e627d7709bd65f4c43157df5a13ae109d6cb6c4b9c991f26e1739c2422a1315a

Resubmissions

06/05/2024, 15:08

240506-sjbtksba668

06/05/2024, 15:05

06/05/2024, 15:03

06/05/2024, 15:00

06/05/2024, 14:59

06/05/2024, 14:40

Analysis

max time kernel
99s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HL_ucheniy.jpg
Size 5KB
Sample240506-se89aafe41
SHA256 e627d7709bd65f4c43157df5a13ae109d6cb6c4b9c991f26e1739c2422a1315a
MD5 9ad53fcca40122a3c259fd5dc9776775
SHA1 05a701bfc794b31b4605df0d72b2109e2f1918ef
SHA512 87bf5484ebcbb6f0e1320dc189dcda302bcf62ed64dd73ab0d6c20c982a180b4d9d681a5fb065d05d2bf949addf7356b0b06b831476a0dec593667fc3313fd36
SSDEEP 96:/WkR7QJRwPwpgtieTQAbTl31CnkZvxYdFH7VJY/818vLNFmnh6sPLspETMyZqh:/oSwpyi8skZveH7VK/A8jTmHjmEIyZqh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTcbPrivilege	740	svchost.exe
Token: SeRestorePrivilege	740	svchost.exe
Token: SeDebugPrivilege	1028	firefox.exe
Token: SeDebugPrivilege	1028	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
1028	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4796	740	svchost.exe	97
PID 740 wrote to memory of 4796	740	svchost.exe	97
PID 4928 wrote to memory of 4200	4928	OpenWith.exe	116
PID 4928 wrote to memory of 4200	4928	OpenWith.exe	116
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 4200 wrote to memory of 1028	4200	firefox.exe	117
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 264	1028	firefox.exe	118
PID 1028 wrote to memory of 4504	1028	firefox.exe	119
PID 1028 wrote to memory of 4504	1028	firefox.exe	119
PID 1028 wrote to memory of 4504	1028	firefox.exe	119
PID 1028 wrote to memory of 4504	1028	firefox.exe	119
PID 1028 wrote to memory of 4504	1028	firefox.exe	119
PID 1028 wrote to memory of 4504	1028	firefox.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\HL_ucheniy.jpg
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\system32\dashost.exe
  dashost.exe {5997c4f9-9015-4361-b33b6cdfebb333b0}
  2⤵
  PID:4796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ConnectUse.bat" "
1⤵
PID:1160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x504
1⤵
PID:4596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\áT■ä│∙"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\áT■ä│∙
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.0.1904214220\1736766311" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1736 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {116cf050-a17f-4570-b263-33ebaa81d9e2} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 1836 22347b23e58 gpu
      4⤵
      PID:264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.1.329136842\1121323951" -parentBuildID 20230214051806 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f066d77-b2b4-4f7a-b154-395e94a46b13} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 2428 2233ad84d58 socket
      4⤵
      PID:4504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.2.1674457932\127397754" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1811f37a-b393-472e-81d2-441c856bfd7c} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 2996 2234aa3ad58 tab
      4⤵
      PID:2840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.3.572840729\357459584" -childID 2 -isForBrowser -prefsHandle 3808 -prefMapHandle 3804 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6da5d36-35ff-49a3-bf5e-263dc31a8378} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 3836 2233ad76e58 tab
      4⤵
      PID:2628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.4.482651545\349880638" -childID 3 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91b5c422-4d44-4cd1-a9d0-f2af1e94e713} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 5036 2234e4bd458 tab
      4⤵
      PID:1996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.5.714700328\1608405740" -childID 4 -isForBrowser -prefsHandle 5240 -prefMapHandle 5236 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a23e288-db98-493c-99c5-f9a06253b043} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 5248 2234e4bd758 tab
      4⤵
      PID:1536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.6.1719971333\430008322" -childID 5 -isForBrowser -prefsHandle 5064 -prefMapHandle 5344 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46473e36-523b-4937-b69e-917e919fd107} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 5128 2234e4be358 tab
      4⤵
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nzxw1g49.default-release\activity-stream.discovery_stream.json.tmp
Size 27KB
SHA256 e11c80a87adf3a1603e34f49415f4f49d6978db3058d70eb5cb4b86a566008f4
MD5 a7d50aec57d8635eb121a6a601dc4c4e
SHA1 9a9dae40235ae4f4f4a700dce600208a145af0f0
SHA512 b5c07e61edb1c189c2b4bb65eb830eea49e0577dfa912010edb59211b4758130ffcfaf1d749bc42650c517f7116c749a74f10dc185ebacd209e6b9f304f277b0
SSDEEP 768:r4MCegEgasXoVPqMggEjWHaTE/A1dayduUwU7b:0MCf9asXoV/ggEqHa4/ALh0N0
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\prefs.js
Size 7KB
SHA256 fdd68401ff9a526e9840a5409257853e4a55b4bc6ae8a1bda4be3a24343fe098
MD5 c7e1e562ff0289b8d141516a4802aa04
SHA1 b1a30018b36b77e589b4222611200fec63ed0e67
SHA512 8154c350e0a5d8396350d94dd5d5a79ef17ea9f0598c4555d3acf968cab088d1c3e7ba24762ad615b318e8c295de19742cf24a75e10d8b85d98d911994e728de
SSDEEP 192:455neRzfjEgoC0Xbo3IYaZ/ReA2Bw8HcUF7So:lgyIYaZOw2F7f
MD5 SHA1 SHA512 SSDEEP