Analysis

  • max time kernel
    141s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 18:17

General

  • Target

    https://klienci-indywidualne-santander-pl-sa.markoref.com

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://klienci-indywidualne-santander-pl-sa.markoref.com"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://klienci-indywidualne-santander-pl-sa.markoref.com
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.0.1120074229\380022324" -parentBuildID 20230214051806 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0b9658-f245-4753-bbaf-e82d84c6cf0a} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 1884 298db617d58 gpu
        3⤵
          PID:4376
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.1.2013895348\226854538" -parentBuildID 20230214051806 -prefsHandle 2448 -prefMapHandle 2436 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c7cfa89-679b-4eaf-a50f-87a3cd2b22ef} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 2476 298c7384758 socket
          3⤵
            PID:3496
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.2.709818814\806632736" -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 2896 -prefsLen 23030 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c7b18d0-7dd2-4b2d-bf12-8c21fb094c66} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 2972 298de436858 tab
            3⤵
              PID:2192
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.3.1165058965\227804653" -childID 2 -isForBrowser -prefsHandle 4104 -prefMapHandle 4088 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7c026b5-7a76-4164-9919-2afe7bc584f9} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 4116 298e00dae58 tab
              3⤵
                PID:3776
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.4.1724790944\1672641571" -childID 3 -isForBrowser -prefsHandle 5092 -prefMapHandle 4928 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f727196e-7876-44d2-a85b-3819a7718d01} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 5108 298e1e32458 tab
                3⤵
                  PID:388
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.5.903796514\835457682" -childID 4 -isForBrowser -prefsHandle 5252 -prefMapHandle 5256 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bd47f8-3d3c-4ca1-a661-457afd1e9e6a} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 5244 298e1e33358 tab
                  3⤵
                    PID:3524
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2832.6.263058316\1119739788" -childID 5 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {086c7aa4-82a8-4644-bcdf-5915a1c38fc5} 2832 "\\.\pipe\gecko-crash-server-pipe.2832" 5436 298e1e34258 tab
                    3⤵
                      PID:3856

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\activity-stream.discovery_stream.json.tmp

                        Filesize

                        26KB

                        MD5

                        1a3a4d3529648aadce8067c8127987b3

                        SHA1

                        b07d5f9778f95fd4c49e42ea0329cfdd245193c1

                        SHA256

                        79869de2f4ab8e43f0dec83ea9fb9c3f19c5e2f0e4ffd887fe3afba92118c507

                        SHA512

                        373470d41977e164d728dfd4391f4975a073c53b05728aa59ceab0dedaafadf503ab1d4049b5147c57853a8af91a9d267be34362a30674de4ec77082d09788fa

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

                        Filesize

                        13KB

                        MD5

                        d2d8f4631701295fe5d39bc2f1d75aa8

                        SHA1

                        3c3c58b4a9024825b7a44a7c57fa6c36e7e53e01

                        SHA256

                        5b1987334c5bcd583efc1b0055fb27633cbb84104a4985d648317e15b5e82471

                        SHA512

                        1d814dd5b39b69e378cdc5a274746e064a8be3923f16761293da2baf022f6cd8d48a975832638a98c08a55fcbfb73d9b75ba8b8d99ce41193912ba95cd3af436

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        8.0MB

                        MD5

                        a01c5ecd6108350ae23d2cddf0e77c17

                        SHA1

                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                        SHA256

                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                        SHA512

                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                        Filesize

                        372B

                        MD5

                        8be33af717bb1b67fbd61c3f4b807e9e

                        SHA1

                        7cf17656d174d951957ff36810e874a134dd49e0

                        SHA256

                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                        SHA512

                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                        Filesize

                        11.8MB

                        MD5

                        33bf7b0439480effb9fb212efce87b13

                        SHA1

                        cee50f2745edc6dc291887b6075ca64d716f495a

                        SHA256

                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                        SHA512

                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                        Filesize

                        1KB

                        MD5

                        937326fead5fd401f6cca9118bd9ade9

                        SHA1

                        4526a57d4ae14ed29b37632c72aef3c408189d91

                        SHA256

                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                        SHA512

                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

                        Filesize

                        9KB

                        MD5

                        ea2a60281edc2376a6c4cf47af4babf8

                        SHA1

                        bcf48af7c87b0626cc08f7eb45ba9625419445bf

                        SHA256

                        2e15e4315da634c8287dbc91ac1a318e1134bd305d0f71278b237122cf5a9ee7

                        SHA512

                        eced4d1cf2b1665913d2854704620af089edae860ee787e0e3f4b29b2cba9660b5165714693eeb1e6945c90fa6d4dd5b1a3530f4a17506cc324bd8cf0ba07d4b

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

                        Filesize

                        8KB

                        MD5

                        1367bd5d1e1e718eeccf3913250fb835

                        SHA1

                        e5549f457582d063295c40607e7e47c57ac7ced8

                        SHA256

                        3493cdc5ebe0c3bb59ef05a11033371a07f78702cc01c6153ae2fe5ec72616a1

                        SHA512

                        751df82c75e200ef667c140cedbaa480ec7fe980b88d4d4dcab087fdad4eab5d1b038a1e77d06deb950fa7a4edfbb8b29bef52aa78be18a90cf07d691490b311

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        148b9f8cd8a0ad5054b9cd83f1450cb5

                        SHA1

                        258f6ee4c2ed53f62cc9c07d7e9b191ff31c5772

                        SHA256

                        a5e5970941350a12af444bee9dab5639558f2f38a9b3445e4d8d0af2342ad810

                        SHA512

                        0d918e35e5e2e09a8148a501028a74c1b36f78f652d335f4d694b7ba4277524ef47d78cc4d25a7a97ceaa7c551d88d6576e47d963ef0ff81cc8d58b65ac17bdb

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\prefs.js

                        Filesize

                        6KB

                        MD5

                        239a4024882a798bec28cb99b14ca94c

                        SHA1

                        ba08a21f72aa9e9ff949986db8c1eecdc72c9de6

                        SHA256

                        bbf16bee7a12b84f709cda8dce7e40832bf65e4bad50e7f3b41fd249a2258a66

                        SHA512

                        8b58e8c187a7bf8ae94d10fada25682945475fa0b477b01b86611d4af501248343fd29c23ea792e4728d054a8162ea41b7ba50dba60380d9b639f8d5fa28d211

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        1KB

                        MD5

                        f5565b6a2436a15f3c06b4ef1a76e9f8

                        SHA1

                        038f85d4029b0ba931a9da671ddfee7f48f8c604

                        SHA256

                        577fb9a4b868666ab8d23d6c3707f0ea9b24d40f783d1317847642f7fe35b7da

                        SHA512

                        40f0f38e4ecbe4e44c98d04dca978bbff4b112fd9a83882c05d8f244fbc523ac263fddf1fec07119efc5bbeabbcd370b1ab010ea9d293bca8a3578e07d1f576f