Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20240404-it -
resource tags
arch:x64arch:x86image:win10-20240404-itlocale:it-itos:windows10-1703-x64systemwindows -
submitted
08/04/2024, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
free.html
Resource
win10-20240404-it
General
-
Target
free.html
-
Size
15KB
-
MD5
4928758af003e19a6f86b908015d9b37
-
SHA1
8d6a1629ea6ce97180c5c9768fffb4832ba927e8
-
SHA256
171b362ce6384032e44690f8047de9c7992097fdbed4be918b597ea485060c37
-
SHA512
4e0bfc766f03f896391c00ba7da1c8321f6bd5530ad06bacae09e666c506d82930bb23e4667c0049f5a42b570327c2cfa1df4288f1b30f1833dd7d2f374e9e17
-
SSDEEP
192:PNx5Ssv99qXoqTJkNr423x+tmT1TwVwDArC7AIqczwVlFtyrrN:5Ssl9qYoJkN0u+tmTFWwAIqcktErN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2000 firefox.exe Token: SeDebugPrivilege 2000 firefox.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2000 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 3208 wrote to memory of 2000 3208 firefox.exe 74 PID 2000 wrote to memory of 2404 2000 firefox.exe 75 PID 2000 wrote to memory of 2404 2000 firefox.exe 75 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 3564 2000 firefox.exe 76 PID 2000 wrote to memory of 1076 2000 firefox.exe 77 PID 2000 wrote to memory of 1076 2000 firefox.exe 77 PID 2000 wrote to memory of 1076 2000 firefox.exe 77 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\free.html"1⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\free.html2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.0.1559672195\429623370" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6592a3de-be9c-4378-8e7d-d22d049fa8d9} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 1800 1755d603e58 gpu3⤵PID:2404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.1.1489183197\66341979" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cae2cfa1-b289-4713-a066-e7ed2f5ebc3a} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2152 1755c2f9258 socket3⤵PID:3564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.2.1829693704\1250029943" -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1e872fc-e413-4a63-a4f9-34d4cf7eab15} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2744 175603d2858 tab3⤵PID:1076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.3.374384701\1252110434" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 2736 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e3cc5b7-1d06-4810-89a1-ecd8bbba7b99} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 3468 17551360158 tab3⤵PID:3708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.4.1944800817\1425916420" -childID 3 -isForBrowser -prefsHandle 4660 -prefMapHandle 4656 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81cfbef-bc74-4089-bb51-aafc70eac497} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4672 175628a1f58 tab3⤵PID:1680
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.5.229089882\318381178" -childID 4 -isForBrowser -prefsHandle 4812 -prefMapHandle 4816 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebe8bd14-1535-408f-a70e-3716e700255c} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4804 175628a1358 tab3⤵PID:4392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.6.1539812943\1106670278" -childID 5 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27eaed7-ba22-4033-818a-db737d4dbd27} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4992 17563669a58 tab3⤵PID:3912
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5e8f354400c64699513f608f6e8f8cc90
SHA18780625ad791f52576c8a2b7e31133a4ca189fab
SHA25679dee9400b808a3b0f346c61717d12ff14e65d045bba2c131bdc7f203031837c
SHA5129f02cf40cc5f568e7ca05d48312a4cf3f413f9874abefa3b4c398e6392c232eab21ca2f06f9cc30765decc5c7fb05659cb93bbb86bb6f33f707dbf1b080d3320
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\a4aa1555-4dce-4bba-8339-67bb3629d0ca
Filesize746B
MD51cea641218b6ba97cc167876acf90a87
SHA1f8534105b2228b38439040e2339b7cf30920a153
SHA256f1a4591b0e72c745cff11adf4dfc63d4a44c43928cb4c2173098e6c126aed942
SHA51271e72ac3ac7387ab8625b6798de92719c99c75ed431066050b656fab7e09e0f61a14dd1dc28839e10f326a6dd8b9fa5e129b7f43ed5affe3e7b12c116c1dfc56
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\ea37dc01-4499-49e6-8ccc-bc7eff9cb07b
Filesize10KB
MD5439b1ff760a8ed9ca6a83b3b02e7666b
SHA119da07b353224c501dc24391ca02cdbec4032a71
SHA2565f1d06b945e45e550fe265f1a88c42a59fe7a3c7122e15bbb89ff36629a8f705
SHA512663f0da95595d1e28276a26dcd30b9262a3f5fbbd21d63e54e25d68d42dd6d5994326bdd4939a216f41ca2e91dba3591bbc349b74e4f677568e8a00a03b99043