Overview
overview
9Static
static
3FiddlerSetup.exe
windows7-x64
4FiddlerSetup.exe
windows10-2004-x64
9$PLUGINSDI...up.exe
windows7-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analytics.dll
windows7-x64
1Analytics.dll
windows10-2004-x64
1Be.Windows...ox.dll
windows7-x64
1Be.Windows...ox.dll
windows10-2004-x64
1EnableLoopback.exe
windows7-x64
1EnableLoopback.exe
windows10-2004-x64
5ExecAction.exe
windows7-x64
1ExecAction.exe
windows10-2004-x64
1FSE2.exe
windows7-x64
3FSE2.exe
windows10-2004-x64
3Fiddler.exe
windows7-x64
1Fiddler.exe
windows10-2004-x64
3ForceCPU.exe
windows7-x64
1ForceCPU.exe
windows10-2004-x64
1GA.Analyti...or.dll
windows7-x64
1GA.Analyti...or.dll
windows10-2004-x64
1ImportExpo...ts.dll
windows7-x64
1ImportExpo...ts.dll
windows10-2004-x64
1ImportExpo...rt.dll
windows7-x64
1ImportExpo...rt.dll
windows10-2004-x64
1Inspectors...on.dll
windows7-x64
1Inspectors...on.dll
windows10-2004-x64
1Inspectors...or.dll
windows7-x64
1Inspectors...or.dll
windows10-2004-x64
1Inspectors...es.dll
windows7-x64
1Inspectors...es.dll
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Analytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Analytics.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Be.Windows.Forms.HexBox.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Be.Windows.Forms.HexBox.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
EnableLoopback.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
EnableLoopback.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
ExecAction.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
ExecAction.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
FSE2.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
FSE2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Fiddler.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Fiddler.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
ForceCPU.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
ForceCPU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
GA.Analytics.Monitor.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
GA.Analytics.Monitor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
ImportExport/BasicFormats.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
ImportExport/BasicFormats.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
ImportExport/VSWebTestExport.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
ImportExport/VSWebTestExport.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Inspectors/QWhale.Common.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Inspectors/QWhale.Common.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Inspectors/QWhale.Editor.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Inspectors/QWhale.Editor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Inspectors/QWhale.Syntax.Schemes.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Inspectors/QWhale.Syntax.Schemes.dll
Resource
win10v2004-20240226-en
General
-
Target
Fiddler.exe
-
Size
1.4MB
-
MD5
bf4fb7029571683986ecf3a48eacd4fd
-
SHA1
5f1c4f0a79f4a0c8e96d27adbf0153a45a58cc11
-
SHA256
b0eab66bae42868d402f326a37cb0e4364d4a686eb5feb4d93325b5078c1bc0e
-
SHA512
ec240842386f28e87576720252d12c5a02ea9e2c29485d1acaea34c89a1577041462610d953a59e9e4acef4d3c566e861d6672a00d9bf196d778bf13a45bb25e
-
SSDEEP
24576:HA93BNl5yPcNBSuUsRCb/l+53flpmjaqkIw:swLzkIw
