hxxps://ad[.]doubleclick[.]net/clk;275260754;102106837;b?hxxps://tinyurl[.]com/2uaxysyy

Resubmissions

17/05/2024, 14:00

240517-ra312abc347

17/05/2024, 13:59

240517-ragg2aba5v1

Analysis

max time kernel
47s
max time network
48s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
17/05/2024, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ad.doubleclick.net/clk;275260754;102106837;b?https://tinyurl.com/2uaxysyy
Sample240517-ragg2aba5v

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	firefox.exe
Token: SeDebugPrivilege	1132	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1132	firefox.exe
1132	firefox.exe
1132	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1132	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1856 wrote to memory of 1132	1856	firefox.exe	77
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 2088	1132	firefox.exe	78
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79
PID 1132 wrote to memory of 3120	1132	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ad.doubleclick.net/clk;275260754;102106837;b?https://tinyurl.com/2uaxysyy"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ad.doubleclick.net/clk;275260754;102106837;b?https://tinyurl.com/2uaxysyy
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.0.1860402211\6140536" -parentBuildID 20230214051806 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55daa03c-9b7e-4249-a853-50737b3e0332} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 1884 2161a60da58 gpu
    3⤵
    PID:2088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.1.1386961487\1128858758" -parentBuildID 20230214051806 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8393e76-375c-4056-a90b-afe2b38aa98a} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 2440 2160d985958 socket
    3⤵
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.2.1658181839\1830851762" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27f31e0c-cb14-4f69-b71c-794f6470565a} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 2972 2161d646558 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.3.808403078\95818525" -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3656 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e46aa457-38f0-4fc5-b1a4-192b21fabbc2} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 3668 216204b6158 tab
    3⤵
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.4.1559198403\874129506" -childID 3 -isForBrowser -prefsHandle 5144 -prefMapHandle 5140 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f52cde78-368e-45ef-a90a-ed60905e255b} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 5180 2162267cc58 tab
    3⤵
    PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.5.1628154923\1104629083" -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5308 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe810f0-7eae-47ff-a203-d25351fab4cd} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 5356 2162267b458 tab
    3⤵
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.6.2062071396\271240997" -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60e2452e-99a0-47a2-a4f1-db7f6340e181} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 5512 2162267c058 tab
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.7.361553592\1355369544" -childID 6 -isForBrowser -prefsHandle 3008 -prefMapHandle 2968 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee6206d0-4e2d-4460-b057-2ad78c4a2e5f} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 3020 2161d646558 tab
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1132.8.837086908\1538304891" -childID 7 -isForBrowser -prefsHandle 4736 -prefMapHandle 5264 -prefsLen 28039 -prefMapSize 235121 -jsInitHandle 936 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e6e6ceb-b6a1-4f74-bf1f-d8d561f6d6d2} 1132 "\\.\pipe\gecko-crash-server-pipe.1132" 5276 2161a60f258 tab
    3⤵
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dpu1uz4v.default-release\activity-stream.discovery_stream.json.tmp
Size 24KB
SHA256 6ff2ce047af44477b4ab1e25fdba9b4b740d7c54bc9772e0bddd287eefa19244
MD5 f7a4dd8ceef4b04641da81ca286ca926
SHA1 1ab55b0866abaf689f9a0cd3ff6a9a378be8dae9
SHA512 6d74a8d2f66a6d44dca949f7a1ee448aad0a089f96e27d939f50979bf219137c87a54d5cc02c9293a297d45e38dafff17193fe7c24a6668f507cb02701412af7
SSDEEP 384:rruq+d7mwzOenf+BQ64OW8WZ+v6AGZe7dbbnxtaYZokN0cY5GI3Bxz17nveyaa:rrSd7mw3fnTYNl3nbZU5GI3z1vey1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dpu1uz4v.default-release\prefs-1.js
Size 6KB
SHA256 a26639758e291e86c2e91c479b93dae77d50b12035dd87a271b3c87495831228
MD5 405dd6d661233dcf04cad079b86e17d6
SHA1 9d56fe0e45eff0a680e073dd7d38b32d8cac7aa5
SHA512 5ee054bf40059b00c0a54fc49f9c17cf8bee757401ee00c80bf3fb022cf078a813366498ee8c66016b4c7b7bb4ee965ce664c9775fedcf291f707a0272b4908e
SSDEEP 192:VX5nJRYf6pKR0Xb13IYfjY06nBw8H8JBS/:VWsVIYfx6Bw/BQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dpu1uz4v.default-release\prefs-1.js
Size 7KB
SHA256 174b7ca1ccf6355a445d40c8c7a0e72051b27b5890dc61b758be6dfb0c69eda7
MD5 0459c5ed718758abef4ab9ed1479edd3
SHA1 bfc3d6a956c74d9f273ba20d5e2f0e4c1e04962f
SHA512 710a8f1de3cf388c76985888be9a8bcd6daa316c1fcf83a2ee620e3ce6f63ed725cdeedebb8897ce12c4dbbf35b748c5f1a48ac92a4470b97b3f9b6657c89bf0
SSDEEP 192:VX0nJRYf6pKR0Xb13IYfjY06nBw8H8JfS/:V/sVIYfx6Bw/fQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dpu1uz4v.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 5e3d74ec304d5b1e14c19ae6e3a9c4a8873f5c2e991c2429a4ba84a5d73bfdec
MD5 26e61a03a34fc4b45a564477565ec54e
SHA1 ac625da06ea32ef94e6abf5449791a04fe300868
SHA512 cabba33c20b30779d8a3fb500e275fa904d8c7d505f60e5b40ffef3ffcd95df75d6de235f1eeaa7dd0345ec299e5173bffa78ba7d8b02e853114b71b30e5b3ef
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dpu1uz4v.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 d266a2f0a5088932944b348230d0982a0a20fc271fa0e4a29312a730f1b0be14
MD5 89255ce2c0a9b6b063577951ca365047
SHA1 b44c8b1ff122262337bd66500896bed86eaaae5a
SHA512 74f3c2e92ff774196e4c308c355d2344717ba74d3a5a298f6c4f2805f87db23cbe173ada6228eab22e459094d5ef987ab8c5e9545ef437c0d0cca3b50fa8c24f
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads