Analysis

  • max time kernel
    125s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 17:26

General

  • Target

    https://apis.google.com/additnow/l?applicationid=180181176205&__ls=ogb&__lu=https://214.164.205.92.host.secureserver.net/finanzas/[email protected]

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://apis.google.com/additnow/l?applicationid=180181176205&__ls=ogb&__lu=https://214.164.205.92.host.secureserver.net/finanzas/[email protected]"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3112
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://apis.google.com/additnow/l?applicationid=180181176205&__ls=ogb&__lu=https://214.164.205.92.host.secureserver.net/finanzas/[email protected]
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.0.1757301619\1534337108" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 22244 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52094d0e-3f53-415e-b12b-645f782d2fea} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 1848 1c0faf26158 gpu
        3⤵
          PID:3012
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.1.1742450958\1577938974" -parentBuildID 20230214051806 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 23095 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b18046bb-1987-470d-ae61-237ca6821718} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 2428 1c0ee292558 socket
          3⤵
            PID:3096
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.2.1125217320\73599412" -childID 1 -isForBrowser -prefsHandle 2716 -prefMapHandle 2976 -prefsLen 23133 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2db468bf-7901-410b-af6c-eb5064b3ef66} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 2608 1c0fe03cc58 tab
            3⤵
              PID:4360
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.3.1196078173\886891259" -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 4000 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04ed960d-ac59-4fa6-a2a1-35b73471d57e} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 4008 1c0ee282e58 tab
              3⤵
                PID:2176
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.4.1842378500\441830656" -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5264 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb103792-da5c-4c29-baeb-58679393b0a3} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 5272 1c101d90858 tab
                3⤵
                  PID:3984
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.5.470617123\1077002475" -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5324 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b000a982-4220-4af7-9bd3-47f338277399} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 5416 1c101da4c58 tab
                  3⤵
                    PID:2188
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.6.246467543\2012419326" -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4b3cfc3-76a9-4eb1-902a-ab32c00817d7} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 5636 1c101e34e58 tab
                    3⤵
                      PID:1652
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.7.1221883331\706240737" -childID 6 -isForBrowser -prefsHandle 3212 -prefMapHandle 3252 -prefsLen 31086 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4e60c97-4cd0-425a-ae7a-56aa3bd02119} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 3372 1c0fb4b3158 tab
                      3⤵
                        PID:5836
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
                    1⤵
                      PID:4520

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      24KB

                      MD5

                      e8b111878b2f679b0bda5e1b577d858f

                      SHA1

                      a18eb868651fc4c273187f19ca878abf1ad53dcd

                      SHA256

                      fd1a8d9e821a8a2fdedf62c68f14e9c72a7c25b981b5e07a7f0b29b6816f2ac8

                      SHA512

                      66e9b17103aca7ff47ef30c8d3c1ca997bd79e6e3a220fcdfd9c7f3bac221f157505df8279a327b13ecacdac9bb86c2730e3384440a2d3ff14fa25d9f9c82aca

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

                      Filesize

                      13KB

                      MD5

                      170f8f5621d7e7b6d3d25161e90919eb

                      SHA1

                      d77b97fbf0e0ee39ccedbd23fdafa2f76df9b064

                      SHA256

                      d1b52ad079f4142e77094977020b5ef06e106ffaa8666e79584f1afcf5f93811

                      SHA512

                      c9372a6cba51d68eab4968f312e0873ebec619f7bacc64cdb706784b3230e242bd0738401bc7a0efadcef20ef24eccafc711d0c4bb8f3b5bdf9646e5f65d65db

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

                      Filesize

                      10KB

                      MD5

                      8193b97ccb86e79f8073cb051a496c95

                      SHA1

                      d24ba37830902107a2c63d912a349cc19f521981

                      SHA256

                      afd4e43dde76e6db5e29489007e444dfc14e460d7516c407de56fc92ab78bd6d

                      SHA512

                      5475d6b5fe076c322367270741c417e84f5609205ed22c2a5c18f797c5cae3b864e015ad5a40336473ce5ea4dca2942272942fb52d451063fd5cee108609bee3

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js

                      Filesize

                      8KB

                      MD5

                      2506564d75189f518e46c63ca6bade03

                      SHA1

                      fdea7cd8fff8a92c59c7d4ce91a38502961416e6

                      SHA256

                      e413c68fc49ea925eef5300fb4b4d988919078019cec84cde0dd0da104479c4c

                      SHA512

                      1249411c07af161d42efc9bc5b03ad6a24fe09436a2d19e4d9d0cd0ebf33966ef6b4a6e90f724e91cb3fb15728c404024af3f95c95286218ec30c87a1dd2432a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs.js

                      Filesize

                      6KB

                      MD5

                      bf98fdc4d6f914f38b73ac06064a0fe4

                      SHA1

                      e09cebd359c73cbba37afda61f51a987dc272ef3

                      SHA256

                      48200e66b88309853dcf5e23b26952078d7a1f1d6f0df0c9e1bdff56af5de1a1

                      SHA512

                      40f9a167f2756fdf944eb25e0b5b66efe4bb8d0485ce2099a0fec32538867e30dc38be4fca7c809aa1247fa17719bce2a42c98d01ee0bee53feb378fe6680cfe

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      3KB

                      MD5

                      576420c4ada4804f3c12cc97a9e7c199

                      SHA1

                      27d22f8d4791d2f3ca8f75053c1221adc2ba700d

                      SHA256

                      ed00861f8302a721c658693cd2ead89b81157b864fef2dea030fbc59766b5fdf

                      SHA512

                      81b1886c5a2b9c24af51cc82708ae9e7564328ca0536a30149757866eaad1803575b68d040f06c06d54aaa8badb245c39c5b9da1f133211a03957f3d2a72caf5

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      1KB

                      MD5

                      966fd6c90709edc90734b83543dd9b02

                      SHA1

                      bbc705185c50838ae1ceac889319e766be998ff9

                      SHA256

                      5e480c0ab0b4d553fb70ad59df38e3cb570857b51eb447a6f3466bb2abebf8e8

                      SHA512

                      bb36c7d967749786d96195aad76b3d0111564d3360fbbb4c2826378d3595d0b8fe57c4a66e9e28abbf524c6593ae43bbe977bc0cdba1e46456998ac607c49dc0

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      1KB

                      MD5

                      1a00d1d7ee0b17b8330004f554bed08b

                      SHA1

                      0f79dce9bbb46b984d1febcb7c0e705068f60153

                      SHA256

                      d68ecbd8dc1b63b11c098cbb0db72c2a5df9bb0fb59bc5e6446b04b7180fcadb

                      SHA512

                      84c5d6c89434638be59ffaef6ec6cc2e94f185cd0eb8b912e96ed58cc898cff6aa69df95f73dbdcd1a32dd8026dc797c2cadc22e130cd2cbf228eb7b55e34722

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                      Filesize

                      192KB

                      MD5

                      a8a32bd66f44fb0656c2cd001f3fe614

                      SHA1

                      c66d606b728d2da31aaf781e85334e7ddc084e30

                      SHA256

                      6d1213fc9f26cce370958ed6d0a8aa9862cd87f6376aa0031030a320bef9b1a3

                      SHA512

                      13dd6048ee5343716b3d7fd19efd85d3154faca4488d1cecb1fce26993ff2f076fb165e171e542ce295b7afb0dd83a769618a00e789e2fd852dd4ad2e6aa43d3