Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 02:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mailto:[email protected]/?subject=FOLLETO-SUBCONTRATACI%C3%93N%2B%20Nombre%20%2B%20Tel
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
http://mailto:[email protected]/?subject=FOLLETO-SUBCONTRATACI%C3%93N%2B%20Nombre%20%2B%20Tel
Resource
win11-20240508-en
General
-
Target
http://mailto:[email protected]/?subject=FOLLETO-SUBCONTRATACI%C3%93N%2B%20Nombre%20%2B%20Tel
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 2364 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 4556 wrote to memory of 2364 4556 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 2548 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe PID 2364 wrote to memory of 5092 2364 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://mailto:[email protected]/?subject=FOLLETO-SUBCONTRATACI%C3%93N%2B%20Nombre%20%2B%20Tel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://mailto:[email protected]/?subject=FOLLETO-SUBCONTRATACI%C3%93N%2B%20Nombre%20%2B%20Tel2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.0.669608870\1463152187" -parentBuildID 20230214051806 -prefsHandle 1800 -prefMapHandle 1792 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04430049-353a-456d-b929-a589204bcc7f} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 1880 1f912104d58 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.1.1850299432\127116076" -parentBuildID 20230214051806 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e249d4b-a762-4a6f-b36f-f5e6b8e5a72a} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2424 1f90538c258 socket3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.2.1402326310\678319399" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 3004 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27096f33-1d4a-40d0-8bf9-0eeed732349c} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2984 1f91503c158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.3.987253755\383472374" -childID 2 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b2546ea-e5a0-4ae7-84f3-3e925df52f39} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3932 1f918138658 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.4.957250450\1607603360" -childID 3 -isForBrowser -prefsHandle 5160 -prefMapHandle 5156 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bb3127d-e46a-4e25-a14f-5f9630488623} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 5172 1f91ad6e358 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.5.63088875\1367585230" -childID 4 -isForBrowser -prefsHandle 5392 -prefMapHandle 5388 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c109da74-5302-4389-91dc-a1e056f124bd} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 5400 1f91ada1b58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.6.1978977511\1555078993" -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f540bf10-9f62-4488-bf6f-f46354855f3f} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 5516 1f91ada3658 tab3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9w3t05jh.default-release\activity-stream.discovery_stream.json.tmpFilesize
23KB
MD56d665de95bb00d42ec65ea2e2865862a
SHA12ca1552f8c66024cded35ff253060520b6b5b098
SHA2561183a970348c1c142b1ca4f9ae2fe90ed5bdc5fcccf51196e7b948bf72df14cb
SHA512df0061f2e81b00abd685280a1db1ef0df0f7c0e785db72ed88d2f9bcabc1ebf0faa5c28df38ba6926423e461bede280b68c285d7b6bf02c1293acdf9d4a5af90
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9w3t05jh.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649Filesize
13KB
MD5b5c723a9313a8b9bb15c9ea0204eea9d
SHA153ce308300d4350691e6a27c2264bf093c9e723d
SHA2567fb48d5a4917c4e59c642486806283e2345af4488245c389d00685e9531bb8bb
SHA512059e2cb5a95e2bc297a5bd69d6aab7c6a6a00fd30c806daa42ecfe766169abbfd9ebe6d44970a4bba903acb63fd1042feb469a77511bb42c99a11bf5be931a28
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\prefs-1.jsFilesize
8KB
MD56ca6c5ef7c0a2773d1e2e6a359940231
SHA150f41d95492b7dba8207f51da97521d77120890a
SHA256bac52d07ae9745945c626364f764fe006a54924bd403110487574291a345c04d
SHA5124b1df36df451d3bfb0f6bbfb735719152580b17cb2bdd6f5af1b95a6527d3759f49e5a5e7342623956a11f9e843eb588214d57a62635e72005a4143f95738d93
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\prefs-1.jsFilesize
10KB
MD594bcf4ae55de8ddced94a6cbc5ec5970
SHA12f385423d4beca37f9bd83ddb13ad08a249698cb
SHA256298a1e944a6ba471d00af021cfa27e2c1b5ad29cdf000652a0af8214ce998d66
SHA5121b7d9d3d8c78e4ab411372643e174b0f751398c6f205884cfcb26631d35db533bad0e0ee91f162a177e888328d32ef62a801b407693ccf37cb880ee998abb7ed
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1017B
MD5ab88a14159c5594f07212bf0dfb20906
SHA1db19b63b34f496db278269f112ed7ce7abc7b6b2
SHA2568550446e2b2659d3e0b40a8cbcd3a419c745cbbfc85d4e979e1650f5c8324895
SHA512850fe25cf9f59cc4082ce884cee9ef8bec070088f1923580be2ba01080b7c57aabdd551d2df97d3647db0298edcd69ad834401c230adef3e632e970b051b4c32