbikd0.default-release\cache2\entries\4EED77ABF2B13446DC47048EDC01C87DFC8AFFC2
Filesize32KB
MD52935dd8761ce493be335b915e70f5ff3
SHA122ac14a3c0bf3eafecfc19976bdda3990f6a548f
SHA2564db11a8c7f8201104ec6e52f29310f5ee20520395dcf9398385f0f2298a01cc7
SHA5126c9edc51073a4c35486a7d12180953ca64028f017b3b95f1c352bfd8a4042069f21e6e2e708879937825e21f5c80b2966497d72e59ae2e7f0b4037eb12375b48
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5df7280cd3e16ef823ab07019e3e4f2d7
SHA1b7d3bcb33bc0b8fada414b55bedc9d74c07ea459
SHA25667d611fd7c021ab4229f14751377cd3d8c6b066d36acf0e35c098e8511484646
SHA51207eb385099841fe9b8f0215d6ee8a53cb2a2443f629f58c91a7c4a096859b5f3b626fc95fb0c39a46fbc0cf926db284aeffe3eb7c0b2192cd399ec54df061693
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\datareporting\glean\pending_pings\3488e589-2f16-4112-8901-287397696422
Filesize10KB
MD5071e4e24a5b4e5009a49f905aad96728
SHA1cf8b2ef3dd831232077a4dc13eab9a7ae85d59ce
SHA25632334f183154caeed26da70eaabaef53b0dbd534847d5073cd83aeffc25a0e5d
SHA512e07ecfc6dc419bf51f26be8fec0532f96b3a3751d1d2e59a74ff126a6e64e24565edc9740444edb29c266e40521feb386cf8c5999eaaa9fac5e10eae2b661102
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\datareporting\glean\pending_pings\3ca89b1d-cfbb-4fa5-8452-31c07004a1da
Filesize746B
MD5fb34222f891a73020170da211ade06c1
SHA1bedfd4a306e6e9794d67110dbea98c4efb8f5ba0
SHA256f28ec9e653ee65eb2b9111cb840a878d6713d1989740b4759279efe6a391e6e3
SHA512dd770707e84ca59a9113b13391a56493a185ab05b78432fd883a7cf17a6aa51cb412cde84660d188c8d4490d5108305b5460495842e89a52955c8705f46c4d09
-
Filesize
6KB
MD5e92797198b7a0bee58cfb5c90a55d1db
SHA1c212ddcb60d59da882d9763c3233326f3691d5de
SHA256ae1cada325bb9383bdb7badbdb395f0fcf1acd8a0be0cd5eabdd6828f4281dfe
SHA5123729d33f8a1e1811c2d011228a82b6eeef4bad449a94d943a736d973f1c3ac22de2e0d0caf9be14c20b0a33d49f6d7543294badfff9f1707c803ed451ab7159d
-
Filesize
6KB
MD5fa7d0b8c6933f034d3620814b62966c8
SHA182f9a75e0910d571d53863bc41f8ae760124ae94
SHA25665f2c9e782f183aa085c12d423dd64ab5fda853f21abca4a53ae51345255d872
SHA5124dde7fa845bfa39b0776b5b5691e511326a415dfd01513d3fbd59b677e46485d2604f2169453e49a7000238bf3662325be1f634c2d934b7f4626f255da27550d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD547a6382f622b144447e224ef40dcaa12
SHA1a60bc646387132679cae607edfabdde98b0addbe
SHA2567477b3834438855242c49f6e76bc7bdc5c8dd788cc55f925d248d13bf8043aad
SHA51254438a4dad539b0cb3ed2b2c56bffd46927f3f28319077e3bb52ff4c0c2e7aff8234bde98cfd0a96572f53c46d014a75dafa13eb8c9fe04bd3254a1863069d13
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5d18ebb42b9b6da556c4fbb5b2ca541a0
SHA1cc7aea14c632b70f68c59212015b7e77c7ba6c93
SHA256bc00f2dd4093dd29c2b359c5b945ef3da3fc7c2a1a9a6104bbe0cb6d49f03bcb
SHA512bda075a54be7fa837012d648e7864bf34c6d0d113d80356ba51713ed79b53d4d4beb59d9d9d9a9984263a87dc6f147e732343349b50031d85066063012478844
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD56ff4d810dd09cdf1685d808f327cbe8d
SHA1f4bd7cc3f520a0af3d2a53021c8f26e1c0e150bd
SHA25685c76a3ff8c76b41fb3fa098e9df4bae526b1acd41d93278b426bd2fbaafb25a
SHA5126a88d3c2f410724e544b9a407b954d0c65a28020a514017a9996b498c2c27dd182671fc6bf1b7a475c686e724b21975095193cd116b8219aa8c69bec66067006
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD594b8e69677786bf617a9856da00a4eb1
SHA1586cea79a58924baab105d2ff69f82ae453b912b
SHA2562821b8499ef9831400e4bd4951b17e9f257436e96c3b7f2106aa7f3c857f717d
SHA512db739c6571d79be725a88d90cfa08026123635f4bab4b2fce7f2f21e7a4d84d395858c45ca4f8a62f96d43168e10503ccfa38f9542268e3ac76dc98a858802a2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD507fae9b2f94cb3642d449c406dac0038
SHA1b33656986a0103be0d32551b5bb4cb422c2a7422
SHA2561a10ae443443ad6be6829046a4545c43cb63dde2228c02826a18e0fe683de083
SHA5126433abd2dd6ff095019db95509f3dd87fb8d162d41406b70901a1a86a29ebe1dd5bacbfb4c3812184a236249821d52c6396ce1bfc85e811912f8a37f74aae2b0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD5c4276e5b9e141222d0267e0ebe774ad5
SHA1e148935a5a66766700ce4ea54ce7840599efa74d
SHA2567523b4febbdd9858c321e2bec410a7647b7fef0bcee7023bc2d1eead2270ed9e
SHA51270a2308a85af4f03266eb9ce5c5cfe2c95bf6863792838d29debea2d68a32b937966375c67d60735e8f238ac20fc15406d04bd517fc43a49742b581348547403
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cnkbikd0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize192KB
MD58229d9830e195e973a60fe9339c55412
SHA1f14ba01149e4a63f97bc628bb455446fea2c112e
SHA256a42365232414675a4ee8294a87ad7e39b40cbe5a978324f9806e41d0c872895d
SHA512963477b5c8a0695733128fd32453c0340378fd754b95daef5dcb97a1124ae52e547554010891a3fcc5d6beeadf713cc400c9f36b7c7dfe87c3d24e65ce676f84