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Fiddler.exepid process 4516 Fiddler.exe 4516 Fiddler.exe 4516 Fiddler.exe 4516 Fiddler.exe 4516 Fiddler.exe 4516 Fiddler.exe 4516 Fiddler.exe 4516 Fiddler.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Fiddler.exedescription pid process Token: SeDebugPrivilege 4516 Fiddler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Fiddler.exepid process 4516 Fiddler.exe 4516 Fiddler.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Fiddler.exedescription pid process target process PID 4516 wrote to memory of 3656 4516 Fiddler.exe msedge.exe PID 4516 wrote to memory of 3656 4516 Fiddler.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Win8EL2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3824 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5164 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5864 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5284 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5436 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5360 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=6104 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5956 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=4748 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20202.18177\user.configFilesize
966B
MD5bdf617a621e5bbe62ee5e47100603ac3
SHA18868b84f976835f4dfeaf0bffa60613933ec8b53
SHA256d829bc54f29e0238458a7b4dcf8ae48923c853795558b3f950c369afe5590110
SHA5120a356e167fa7ca4ada99dc4091362cb6bdc18ba65758b9e835ee95c84b1c22f0c2c457d89537cd441c63ca08f14ceefc9a5fdcfd1adcf6d448135a9e4f0d8dbf
-
memory/4516-18-0x000000001F770000-0x000000001F91E000-memory.dmpFilesize
1.7MB
-
memory/4516-4-0x000000001DF00000-0x000000001DF50000-memory.dmpFilesize
320KB
-
memory/4516-17-0x000000001F530000-0x000000001F540000-memory.dmpFilesize
64KB
-
memory/4516-0-0x0000000000490000-0x0000000000606000-memory.dmpFilesize
1.5MB
-
memory/4516-5-0x000000001B6E0000-0x000000001B6F6000-memory.dmpFilesize
88KB
-
memory/4516-6-0x000000001E9F0000-0x000000001EA38000-memory.dmpFilesize
288KB
-
memory/4516-7-0x000000001EA40000-0x000000001EA64000-memory.dmpFilesize
144KB
-
memory/4516-8-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-9-0x000000001F0C0000-0x000000001F0CC000-memory.dmpFilesize
48KB
-
memory/4516-10-0x000000001F120000-0x000000001F16A000-memory.dmpFilesize
296KB
-
memory/4516-11-0x000000001F0D0000-0x000000001F0DC000-memory.dmpFilesize
48KB
-
memory/4516-12-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-13-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-14-0x000000001F570000-0x000000001F5B2000-memory.dmpFilesize
264KB
-
memory/4516-15-0x000000001F540000-0x000000001F552000-memory.dmpFilesize
72KB
-
memory/4516-16-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-3-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-19-0x000000001F5E0000-0x000000001F5FA000-memory.dmpFilesize
104KB
-
memory/4516-2-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-20-0x000000001F560000-0x000000001F568000-memory.dmpFilesize
32KB
-
memory/4516-21-0x000000001F5C0000-0x000000001F5C8000-memory.dmpFilesize
32KB
-
memory/4516-22-0x000000001F5D0000-0x000000001F5DC000-memory.dmpFilesize
48KB
-
memory/4516-23-0x000000001F630000-0x000000001F656000-memory.dmpFilesize
152KB
-
memory/4516-24-0x000000001F600000-0x000000001F60E000-memory.dmpFilesize
56KB
-
memory/4516-25-0x000000001F920000-0x000000001F9DA000-memory.dmpFilesize
744KB
-
memory/4516-26-0x000000001FF90000-0x0000000020534000-memory.dmpFilesize
5.6MB
-
memory/4516-27-0x000000001F610000-0x000000001F618000-memory.dmpFilesize
32KB
-
memory/4516-31-0x000000001FDA0000-0x000000001FDF0000-memory.dmpFilesize
320KB
-
memory/4516-32-0x00007FF8EBAF0000-0x00007FF8EC5B1000-memory.dmpFilesize
10.8MB
-
memory/4516-1-0x00007FF8EBAF0000-0x00007FF8EC5B1000-memory.dmpFilesize
10.8MB
-
memory/4516-38-0x000000001C4A0000-0x000000001C548000-memory.dmpFilesize
672KB
-
memory/4516-39-0x000000001C550000-0x000000001C572000-memory.dmpFilesize
136KB
-
memory/4516-42-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-44-0x0000000023960000-0x0000000024106000-memory.dmpFilesize
7.6MB
-
memory/4516-48-0x000000001B320000-0x000000001B330000-memory.dmpFilesize
64KB
-
memory/4516-49-0x00007FF8EBAF0000-0x00007FF8EC5B1000-memory.dmpFilesize
10.8MB