hxxp://p1t[.]fun/?l=1031

max time kernel
534s
max time network
531s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://p1t.fun/?l=1031

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	firefox.exe
Token: SeDebugPrivilege	2140	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2140	firefox.exe
2140	firefox.exe
2140	firefox.exe
2140	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2140	firefox.exe
2140	firefox.exe
2140	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 1704 wrote to memory of 2140	1704	firefox.exe	28
PID 2140 wrote to memory of 2784	2140	firefox.exe	29
PID 2140 wrote to memory of 2784	2140	firefox.exe	29
PID 2140 wrote to memory of 2784	2140	firefox.exe	29
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2788	2140	firefox.exe	30
PID 2140 wrote to memory of 2208	2140	firefox.exe	31
PID 2140 wrote to memory of 2208	2140	firefox.exe	31
PID 2140 wrote to memory of 2208	2140	firefox.exe	31
PID 2140 wrote to memory of 2208	2140	firefox.exe	31
PID 2140 wrote to memory of 2208	2140	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://p1t.fun/?l=1031"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://p1t.fun/?l=1031
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.0.451977269\1939255542" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {470b0d42-6861-46cc-992a-6a8924469a76} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1296 11fc2258 gpu
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.1.1832754471\1481261988" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1daa2628-b242-472f-a0b3-a3e96ca6b88f} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 1500 d6f258 socket
    3⤵
    PID:2788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.2.1635411970\117209479" -childID 1 -isForBrowser -prefsHandle 2116 -prefMapHandle 2112 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b119873-0505-461e-bc55-852e8f517dda} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 2128 19e9e258 tab
    3⤵
    PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.3.942494144\753340365" -childID 2 -isForBrowser -prefsHandle 2916 -prefMapHandle 2912 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae6556c2-09a4-4e91-ab51-c4d27d91d448} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 2928 d62858 tab
    3⤵
    PID:780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.4.331861399\1972616476" -childID 3 -isForBrowser -prefsHandle 3508 -prefMapHandle 3584 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67afe5e4-a7e0-4a52-b3a0-d74391c2705a} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 3552 d5d058 tab
    3⤵
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.5.330181766\1302021049" -childID 4 -isForBrowser -prefsHandle 3668 -prefMapHandle 3672 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39f0b59e-7763-4286-8d16-a64162ffb5cf} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 3656 1e473c58 tab
    3⤵
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2140.6.1061291154\601026531" -childID 5 -isForBrowser -prefsHandle 3788 -prefMapHandle 3792 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be984e52-d0d1-4b95-9279-1812b2705f45} 2140 "\\.\pipe\gecko-crash-server-pipe.2140" 3776 1e474e58 tab
    3⤵
    PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ox017b3g.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
5e7760f54ffc445e4966bd2877ba0965

SHA1
05cbde5a5e21016cb111bd9691faae6e2f528e35

SHA256
5ab08f4edae6ca1a7ce3125b975a039c1ff95bf1eb4b48ac306631e49664a7ca

SHA512
7d91f0bbcfd9b0ea9dac1387c998e1590457fa88b3432bc9cab21ae3fa3dc19abc6f9738bad46e817dd4682690fc145bdb11e7f7781b7026d05b9b3ee47f977b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
01d61c09d7dba7795aa437fb43890caa

SHA1
5dcfd68ec1a2dce4234e118f0fd6e941bfaf9811

SHA256
4ebeb5be280c08eec408287357dcd5d682c2040f80fafa9d3b674acd40c3ebfd

SHA512
5449ab46ebb881265cf9e917a19c6b8a806e85bd5488afdfd525180d0a2db45b6c9e9abce90525a49de89d7647d354a6fbad62b1b885e934c86c7024fc456115

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
41b618353b4d2dcf9245fc2b705941c8

SHA1
8da3f96ab69fc7c83e43b3a0f7b04a945fc0bbbd

SHA256
c222e352ebebbcd99e31b336b837b236c9ece69607d6238bd01d40bfd07261cb

SHA512
0f05b4173827eb2e3840ef8eaa7c56f729d7623570b91b126d634a4b057505214f466268a6670602cdde0eb549bc40f367c7a74a562302d5342f5b5c749b5a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\bookmarkbackups\bookmarks-2024-06-15_11_909BdXTLdbCvxOte-5C1Sg==.jsonlz4

Filesize
950B

MD5
08124f8c43020ff133b437333a6fbec3

SHA1
4ecb00a469c1cb05ed544cc96394cfd55c0fb0f6

SHA256
10992dc5e6d53ef17931567106c4009e02c300889e63a58994edc56c04ed7adf

SHA512
9fc5b4eeffc5e64217cd24bcb4a28c556f11d56363092a04212a93c248e15f639d14fa53b1a60071da16e61bc2b0aa54a50e67dd35b2dec2d2faed825fb55e60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e77dd30d72894f1b924401c024a84ebf

SHA1
ef8397a5ceefa9e493819d928501c3add0ba2674

SHA256
5c117d094ca208d359d9d4f037cf7d5e6b8cbbbfbdd69e0e51a6cc7ba0582d49

SHA512
dbc6674eb66e5b2db8e87d404be07636a169986910e49bf3f672d0f15e51733ac5e6883ea5fc621925953a9871ec5aac9cfb2b10fc9c8bd48c73f0bf492b4835

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\datareporting\glean\pending_pings\1b0ef784-2c0d-4f96-8009-fd33e6454272

Filesize
745B

MD5
aba9d9bde179c824a605c3140df4cf10

SHA1
8a147586a674ecf37fe68a32951162caf4264b10

SHA256
4173126046d36cec371f29ca9433f535431bd6be10acaf746e56d079c9673cb8

SHA512
df50485dc84084f28af7ff6813d0e4dcb9aae34cb801abe587de4386b41d03694d8d4b4ab9ebe6e1ea986d94b3575888423dd7fdd7edc9d169132259e862b74d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\datareporting\glean\pending_pings\e307da78-8a6a-44de-b4a9-1d600e3c73b8

Filesize
13KB

MD5
74a32c9f2afbb9fd28379b8260fd9a05

SHA1
8c6587199fd202abb08bae000fc9b678f3afef76

SHA256
3dff458cbe18661c3ef8089fb3470998a66d2c15db23513855ec993c7d87caeb

SHA512
e56f01476a2860e39e31389d9f812dd56250c1898b1d30f816a60a606f54a4d82c91710fe3b55d252ae526ebbc6bf03fa50a96681b6d747c51398ca1ba4ba92d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\prefs-1.js

Filesize
7KB

MD5
e2bae9455d4ed3f352ae32423b5405f6

SHA1
0191ad1be37620f3a3b981ec715a3ffa5b928fd4

SHA256
5772a423b191eb01bd4551416889ec154e96d14c7db9760462caadeef0c8bd4b

SHA512
f506c668a5a84533c2336d361673632229488cba29741a1de3ecca4ce1d782d514e54cacfbbdc1a17c3d7cc1773112ab477dc1f6ad9604667d6e991d78285f50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\prefs-1.js

Filesize
6KB

MD5
56c6eb597fb28521589aa3b4a8aaa4e5

SHA1
82cf0e20b09ab4a70a8b67a4cb892a79e6759a1f

SHA256
bc82c84fcb20c843c7578048334e46605d8cef9ea715bd927313b36c7ad8dfd1

SHA512
656efb4d0701db015489dfed84d2f4a15dc0dff0e1681479ce25442fc5d8041e2cf85081e6cb62d7e24f12dfc67d59167a9db2bda9d71dfcf9a6147795bee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\prefs-1.js

Filesize
7KB

MD5
07f87c4e90cb261b93db602abe3f0ea7

SHA1
c155ae73d1a2b8d72e4af1f8c97eec7553c8ea95

SHA256
288aa2c4943720dc2b1f5686ce154d211ba579b4b85165f7f6df4869a80420b9

SHA512
e75f53506c5e2211fd201ed41064aed7476742d2b33cf38cf7c0fc17b3222c11d630a9c40c0c7a3f2a2d222c62a2a5f82f54e8a815e37e4f90ab0bf4933bd623

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
935B

MD5
b7215413f19797a7a71757adccd2d695

SHA1
e1cfa0bcb2384c251a1d808881dffd1093b38446

SHA256
c3b00795f4dd71b8f70f17a941694008af6bc4559518151fccce2c4cc5cea692

SHA512
f214c030eb2ead79c5a18b7342997c939f84e895869a7276f1fd9c8d4b27f4dfed3fdb471bc8874a381fd8f51ab3ecebd149ef00ec558e3162d62c705176720d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a4ab07c7fc42254d589a467ed2a7798f

SHA1
532acd9b3c8b479c788a3a779176475c6d072785

SHA256
dcbb8539de304cc08eb714f88c51926b3bc97e8a70bd81e3647415c1052ea167

SHA512
dea71244281c67b7f61a7493e14106886dff9ee08442a3c6a307155033fa96e86d75ee174d266336732e78b9faded647b3f624935277bd1608b9865b58c14713

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\targeting.snapshot.json

Filesize
4KB

MD5
da8e3a2ad9051ff5276a502d36e89998

SHA1
4479c6e906e6fb7027830540ec2340f2f4a58f59

SHA256
62e369a29084708ff8337f1f7f25ac997de867fcb9ac778590e4c3057575c1a0

SHA512
dd6dfb561a8443003b920fdb923b7acc3b06c73d2b89dd5ae5cd81ef3aa4574d2b6ad459fa2c6fc03b3dafc6a0c0847772ec01fd370ab7b8ae79ac431b89bdc9

Download Submit

Resubmissions

Analysis