Analysis
- max time kernel
149s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system - submitted
05/06/2024, 11:07
Behavioral task
behavioral1
Sample
login.exe
Resource
win11-20240426-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target main.pyc
- Size 7KB
- Sample240605-m8a1padg2s
- SHA256 4ffb66067abd2cf56c3ca8371b716a8b317608ba84861258a086b6b5f1ad93ae
- MD5 31efc0351e79c1684a7032dcc4e81b1d
- SHA1 efd2ff61b9280ddbb268eace392cae60f5aee7f8
- SHA512 121fbd073e48e32a80a5cb4355491fc3cac1d6080f4462c74a6a4e2b9c148a5bea3a40cbdc1d3ec559675411f36d54ee25aff7a8c7d67a931619a1852f713233
- SSDEEP 192:w3PjFWBoD8KrIWdXwXSFXsKSJhwv55yhMdwXnw:71WuiF8r2vgPXw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Empyrean stealer 1 IoCs
resource yara_rule behavioral2/files/0x000500000002aa8b-20.dat family_empyrean - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\pyc_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\pyc_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\pyc_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\pyc_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\.pyc OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\.pyc\ = "pyc_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\pyc_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1772 firefox.exe Token: SeDebugPrivilege 1772 firefox.exe Token: SeDebugPrivilege 1772 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1772 firefox.exe 1772 firefox.exe 1772 firefox.exe 1772 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1772 firefox.exe 1772 firefox.exe 1772 firefox.exe - Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 3040 OpenWith.exe 1772 firefox.exe 1772 firefox.exe 1772 firefox.exe 1772 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1436 3040 OpenWith.exe 90 PID 3040 wrote to memory of 1436 3040 OpenWith.exe 90 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1436 wrote to memory of 1772 1436 firefox.exe 93 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 3056 1772 firefox.exe 94 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 PID 1772 wrote to memory of 2880 1772 firefox.exe 95 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Modifies registry class
PID:4964
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\main.pyc"2⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\main.pyc3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.0.74318659\390764825" -parentBuildID 20230214051806 -prefsHandle 1664 -prefMapHandle 1816 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ce222b-f91c-4c01-a1d5-5ca583b6d8e4} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 1896 1d0108b3858 gpu4⤵PID:3056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.1.658028293\113030049" -parentBuildID 20230214051806 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c0449fd-2b5d-43e1-a3e7-5100e630f7d7} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 2440 1d003a89658 socket4⤵
- Checks processor information in registry
PID:2880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.2.1518789177\1344192677" -childID 1 -isForBrowser -prefsHandle 3200 -prefMapHandle 3196 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edb5e975-612b-47e4-97bf-d7c0cb399ca5} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 3212 1d00f891058 tab4⤵PID:2744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.3.108836544\726338245" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b7d9464-c3b8-4569-bd05-7ce7c18332bf} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 3084 1d003a79358 tab4⤵PID:752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.4.609437085\434047753" -childID 3 -isForBrowser -prefsHandle 5376 -prefMapHandle 5360 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd57ecfa-d2d7-4de0-bb2c-80927d1d50b6} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 5388 1d0110f1e58 tab4⤵PID:5112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.5.254299274\1695510738" -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {166b995a-67cf-4d63-ac13-8094a6c74598} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 5516 1d0110f2158 tab4⤵PID:2564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1772.6.142832562\1618318321" -childID 5 -isForBrowser -prefsHandle 5744 -prefMapHandle 5752 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1352 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15823112-a7c5-45b5-a647-f327a486e243} 1772 "\\.\pipe\gecko-crash-server-pipe.1772" 5736 1d0110f2a58 tab4⤵PID:4784
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9w3t05jh.default-release\activity-stream.discovery_stream.json.tmp
- Size 24KB
- SHA256 b038ab6e93a036750d225af060595bc9d89a2c5aa6bf278ad90e14f373e70c52
- MD5 8da4553931a0db79ecb5ca0d51ca84ff
- SHA1 e94462f2e32b032b56fd0d04a27c03ff2a376d8d
- SHA512 e010b80c039ec234501b3213db35d0979d006013a4c3ebf5e584178dd3e202821714482aa287c7eb72e69c97451651890b0e0a8626156c2690e584b16f470537
- SSDEEP 384:rrWkoneikk3O0cnCArRVnk5Mrg3TP6YXMCCKGw5NIWyaa:rrqtkJz1O53O2MVOny1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\prefs-1.js
- Size 6KB
- SHA256 91fd3bff96f85f8c1ba578cf36fd10188532ad980affebeaadba01e7f88ea002
- MD5 82b3d04d643486e5d6e4ddea689a0304
- SHA1 ca9044a12817446123d2b501838361efdce757ff
- SHA512 4bd8382d33645080a67f108b75ffb2f5889dd34d844984c976b4b4e9d5c59fabbec83ca9c77a00e55a62c3328b35259bf49dfc5a76705f8874d28a95eb9313b4
- SSDEEP 96:xHy5nUTUCPqGq86fK9OLHzSY0XlnBOjX3I2H3v+o0YBw8H8lrqSo:w5nyCR86fK9Wp0Xb83IY/uYBw8H8gSo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\prefs.js
- Size 6KB
- SHA256 e6f7c1982f8e51b7a1adc70c8719fa726d9dce510383e1e7af648c6b2d89c1b7
- MD5 18989bd96d462dff55b64485ba418fd1
- SHA1 6051e3ba23991685beb3c929e369b0cb5041665e
- SHA512 7c888bef351a5e6cf8d7df2456e989a9b895e69ff0b9b3d22e2cecd18cd4c2d776a146d84ad2034ef00fafb98ae362a0111a115ab27f88746a0e56fd29227361
- SSDEEP 96:xHy5nUTUPqGq86fKEKLHzSV0XlnBOjY83I2H3v+o0YBw8V8l3So:w5nSR86fKE6E0Xbb83IY/uYBw8V8lSo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9w3t05jh.default-release\sessionstore.jsonlz4
- Size 631B
- SHA256 ffaa25463152d6b157cc0b2165c6712f20efeca8f2efa9a0d1162a4f5aad5bce
- MD5 ad91baea38f5f8403d42759a3e7e69aa
- SHA1 00198d2abe59543b2a7c235742dec1f4db376c8c
- SHA512 9e14a41bccf4a94d725756f2f43b26fc90eff3e56984a3d0c0d23ae61133db3d1b59b099691317df17875766cb04459b099efaee1c95f3697f5474611a46c313
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\pHiMpV7E.pyc.part
- Size 7KB
- SHA256 4ffb66067abd2cf56c3ca8371b716a8b317608ba84861258a086b6b5f1ad93ae
- MD5 31efc0351e79c1684a7032dcc4e81b1d
- SHA1 efd2ff61b9280ddbb268eace392cae60f5aee7f8
- SHA512 121fbd073e48e32a80a5cb4355491fc3cac1d6080f4462c74a6a4e2b9c148a5bea3a40cbdc1d3ec559675411f36d54ee25aff7a8c7d67a931619a1852f713233
- SSDEEP 192:w3PjFWBoD8KrIWdXwXSFXsKSJhwv55yhMdwXnw:71WuiF8r2vgPXw
- MD5 SHA1 SHA512 SSDEEP