hxxps://public-usa[.]mkt[.]dynamics[.]com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA

Analysis

max time kernel
83s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://public-usa.mkt.dynamics.com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	firefox.exe
Token: SeDebugPrivilege	3872	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3872	firefox.exe
3872	firefox.exe
3872	firefox.exe
3872	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3872	firefox.exe
3872	firefox.exe
3872	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3872	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3984 wrote to memory of 3872	3984	firefox.exe	84
PID 3872 wrote to memory of 1444	3872	firefox.exe	85
PID 3872 wrote to memory of 1444	3872	firefox.exe	85
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2792	3872	firefox.exe	86
PID 3872 wrote to memory of 2080	3872	firefox.exe	87
PID 3872 wrote to memory of 2080	3872	firefox.exe	87
PID 3872 wrote to memory of 2080	3872	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://public-usa.mkt.dynamics.com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://public-usa.mkt.dynamics.com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.0.802161247\283739686" -parentBuildID 20221007134813 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9c43ebd-fee1-4186-896d-f2870eb08a78} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1940 1cbab9fcb58 gpu
    3⤵
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.1.141019903\1839438076" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea667767-0104-4fe2-9679-9d5011e1c2e5} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 2368 1cbab8fd858 socket
    3⤵
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.2.2115432827\347027214" -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 3196 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b414211-4764-4159-b559-372111996fff} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 2960 1cbaf8d5d58 tab
    3⤵
    PID:2080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.3.1028034264\403067136" -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8dfbb31-c98c-4fd2-a05a-eacca2c88c03} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 3624 1cb9f060b58 tab
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.4.1628020326\2057663622" -childID 3 -isForBrowser -prefsHandle 5092 -prefMapHandle 5088 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9531a26-0e92-4600-aa35-7f4589378a39} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5100 1cbb2228458 tab
    3⤵
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.5.1017990193\788454054" -childID 4 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24d4a92b-f892-4491-9dde-b270c892b659} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5164 1cbb222a858 tab
    3⤵
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.6.657146103\1092746359" -childID 5 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {995fe0d6-cb84-4948-b9d3-8d1bc0a2d6ab} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5356 1cbb2c21558 tab
    3⤵
    PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.7.1088164866\51222135" -childID 6 -isForBrowser -prefsHandle 3412 -prefMapHandle 2928 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5221de0f-c603-449f-bbb5-44eba6f16b46} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 3404 1cbb2c23f58 tab
    3⤵
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.8.1223497447\1232175966" -childID 7 -isForBrowser -prefsHandle 5220 -prefMapHandle 3332 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b4ed6b2-64b1-400e-a276-38881b9068f9} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5368 1cbb3591558 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.9.688660947\640724724" -childID 8 -isForBrowser -prefsHandle 3604 -prefMapHandle 3600 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {475956ee-8400-46fb-a44b-4640a926302a} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5716 1cbb08e0e58 tab
    3⤵
    PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4c2efdae46d2355edd35a0a0e4b6a5de

SHA1
743d0d240944245db286d0d89fd8a5d1dbc31020

SHA256
5b85a348c26f2f81053f62eec7c59d93ba0b38032b76c5c2586dfca73fe2621b

SHA512
fd9ea70583b5ffadb35c3db7cd7a886a362872ad2250aadc06696fd05d05e37c709dfcfbd53294588b2367c8acffde049f2fc76e24cc6d7aa46ab3fda9185680

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\0e1075ce-ebbc-42d3-b5f0-2425114533d9

Filesize
10KB

MD5
dfbc8c399e889475e6e740839b10b439

SHA1
1d28deb8a0c7ef435a23b6775e9195abb5fe84fb

SHA256
5d4db544dc2341f40d723d50cb2d1c8316bcd6d5a1ab4581c78e9a8919b8977e

SHA512
82c8051a7156bf8ca37b15cf4f0fa1171cfa33aae0b54f4d059470f765dde82a10fddf51af393877e32ab46decaefff73ec8e0647a2f69cada444230763cfec6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\fa10d609-8b34-4dbd-8583-92c7d62647c7

