Overview
overview
7Static
static
1URLScan
urlscan
https://llective65.d...
windows10-1703-x64
1https://llective65.d...
windows7-x64
1https://llective65.d...
windows10-2004-x64
1https://llective65.d...
windows11-21h2-x64
1https://llective65.d...
android-10-x64
7https://llective65.d...
android-11-x64
7https://llective65.d...
android-13-x64
7https://llective65.d...
android-9-x86
7https://llective65.d...
ubuntu-20.04-amd64
4Analysis
-
max time kernel
57s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-05-2024 12:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://llective65.de/invite/i=63719
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://llective65.de/invite/i=63719
Resource
win7-20240508-en
Behavioral task
behavioral3
Sample
https://llective65.de/invite/i=63719
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
https://llective65.de/invite/i=63719
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
https://llective65.de/invite/i=63719
Resource
android-x64-20240514-en
Behavioral task
behavioral6
Sample
https://llective65.de/invite/i=63719
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral7
Sample
https://llective65.de/invite/i=63719
Resource
android-33-x64-arm64-20240514-en
Behavioral task
behavioral8
Sample
https://llective65.de/invite/i=63719
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral9
Sample
https://llective65.de/invite/i=63719
Resource
ubuntu2004-amd64-20240508-en
General
-
Target
https://llective65.de/invite/i=63719
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 3616 firefox.exe Token: SeDebugPrivilege 3616 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 3616 firefox.exe 3616 firefox.exe 3616 firefox.exe 3616 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 3616 firefox.exe 3616 firefox.exe 3616 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 3616 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 2280 wrote to memory of 3616 2280 firefox.exe firefox.exe PID 3616 wrote to memory of 196 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 196 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 2060 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 5100 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 5100 3616 firefox.exe firefox.exe PID 3616 wrote to memory of 5100 3616 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://llective65.de/invite/i=63719"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://llective65.de/invite/i=637192⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.0.253022339\227962871" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1740 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62031ced-73e3-41c6-80df-bfd2d446afd4} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 1828 16235bb7058 gpu3⤵PID:196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.1.197384554\214545684" -parentBuildID 20221007134813 -prefsHandle 2192 -prefMapHandle 2188 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c258ec23-9167-4178-8007-a50cef5d8f45} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 2204 16223570458 socket3⤵PID:2060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.2.808624346\147970281" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 3032 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ca58a50-ca3b-4604-b538-effb6bcc51e2} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 2804 162398d0158 tab3⤵PID:5100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.3.1204889650\1911979210" -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 3688 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {606008d5-de83-4124-8af6-62c6bda5b3fd} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 3704 16223568a58 tab3⤵PID:4564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.4.1434487517\2132736021" -childID 3 -isForBrowser -prefsHandle 4712 -prefMapHandle 4476 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efdc082a-5218-4d4e-970f-7d8f75c7de0a} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 3824 1623b827858 tab3⤵PID:1004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.5.2033262080\1538823808" -childID 4 -isForBrowser -prefsHandle 4848 -prefMapHandle 4852 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {122842c1-5391-4336-ac07-67921486f210} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 4840 1623beb6e58 tab3⤵PID:308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3616.6.78242574\1597320609" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 5024 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d0306ad-168c-4542-ace8-c123007ed8d3} 3616 "\\.\pipe\gecko-crash-server-pipe.3616" 5012 1623beb7158 tab3⤵PID:1452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD54b9b66c05fd84586c00edd2d4fb6b888
SHA1f747b29e1f51d7714dd6993eb88774d4cb7b6a0a
SHA256a5317b8d1f49a07f39bc69e2cb878a4446d8502fbba7e638190e40c90f5ffb49
SHA5122159dd6f0a97d3d9b6b6eaed7b1a595622d16536f7bd849b9bd7c19104cb67cabcdc6ce892156545bb44d044edee16a65eb75e6552ef998283947a0037e83fc3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\74b3e2f2-5802-4c87-8a04-8e685281afcf
Filesize9KB
MD5131fbd1e0e475b7398bf957fded00fd1
SHA1ccd9428e35af6ed97967cc74996b470982098790
SHA25636cbd0c63b19cc05144050ceb96ed4e12068afc6f904ee8246f55f7e11436d2c
SHA5123913aead1de0cbb2e05fe5f57b7aaeacaf25fac25ada9c86b3c28dc51761a5e097cfdf0d6d84febe16e02467a6841c1bc2f88087153c366642e66df86324feb5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\969255ef-466d-458b-8ede-bf3e297fc1fb
Filesize746B
MD58715233603d449810f876f33c6787447
SHA14afa7401c6f3f92f8318c8c090027a3405b5c217
SHA25652f06f28eb6caca199d6c94859e7bc0bc1f7037ba614995edd57d43a0521a8fb
SHA512e0daf8c059294cba8802a2a1fdf540dcf3140f0c57c30d0fd23d545f943d37fd6c669f6d618594f7433dcad4557089589789c21c4580c60ef3c874edc59bbb32
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5b6a44e2198d1ccaff4e9cc4206fbaece
SHA113c8b3e18de4538ed5238a6a8f3d0485bb02924c
SHA256b141accc9f04472ca031c14757bd2a51584b5ef7dac4a8f487e90fff57ba0d04
SHA512c4545bc7d185961b1d3380e1634479b149f7ad5a022346c7eafd4b645f2a689edc7f1f4520adc3aa294ed2d5bd46516efa03bfa09ce76fdb029bc67b2a4228a8
-
Filesize
6KB
MD57e45aa5b8011b5bbcc2becf4008c7e1c
SHA153524220f13731d6f182ef193f62bd89c761c9c4
SHA256493d273b69a0e9ef0c81ed53d73a3f2537209ddcd0a6eaa1a36744d70be8fd4d
SHA512d807d7ab28220306a27b690c6d199794560eadf6aafecaf30ae412230668ac376c831e201c43cc18c2ae47f2ad70bcfca1ec9b143b406e0db1fff9e9c0df4cdb
-
Filesize
6KB
MD515ccb6044de7b24b2d626434000dcc26
SHA1e99dbd63ac9ed58f83f9536e71360c9617f4309d
SHA25614f40d2825423f549bdb7d95e2383f100068f67c0bcccc422e72e29243a88670
SHA512ccc19dc89aad7dd234045f60ed115975d87df253e72c37a1194287caf6eb05743327e4309a104260e3179561fcd52be0447b47192aee8734a11f85caf02de611
-
Filesize
6KB
MD5706994de8c57f50149efc63fecce4661
SHA117d7caf1f859deddd87a3d2ef0520bb1e2c2c5aa
SHA256969032b733ab1c9349bfbb1e2cf22c6863cb8cdc0b0780f1a4fdd121bd2382f6
SHA51290b9ed2d2be1e4dffd02622fd77fed634118875149be9603ede329f92d7e2a728c0bb0bea20fc0a85065adea5fc6c8e6c10f266ef79692c53dc859fe898bcbae
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5abfefc37d42b174fa2b7deaa142aeef1
SHA1f36610a3b6996c5b42223092aac5aa231ff377ea
SHA256c5aae10f6b38ec6dbc6a9a1244d8e5dd240aca661d3d86ccc69dc77913515750
SHA5121252cacc80ea62d075cc9e1419dd4a4e3b1ff1fdf053befef9fe1c21731c4630c81c5b93e4768ca5621ff0127872ede4a487b10c78698893d5fbb83c5341adf5