Analysis
- max time kernel
61s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
36925203-7013-a10b-ba7d-20fcaf7c1618.eml
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
36925203-7013-a10b-ba7d-20fcaf7c1618.eml
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 36925203-7013-a10b-ba7d-20fcaf7c1618.eml
- Size 17KB
- Sample240529-j6versha62
- SHA256 72dab8ecbdbc7a30ecd3c47c09514a89f4c3486101e18b4edb6111dc6c522d4d
- MD5 020474fc07b0080dcf225fbcfd4ba120
- SHA1 9542152e8a0db447e647d65fe8688b9da51f5fc8
- SHA512 c451d09a355f90aba883813d674bf8e8c209d6e4a4da3fd3699d814370a9f1ecc75fcafd26e37347af72b87b03601d2b3bf9827431b49b6e5924ccd0e68e0c3a
- SSDEEP 384:bqrXhct497GBHEVLJnTxDrn8b8pBbQ5O+YFYAxMQXqvhi/T0duRem:wKt5iVL5TxPn84Gm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings cmd.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\36925203-7013-a10b-ba7d-20fcaf7c1618.eml:OECustomProperty cmd.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1428 OpenWith.exe 2664 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4892 firefox.exe Token: SeDebugPrivilege 4892 firefox.exe Token: SeDebugPrivilege 4892 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4892 firefox.exe 4892 firefox.exe 4892 firefox.exe 4892 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4892 firefox.exe 4892 firefox.exe 4892 firefox.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 1428 OpenWith.exe 4892 firefox.exe 4892 firefox.exe 4892 firefox.exe 4892 firefox.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe 2664 OpenWith.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 3536 1428 OpenWith.exe 95 PID 1428 wrote to memory of 3536 1428 OpenWith.exe 95 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 3536 wrote to memory of 4892 3536 firefox.exe 97 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 3224 4892 firefox.exe 98 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 PID 4892 wrote to memory of 4444 4892 firefox.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\36925203-7013-a10b-ba7d-20fcaf7c1618.eml1⤵
- Modifies registry class
- NTFS ADS
PID:1800
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\36925203-7013-a10b-ba7d-20fcaf7c1618.eml"2⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\36925203-7013-a10b-ba7d-20fcaf7c1618.eml3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.0.1649321278\1997704058" -parentBuildID 20230214051806 -prefsHandle 1780 -prefMapHandle 1772 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2c14e05-fdd5-4654-b1b9-985910f1bf82} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 1868 1933a20d058 gpu4⤵PID:3224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.1.1620876948\1971905836" -parentBuildID 20230214051806 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bc85ebf-be89-4453-b21d-b406f185d79f} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 2460 1932d58b258 socket4⤵PID:4444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.2.2096488590\387843341" -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 2904 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d82227dd-56cd-44c0-97f2-24b50c68f470} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 3120 1933d24a258 tab4⤵PID:4028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.3.130367272\1236908868" -childID 2 -isForBrowser -prefsHandle 3584 -prefMapHandle 3580 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a578056-312a-4347-94f9-4eafca08930e} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 3596 1932d57be58 tab4⤵PID:3492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.4.2000220274\93900926" -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5252 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd6cb44a-7333-44e8-b367-60037b47ba74} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 5260 193414b1258 tab4⤵PID:4328
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.5.1635499731\1344328436" -childID 4 -isForBrowser -prefsHandle 5480 -prefMapHandle 5476 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7558768f-9455-4710-af26-09751aa3768d} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 5488 193414b1558 tab4⤵PID:4464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4892.6.712311730\1791151345" -childID 5 -isForBrowser -prefsHandle 5624 -prefMapHandle 5628 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3edcea11-e802-44d7-9079-ea89fcc583f2} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 5616 193414b2458 tab4⤵PID:4268
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4824
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\36925203-7013-a10b-ba7d-20fcaf7c1618.eml2⤵PID:928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\activity-stream.discovery_stream.json.tmp
- Size 27KB
- SHA256 52c592a6a15806cbafcd549b09038b29e55aa7d585c6c07de252bee0f455f75f
- MD5 b0deb0edf966cb9e3eca8a0be8f5acf0
- SHA1 fba71819ff4ea05e2c0b0515492221fd9db2a01f
- SHA512 2f629857530c92d3621d0834f8af6448acce76fe3a9de9cabc3588f92b2c2d21ac3ae692cc5e80d479e89e766c2f0c28b6e0bb524012cbc3a37720b3a231f0b3
- SSDEEP 384:rM7WMcnIBKEPzrbXI4L6/1XLID+9Rg5b73ryg8yaunnyxMnyxu1f:rMSMcIBKKr5+j4b73ug8ydy9sd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\36925203-7013-a10b-ba7d-20fcaf7c1618.eml
- Size 17KB
- SHA256 72dab8ecbdbc7a30ecd3c47c09514a89f4c3486101e18b4edb6111dc6c522d4d
- MD5 020474fc07b0080dcf225fbcfd4ba120
- SHA1 9542152e8a0db447e647d65fe8688b9da51f5fc8
- SHA512 c451d09a355f90aba883813d674bf8e8c209d6e4a4da3fd3699d814370a9f1ecc75fcafd26e37347af72b87b03601d2b3bf9827431b49b6e5924ccd0e68e0c3a
- SSDEEP 384:bqrXhct497GBHEVLJnTxDrn8b8pBbQ5O+YFYAxMQXqvhi/T0duRem:wKt5iVL5TxPn84Gm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs-1.js
- Size 7KB
- SHA256 ffb3b7b9e3c6211ca8003851c0248315772eb93d7d4d8d06fc36e490a6c912e9
- MD5 3e46d98900a664eeb9cd200cf300020a
- SHA1 0a1ae32c7db7e96ffabee1eab75787caaa82d720
- SHA512 dbf98be55d2372cc436948c8de8b8e32423a1c9169d78e1f1a97bfbd30c894a8c3ef0f680f663328bfb1e9451a012794feb0c127702457e7246937bef254be0e
- SSDEEP 192:wynbCRYf99oK30Xby3IYChzzNBw8HcWhSo:52cIYs7wUf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs.js
- Size 6KB
- SHA256 c1caa296ebbb5e53541c6d2033aeb99d0bc4cc9d9cde50ebee7535381abf5db0
- MD5 b7266fc2300d3317190e45f661a18d32
- SHA1 f9dac8453e50244f6b9d9550636258b5f6d72c04
- SHA512 ba9b818756e2bf28e913d3ae5f8bbe92c9643e72a0fc217e87ad2189bb77e9b715f55e5b3194531a5397665004e5276b36976038146987471811bf76ed7cf407
- SSDEEP 192:w5nbRYf960Dl30Xb83IYChzzNBw8VcOSo:FyWIYs7wKf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 8fd0cabee7fa27167008b3997c3d3d1a1d02ce75237ea264ab06b01d771080fa
- MD5 95bceff4b902ba3a68d4b59b6611cc5a
- SHA1 997bab5669c9d632c91d76d76c1d1f91294bc74d
- SHA512 fe6d555c0bc7a5873beb0146719a7fa6a73245b82b737bdde950e75156495c97990cfbf3671ff55110c0e37c853e4216ad3fd3639a96418c3e2c6ee677f44559
- MD5 SHA1 SHA512