mercurialgrabber | 010ffe6edeb4185ae04edeb175e4b444e1487f83e34c740c1701d48024dfec76

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	cr2dit-c4rd GEN.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	cr2dit-c4rd GEN.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cr2dit-c4rd GEN.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip4.seeip.org
7	ip-api.com
1	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cr2dit-c4rd GEN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	cr2dit-c4rd GEN.exe

Checks SCSI registry key(s) 3 TTPs 1 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	cr2dit-c4rd GEN.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	cr2dit-c4rd GEN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cr2dit-c4rd GEN.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	cr2dit-c4rd GEN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	cr2dit-c4rd GEN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	cr2dit-c4rd GEN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	cr2dit-c4rd GEN.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	cr2dit-c4rd GEN.exe
Token: SeDebugPrivilege	1256	firefox.exe
Token: SeDebugPrivilege	1256	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1256	firefox.exe
1256	firefox.exe
1256	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1256	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 4988 wrote to memory of 1256	4988	firefox.exe	101
PID 1256 wrote to memory of 364	1256	firefox.exe	102
PID 1256 wrote to memory of 364	1256	firefox.exe	102
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 4612	1256	firefox.exe	103
PID 1256 wrote to memory of 3184	1256	firefox.exe	104
PID 1256 wrote to memory of 3184	1256	firefox.exe	104
PID 1256 wrote to memory of 3184	1256	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cr2dit-c4rd GEN.exe
"C:\Users\Admin\AppData\Local\Temp\cr2dit-c4rd GEN.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.0.805085745\665935530" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {753f3461-cfb4-46e0-82a1-e508f2e120c5} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 1844 1fed93dd658 gpu
    3⤵
    PID:364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.1.846773815\31719001" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bef19f6b-f51f-4cd2-91a9-d942d5b4c4a2} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 2372 1fed92fd558 socket
    3⤵
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.2.527563887\841507056" -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 2932 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd370394-888a-4331-a299-eca96b51ff83} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 2896 1fedd49fe58 tab
    3⤵
    PID:3184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.3.145701259\1050469313" -childID 2 -isForBrowser -prefsHandle 3584 -prefMapHandle 3580 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44777e55-7125-475d-9e7b-53cda407ce88} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 3592 1fede273a58 tab
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.4.853589214\1114008359" -childID 3 -isForBrowser -prefsHandle 3968 -prefMapHandle 3964 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9aa2a65a-29c7-464a-aa56-270b122a6514} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 3976 1fedeb6c858 tab
    3⤵
    PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.5.760950995\352542387" -childID 4 -isForBrowser -prefsHandle 5152 -prefMapHandle 5148 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a162f9fa-debd-4d28-bac7-36edf3448dc7} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5160 1fec5761058 tab
    3⤵
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.6.712886519\968391158" -childID 5 -isForBrowser -prefsHandle 5288 -prefMapHandle 5292 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee0fd0a8-eeb5-4923-af58-d9e6ee5e9579} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5280 1fedeb6c558 tab
    3⤵
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1256.7.308702253\795352344" -childID 6 -isForBrowser -prefsHandle 5496 -prefMapHandle 5500 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06fad635-f499-4442-8c3e-418049e3705e} 1256 "\\.\pipe\gecko-crash-server-pipe.1256" 5488 1fedfa33858 tab
    3⤵
    PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4936 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion