Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
FirefoxReportLogs.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
FirefoxReportLogs.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
WebUI.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
WebUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
FirefoxReportLogs.exe
-
Size
1.8MB
-
MD5
ceef4762b36067f1d32a0db621ee967e
-
SHA1
d23da38df6b0fca8c524b641c59c700a2338648e
-
SHA256
efb6169bbb869a849afb91184a75b906fe509cbf6e672b6b4f3311c02343bbbb
-
SHA512
6301871a95e48f2873b60c706757af38d956c895112f14c28eac4c4a83456a1acdf15d0a5b1cd35f267a4149dc78b2469c427bde6a1bf5aa99de51d5e824d1b3
-
SSDEEP
24576:fMWohhojVlG981FE03Pb+Cp67LkDdlXUi+nNv3O5AcAQNwuWSfJST4HCLgCGT/TH:KhujVl6p8UiaAKRT4HCUN1
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FirefoxReportLogs.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FirefoxReportLogs.exe" FirefoxReportLogs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FirefoxReportLogs.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FirefoxReportLogs.exe" FirefoxReportLogs.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\http:\15.228.77.178\ytr\serv.php FirefoxReportLogs.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2112 FirefoxReportLogs.exe 2112 FirefoxReportLogs.exe