Overview
overview
5Static
static
3FiddlerSetup.exe
windows7-x64
4FiddlerSetup.exe
windows10-2004-x64
4$PLUGINSDI...up.exe
windows7-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analytics.dll
windows7-x64
1Analytics.dll
windows10-2004-x64
1Be.Windows...ox.dll
windows7-x64
1Be.Windows...ox.dll
windows10-2004-x64
1DotNetZip.dll
windows7-x64
1DotNetZip.dll
windows10-2004-x64
1EnableLoopback.exe
windows7-x64
1EnableLoopback.exe
windows10-2004-x64
5ExecAction.exe
windows7-x64
1ExecAction.exe
windows10-2004-x64
1FSE2.exe
windows7-x64
3FSE2.exe
windows10-2004-x64
3Fiddler.exe
windows7-x64
1Fiddler.exe
windows10-2004-x64
3ForceCPU.exe
windows7-x64
1ForceCPU.exe
windows10-2004-x64
1GA.Analyti...or.dll
windows7-x64
1GA.Analyti...or.dll
windows10-2004-x64
1ImportExpo...ts.dll
windows7-x64
1ImportExpo...ts.dll
windows10-2004-x64
1ImportExpo...rt.dll
windows7-x64
1ImportExpo...rt.dll
windows10-2004-x64
1Inspectors...on.dll
windows7-x64
1Inspectors...on.dll
windows10-2004-x64
1Inspectors...or.dll
windows7-x64
1Inspectors...or.dll
windows10-2004-x64
1Resubmissions
05/03/2024, 13:45
240305-q2myfsha98 5Analysis
-
max time kernel
120s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Analytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Analytics.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Be.Windows.Forms.HexBox.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Be.Windows.Forms.HexBox.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
DotNetZip.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
DotNetZip.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
EnableLoopback.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
EnableLoopback.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
ExecAction.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
ExecAction.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
FSE2.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
FSE2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Fiddler.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Fiddler.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
ForceCPU.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ForceCPU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
GA.Analytics.Monitor.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
GA.Analytics.Monitor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
ImportExport/BasicFormats.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
ImportExport/BasicFormats.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
ImportExport/VSWebTestExport.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
ImportExport/VSWebTestExport.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Inspectors/QWhale.Common.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Inspectors/QWhale.Common.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Inspectors/QWhale.Editor.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Inspectors/QWhale.Editor.dll
Resource
win10v2004-20240226-en
General
-
Target
Fiddler.exe
-
Size
1.5MB
-
MD5
a5b8c0f51898e9d55e4b3aa7904adf32
-
SHA1
5eaff276409670f3e8ce4cbb17086f1362d18868
-
SHA256
5e3006a575d4acce2e5e3cec684d7e9a1fbc3efbb73f06f5c4604faebf014ad3
-
SHA512
6abf01f09c8c6e430118de27322f4d67bf25018633544556630c47bfa9adc2c1fd186c94119a0b9be6c2d8dead9bbb46a8b1185fe02da2085601b0e9613ad427
-
SSDEEP
12288:nkcQS3I8s758yMQhaTqylrpxVKXgDPL5daRtriRStgz+/iUFu0o3AklQvleUl053:rOrc7WeJ3WZwo343m+pmjtSDN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main Fiddler.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe 2292 Fiddler.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2292 Fiddler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 Fiddler.exe 2292 Fiddler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2292
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20211.51073\user.config
Filesize966B
MD529bd757efdf2000fbd55c76ede82c3e4
SHA11abcf3be95daa6b68c9d7adebdcd89d69c287406
SHA2566d6f9655abc3cc9e7c6de940361900e8c0a8c17d27f74ca1af2c4c2414b6b205
SHA5129bb9b4848d9e07f3357672e72ec9df3043a84d691337d7617a36d434249d60a0e550293325745b0e5da00bf42cc84aa8dad4f7e033944fedf8ff88e9bd809c64