Filesize
746B

MD5
a94744364ee248167165d3f5d92e0124

SHA1
27d8d92468486bd6c47ecdb70a3ba88f30369d49

SHA256
1fc673180f81290c8005af544ba207bf05cc356cbe385a6dcf8e3d2f44d976b1

SHA512
32f7b9f1260ab0bd7bb5f55ecb8d6fad905f566ff66045af953ac09ad2ae05dfa503cb58a542523dbd6d6e9432762c37cc2d0f40c9a20493bd2cec62d1353cef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
6KB

MD5
9c2091c33125d37e830300a4d149e341

SHA1
e2812bf1aee84e25f22cdfe8e9bdc131f2476b09

SHA256
230d42005123f14baf56b72046a847a5216e79c4b08964bf595465ff5a81f7d0

SHA512
8a7c06d202c641215ddecbaef0d79b8964e80df6b45d2dd66c8167219b0c6d03309a2ff1e8ab74c59624807ab4fd57ad6464687dd9af1bab9d6abba2836c3252

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

Filesize
6KB

MD5
14df9c8f3948b7f14da312ea1e63144e

SHA1
8c63894202c0d45610fffc8636a920ef821a1058

SHA256
c960bcf700693e0538b5606d1e4b01619e28641919d00815c9a79ad69a8c53bd

SHA512
01c0f3b1025884e255d7575a8a0835c15079bb161e088e4668f30ad3f43d64495e248d617ffaf3841c2349ce6846edcfe4eb95240ea32493f83d492ed639115e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

Filesize
6KB

MD5
53a23af4335fcebf29afc4c6f5d8de71

SHA1
6759dbb7dcd8e7b3aecb8a8222d11e2a3ac48de7

SHA256
8dc7e73fe0e1c22834817d5bc5d3ae28220684dba98759190e73cbbd374e876e

SHA512
ff8be50607c55a6698d5313040bdb5e18cca6b6939c9cf84e816a3412487302e896c25c760564b76032ba9764af17312ff7b207177a4815a2eedf81443ade12e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
f42f35a95fd1e94aa6a4c511af8dac61

SHA1
b5fb3b44d5badb0055572160800672352a6b1ba9

SHA256
50a29cf758a5ede79dda235f4cd7527a028dd9326eced3076c4192ab570eaad0

SHA512
a6aabe3c0206da0bcac3fd503fd918017f121c8a2d1e8353851af0dc9cefae96e3e8cf15d7260eca745611a3946cddd8ce56ee7b83e56c3f9452b89027164273

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
8936dfd90f77b44b3a78e4e13dc52ac9

SHA1
b4500017cd8ee6539a97770dfeea8bc105fd5a84

SHA256
56c2b1b17b21cc2b6485125b93b2af10682e7c9bd0b77963a36681879baf5152

SHA512
6a86ef05111b5ebe941734ff9293f8bbe5476744f63199c8037ec827ce84877341f2a6ca5e99b916f5189521939d90d50c511b9bf1c40ed3584ce30ce5c561b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
6d341b0220863132d0fac3d300f391da

SHA1
8eb8b29f0bb3168ea639b41c52cbba5857cef5b1

SHA256
efa1b221c26a8638e4ec429d66f2b6971ee4fbb6b05c38bff12d5bc579ca2128

SHA512
04610c735b652a9ead0e2d001c03e7f368f5693ab4160a0014a2d10ede7aa76424366ac577b5d4462e17a2a164726fe2f4f5b5e2fd9625a5392d807e54453536

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a91d771093b0a66b863921b413cf4577

SHA1
bdcaeefa22579048940510ac7b80eea68a807d6c

SHA256
cce7689feffe0ae820e59922e92809006f9a5182b7e86fff9e64ccd75951e9a6

SHA512
bbb889cf206d71a73aa67c33cf508ba58afe33f8a77078557dfe058d36e909027f544ea67b16c51f493cbca2866aa6e1dd8248e483ce51f653afa43f577106d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
8eff070195653e2a131a916680cd18c2

SHA1
7f5dc88fc5d5969b25d5e75cccabd37362b31a94

SHA256
61c22934bcca9275d3aa4a9548828b028aaa84a0c1d977d50daeb889e02dbfd3

SHA512
18ed6beca1a23e74571ee365b3c5e1b92686188178fa5481d41dd4c991286d5b3599613a870a8d371eb886f82b1b5e35be10ae82b0a95452a53f9cffed73f507

Download Submit