171b362ce6384032e44690f8047de9c7992097fdbed4be918b597ea485060c37

Analysis

max time kernel
16s
max time network
18s
platform
windows10-1703_x64
resource
win10-20240404-it
resource tags

arch:x64arch:x86image:win10-20240404-itlocale:it-itos:windows10-1703-x64systemwindows
submitted
08/04/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

free.html
Size

15KB
MD5

4928758af003e19a6f86b908015d9b37
SHA1

8d6a1629ea6ce97180c5c9768fffb4832ba927e8
SHA256

171b362ce6384032e44690f8047de9c7992097fdbed4be918b597ea485060c37
SHA512

4e0bfc766f03f896391c00ba7da1c8321f6bd5530ad06bacae09e666c506d82930bb23e4667c0049f5a42b570327c2cfa1df4288f1b30f1833dd7d2f374e9e17
SSDEEP

192:PNx5Ssv99qXoqTJkNr423x+tmT1TwVwDArC7AIqczwVlFtyrrN:5Ssl9qYoJkN0u+tmTFWwAIqcktErN

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	firefox.exe
Token: SeDebugPrivilege	2000	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe
2000	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 3208 wrote to memory of 2000	3208	firefox.exe	74
PID 2000 wrote to memory of 2404	2000	firefox.exe	75
PID 2000 wrote to memory of 2404	2000	firefox.exe	75
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 3564	2000	firefox.exe	76
PID 2000 wrote to memory of 1076	2000	firefox.exe	77
PID 2000 wrote to memory of 1076	2000	firefox.exe	77
PID 2000 wrote to memory of 1076	2000	firefox.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\free.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\free.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.0.1559672195\429623370" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6592a3de-be9c-4378-8e7d-d22d049fa8d9} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 1800 1755d603e58 gpu
    3⤵
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.1.1489183197\66341979" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cae2cfa1-b289-4713-a066-e7ed2f5ebc3a} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2152 1755c2f9258 socket
    3⤵
    PID:3564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.2.1829693704\1250029943" -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1e872fc-e413-4a63-a4f9-34d4cf7eab15} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2744 175603d2858 tab
    3⤵
    PID:1076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.3.374384701\1252110434" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 2736 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e3cc5b7-1d06-4810-89a1-ecd8bbba7b99} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 3468 17551360158 tab
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.4.1944800817\1425916420" -childID 3 -isForBrowser -prefsHandle 4660 -prefMapHandle 4656 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81cfbef-bc74-4089-bb51-aafc70eac497} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4672 175628a1f58 tab
    3⤵
    PID:1680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.5.229089882\318381178" -childID 4 -isForBrowser -prefsHandle 4812 -prefMapHandle 4816 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebe8bd14-1535-408f-a70e-3716e700255c} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4804 175628a1358 tab
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.6.1539812943\1106670278" -childID 5 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1248 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27eaed7-ba22-4033-818a-db737d4dbd27} 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 4992 17563669a58 tab
    3⤵
    PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e8f354400c64699513f608f6e8f8cc90

SHA1
8780625ad791f52576c8a2b7e31133a4ca189fab

SHA256
79dee9400b808a3b0f346c61717d12ff14e65d045bba2c131bdc7f203031837c

SHA512
9f02cf40cc5f568e7ca05d48312a4cf3f413f9874abefa3b4c398e6392c232eab21ca2f06f9cc30765decc5c7fb05659cb93bbb86bb6f33f707dbf1b080d3320

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\a4aa1555-4dce-4bba-8339-67bb3629d0ca

Filesize
746B

MD5
1cea641218b6ba97cc167876acf90a87

SHA1
f8534105b2228b38439040e2339b7cf30920a153

SHA256
f1a4591b0e72c745cff11adf4dfc63d4a44c43928cb4c2173098e6c126aed942

SHA512
71e72ac3ac7387ab8625b6798de92719c99c75ed431066050b656fab7e09e0f61a14dd1dc28839e10f326a6dd8b9fa5e129b7f43ed5affe3e7b12c116c1dfc56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\ea37dc01-4499-49e6-8ccc-bc7eff9cb07b

Filesize
10KB

MD5
439b1ff760a8ed9ca6a83b3b02e7666b

SHA1
19da07b353224c501dc24391ca02cdbec4032a71

SHA256
5f1d06b945e45e550fe265f1a88c42a59fe7a3c7122e15bbb89ff36629a8f705

SHA512
663f0da95595d1e28276a26dcd30b9262a3f5fbbd21d63e54e25d68d42dd6d5994326bdd4939a216f41ca2e91dba3591bbc349b74e4f677568e8a00a03b99043

Download Submit