hxxps://login[.]microsoftonline[.]com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=8f6b9afb-4738-4912-8c48-82243401a8d0&redirect_uri=https%3a%2f%2fwww[.]bing[.]com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/[.]default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%220FC69AFB5C3742D695889F34FA860513%22%7d

Analysis

max time kernel
20s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=8f6b9afb-4738-4912-8c48-82243401a8d0&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%220FC69AFB5C3742D695889F34FA860513%22%7d
Sample240530-rbxkmsba21

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	firefox.exe
Token: SeDebugPrivilege	1836	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1836	firefox.exe
1836	firefox.exe
1836	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1836	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 3920 wrote to memory of 1836	3920	firefox.exe	83
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 4072	1836	firefox.exe	84
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85
PID 1836 wrote to memory of 3708	1836	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=8f6b9afb-4738-4912-8c48-82243401a8d0&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%220FC69AFB5C3742D695889F34FA860513%22%7d"
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=8f6b9afb-4738-4912-8c48-82243401a8d0&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%220FC69AFB5C3742D695889F34FA860513%22%7d
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.0.171178795\1765596169" -parentBuildID 20230214051806 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 22244 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c28abb8-a6f3-4e7c-8605-d294b3851a19} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 1648 29b0af06158 gpu
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.1.812230422\1133430137" -parentBuildID 20230214051806 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 23095 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7853b10a-5d97-4c71-b9d8-83b137423cd6} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 2492 29b09f26a58 socket
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.2.2018750415\1012324634" -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 2984 -prefsLen 23198 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40ebbfe5-3587-41ba-afaa-926d915b3fd0} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 3000 29b0df50b58 tab
    3⤵
    PID:624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.3.1913070239\463057177" -childID 2 -isForBrowser -prefsHandle 3880 -prefMapHandle 3876 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ac42880-385a-43b4-8c0b-3b09bc8f1059} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 3892 29b0fb2a658 tab
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.4.121474859\1912960162" -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5284 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5571fbfb-9ce0-4446-8b78-537a55737ed8} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 5304 29b120db858 tab
    3⤵
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.5.626324331\1878598471" -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7491db70-a1bc-492a-b31b-2196c5aa042c} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 5436 29b120dbb58 tab
    3⤵
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.6.1645754482\859395184" -childID 5 -isForBrowser -prefsHandle 5640 -prefMapHandle 5648 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fcc0c9e-2d3e-4d11-9031-a363a81f9f8a} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 5632 29b120dd658 tab
    3⤵
    PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1836.7.1116840940\2034294218" -childID 6 -isForBrowser -prefsHandle 5868 -prefMapHandle 5872 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 900 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db96150a-942b-4cfe-be31-53d58e1f9898} 1836 "\\.\pipe\gecko-crash-server-pipe.1836" 5860 29b123ebb58 tab
    3⤵
    PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\activity-stream.discovery_stream.json.tmp
Size 23KB
SHA256 7f39590b8761e5e1c80ca9d4cf5fec60eaa90d57300909207616eb8be340ab3b
MD5 d37b37accc5fb8737c4ee2e52386b8b3
SHA1 a38ff1c2ef448a2977600bd5ce88bf6dd3d07c29
SHA512 e3513cda88688697bd5b717c38d6d481f8f192da0c37a212f0dfd1fdd595f0f7648af505cd9f2588bb3069ec562a4b85fec2f5170b1dc687b07d7ff8cf407a18
SSDEEP 192:rPlf7rGBX6zxrqoZkj5MMeZeqxzadKRXVKPZdFBCniZ/I/sZtgyYMgs1JZB22T9x:rl7eoAeWARtghgy9gnJX0WU3/cZRNyaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs.js
Size 6KB
SHA256 d0fa59ae15fa119504b8ea72738d1d616b232b85ab7fc7953a5b8f89d2d168b6
MD5 4ff00cefaf27aa3ce35ddd1d58b79087
SHA1 d641a13661de135fcfc4ce65fa22439f40d90be4
SHA512 99fd73799597bf2521bc9f96ec0334a707d06f228ac94676c529a9e2f23382d57ca832fd3b39a3e0fe58425a035c3336b5fbae72417e6cf76a7e8aa5e56540a7
SSDEEP 96:xHF5nUTUHqGq0fdXWLHzSm0XlnBOj53I2HOH9ez96Bw8Vc2uSo:T5n6R0fdX+b0XbO3IYmez8Bw8VcdSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 937f7b959bfb6281731cccbb4498bf80ab57a9fce2128542c074156dca60172f
MD5 0c2b51165f15fabc04a2574dc3e74314
SHA1 5fc3f6f8d54d7c755b320b8e52a826c43e73715b
SHA512 0501face7fb7d8419af8d1581064009adb24501d3a34f5d150f9ddef28380561136114d51cb14bda641e62a42e89815b7998d595ef1d4941c63fb03da72d2705
SSDEEP 96:rsBR3gTQqWNSqHmK9njMORQEtttZ2NQbgbARebhzb4gbQcNZysk0Ika:mzXmK9nj926bgbOebhzb4MQcgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 9146b41ee66417b23b2136a8be6dd9ee39bf27deccb8c601725f449e096b68c3
MD5 acab049fa2870bed1433814de5434162
SHA1 4936100cc75bc25dd9d4880b4c9d8d67dd19400f
SHA512 6d0062165a1b4310cd9e8a67cc5124dc24d863bbcd130d5fb561be7b7af48f2781396a5096fe7523b78c21fadc944de2aa5225c612662df1202cf2b6750671bc
SSDEEP 96:+sBR3fuaUEJcttZUZQbgWARebhzb4gh4bR7ufOhM0Q:TJuEz2bgWOebhzb4A4t78
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads