Analysis

  • max time kernel
    57s
  • max time network
    55s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-06-2024 14:42

General

  • Target

    https://njdsahdn.de/invite/i=3

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://njdsahdn.de/invite/i=3"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://njdsahdn.de/invite/i=3
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.0.513742537\1279418258" -parentBuildID 20230214051806 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64c189d4-5c6d-4d71-8427-300a560cb151} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 1924 1af8a70dd58 gpu
        3⤵
          PID:4076
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.1.1659008081\1789345061" -parentBuildID 20230214051806 -prefsHandle 2436 -prefMapHandle 2424 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf8df91-2c29-457f-a7a1-621e4c435efe} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 2448 1af8ab91958 socket
          3⤵
            PID:4688
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.2.793716303\1744460231" -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 2968 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec2a81fc-0a5d-4924-841d-6e8c7e0a55a2} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 3160 1af8d643958 tab
            3⤵
              PID:2784
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.3.1282999595\455950574" -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3640 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9099c7b-89c4-4305-ab06-ce51cd670a8a} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 3656 1af904e7b58 tab
              3⤵
                PID:4804
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.4.1748964990\1371944510" -childID 3 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1db03cf-9bc5-42a5-9f50-f5dde940df59} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 5252 1af92aba958 tab
                3⤵
                  PID:2824
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.5.1495984207\1888489042" -childID 4 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4055efaa-d923-4fc1-abb6-14b9a668096b} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 5384 1af92abac58 tab
                  3⤵
                    PID:2748
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3688.6.1460905709\812768388" -childID 5 -isForBrowser -prefsHandle 5568 -prefMapHandle 5572 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df00f841-9dec-46a2-b0f7-78a329c74969} 3688 "\\.\pipe\gecko-crash-server-pipe.3688" 5472 1af8d643058 tab
                    3⤵
                      PID:2356

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\activity-stream.discovery_stream.json.tmp
                  Filesize

                  25KB

                  MD5

                  587a6982c692f65ca9ba7f2ce6af06f4

                  SHA1

                  a6e3bef40c91e22ef0783f30c7a5c785e6c60cfa

                  SHA256

                  751e8c891338b625b40830f84da9d412316024b7b92bf3b742b8c8dba6df383f

                  SHA512

                  ceafd3eb2a33a9fd9b4f1c1fd05d3b1223532d2aeae07509b69be1e95ae0d75661ae2d0e3758edf71c91a4fb2b45ca170e7b20a607f524c5ae22af0c4ba7bdb2

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\activity-stream.discovery_stream.json.tmp
                  Filesize

                  27KB

                  MD5

                  4a82b392d28b28a93ea7d67abeb95c34

                  SHA1

                  dbd3b6dcb491e2e38246672d261ac01bb817c493

                  SHA256

                  1558942b2097dca2b8b19a44dbb4050fc99f6a0ecaf1ebfa6f8cfbe174450d87

                  SHA512

                  36a90fb67a4a6961e6b25de3bfe32d2f1c99c516d24a79b7c3405e4fa904558a4daef252242198328e88c71d59f8dc32bb20a1f0cad39df9d0ef30c40bc4520e

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7l3zro2y.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
                  Filesize

                  13KB

                  MD5

                  54b4e136fc942022633189a16305e630

                  SHA1

                  c235a7ca6060007b51d996f20d2633510c20642b

                  SHA256

                  ddea931271e707972e2147d6c21698397df1afb653e5fca663e519c5477fb0f0

                  SHA512

                  23fc2bccc773ac88b1a30f7b22996779a71dc00e519b980ee355ecb138f58dbb7563d3f389899c05906a556109e4102bd36cd2239182bf8bd42438111a97a8f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  Filesize

                  442KB

                  MD5

                  85430baed3398695717b0263807cf97c

                  SHA1

                  fffbee923cea216f50fce5d54219a188a5100f41

                  SHA256

                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                  SHA512

                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                  Filesize

                  8.0MB

                  MD5

                  a01c5ecd6108350ae23d2cddf0e77c17

                  SHA1

                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                  SHA256

                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                  SHA512

                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                  Filesize

                  372B

                  MD5

                  8be33af717bb1b67fbd61c3f4b807e9e

                  SHA1

                  7cf17656d174d951957ff36810e874a134dd49e0

                  SHA256

                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                  SHA512

                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                  Filesize

                  11.8MB

                  MD5

                  33bf7b0439480effb9fb212efce87b13

                  SHA1

                  cee50f2745edc6dc291887b6075ca64d716f495a

                  SHA256

                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                  SHA512

                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                  Filesize

                  1KB

                  MD5

                  937326fead5fd401f6cca9118bd9ade9

                  SHA1

                  4526a57d4ae14ed29b37632c72aef3c408189d91

                  SHA256

                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                  SHA512

                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs-1.js
                  Filesize

                  10KB

                  MD5

                  07abf212c6c980881f58a76a04aa3bad

                  SHA1

                  286f0a5e3b968f378a999f37a01f3a9eb6cc5387

                  SHA256

                  dd1562e46942cef001782b60ce76e8f87a1073eca04878390db57178e783ff12

                  SHA512

                  9e64d657d242f68faeebf463076f7545f1c84b21249e754d6b6e433da192de8fab0530c512ef5bd1b66c7046069c18835fec4635f5bb676c3d1fc6432790a0eb

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs.js
                  Filesize

                  6KB

                  MD5

                  aba4c4008df2176b71acf84b54b8d54a

                  SHA1

                  5b04532f88d4f534f1957bd163b02c33f97f0bd0

                  SHA256

                  1c5bfb962217b78813a7bfc139773c6cfd9afac75a2f3a51a49db1a71ff4d1ab

                  SHA512

                  4e9c85407e0edb3be9221dd1e26526854c57506e7f2626be9abdeae43132f523197d054558f5773a668c95a4b6cf1486236864ad7ef52b50c17416937d24cd9e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs.js
                  Filesize

                  6KB

                  MD5

                  01ba7851e0ccf84bac0ebb542ca7eef8

                  SHA1

                  10f235d98c8f4103014859407ac1b0d067fc5fb3

                  SHA256

                  fa49bb9f07f501f0dcaf56e63325d3d1641628bc28e72285e311b01110d53a15

                  SHA512

                  1a3e69d394413966294bf02b04a27234a71274208cfdf39549b6da189bfc33212e1b28c9d780e620d2089e23606de0a89c2a46e011bc639274c7a9e03cd4c7d4

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\prefs.js
                  Filesize

                  8KB

                  MD5

                  63ea068edc031298fedda64a634f9c35

                  SHA1

                  49967003bce079ddb7d2a2ecb4e997703c0eceea

                  SHA256

                  a31c7ad5a9cef90059b8c94d7fc36405b7a2601e6975f32a8ecdcf7fafdfdec1

                  SHA512

                  7d4d901ad545c176503e6cd115a4b1aa5643132e517ab4b3fb709320208a94830c9218a888e92d4e0ddb71fbdd2cd8e9e2b0218f12f779ea18e76ac347d3120e

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7l3zro2y.default-release\sessionstore-backups\recovery.jsonlz4
                  Filesize

                  1KB

                  MD5

                  de22866a41127b8c718dafe9ed438ba3

                  SHA1

                  1ac2e0c39f09156755642574d92d4e87bfc29188

                  SHA256

                  6f45549103c4daa1a7b85964b438df3684750fdd173ea69f3d7c7ecda6257a45

                  SHA512

                  92ce356f8eef9ea82abf1271a8d716122092768f933d025ff47e52a9aad07b5ac94f70728d82376dbb91cec473b8dcadd11f0622dd11f8beaa95299c664b94a6