hxxps://splicecheats[.]com/

Analysis

max time kernel
53s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://splicecheats.com/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	firefox.exe
Token: SeDebugPrivilege	4688	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4688	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 2192 wrote to memory of 4688	2192	firefox.exe	92
PID 4688 wrote to memory of 4480	4688	firefox.exe	93
PID 4688 wrote to memory of 4480	4688	firefox.exe	93
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 2100	4688	firefox.exe	94
PID 4688 wrote to memory of 4808	4688	firefox.exe	95
PID 4688 wrote to memory of 4808	4688	firefox.exe	95
PID 4688 wrote to memory of 4808	4688	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://splicecheats.com/"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://splicecheats.com/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.0.1626038924\1884561537" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c070b00f-c3ef-4207-8f76-216b43742ab4} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 1980 1a6b4fc3e58 gpu
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.1.1686585797\310651807" -parentBuildID 20221007134813 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3ea6ac8-0833-46ac-a8fe-7f2937f18121} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 2404 1a6b4cfa258 socket
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.2.147609743\424832042" -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 3204 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a3718ca-c98a-4084-845e-d56de3e4eef1} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 3220 1a6b8be8558 tab
    3⤵
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.3.1149865548\1990883772" -childID 2 -isForBrowser -prefsHandle 4068 -prefMapHandle 4064 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {152f468c-10ee-4ebb-9726-15dcbced2c05} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 4076 1a6ba527a58 tab
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.4.1815877098\504483129" -childID 3 -isForBrowser -prefsHandle 4508 -prefMapHandle 4540 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1b95b95-7ff8-4ee8-b958-068b3db1e4f6} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 4544 1a6ba529258 tab
    3⤵
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.5.1503166656\1110731447" -childID 4 -isForBrowser -prefsHandle 4636 -prefMapHandle 4632 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6c29d80-34b6-4103-91de-e40be9b35fef} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 4644 1a6bb048258 tab
    3⤵
    PID:880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.6.317917701\1539465294" -childID 5 -isForBrowser -prefsHandle 5100 -prefMapHandle 5096 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3443e5a-a81e-4abf-801e-80f320a1bdd1} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 4928 1a6bb21a658 tab
    3⤵
    PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4688.7.189712051\2068733801" -childID 6 -isForBrowser -prefsHandle 2984 -prefMapHandle 2996 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24282ab2-05ba-4f69-959d-228614b05340} 4688 "\\.\pipe\gecko-crash-server-pipe.4688" 2896 1a6b8107558 tab
    3⤵
    PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
1c058ab5ee583db84c407f5ae42d0a95

SHA1
011ab74e4278967f15127ddea7c84a6fe6e90317

SHA256
9504ff8ce0431a07e1eaf9ebb0468b7a7c55690e542be9cebe21a3a1178b6420

SHA512
cf07d23ef0398b78607e0c387c0f355012a994716b5a771f81f0cbd35407208631a6090421cf5a10389183cfe020557a67e3805152306e522c506700c9d437cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\625944c1-5538-47f1-bfe2-9f0264beaf49

Filesize
746B

MD5
6defb71102b8e4529a8187fb396a6ad2

SHA1
5728881803ca32f4a1c1bfc72ab5862aa845f46d

SHA256
3fcf3706d1896a2b78d747e94ca0182ced7c9e8c03e136a0c390177a4a6f78c9

SHA512
96dc34cc82140df156be79b15f235769097d25b527d5b06890ed62e237a678260720038733b6ca6ad127e026ecfb46e4a124eb9c82570507b3591a7ceb400c4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\88f025d1-e442-4828-a6ca-0523061a30a7

Filesize
10KB

MD5
e03a463ab411583a6ed3baf319cf49e5

SHA1
cef5f7c5ab4544ba36fdf0453226190940bb1a5c

SHA256
f21603e2598da8f97ce242fa283303f942b5ce8e75c8123d53bcf324fafd32c9

SHA512
14957df10081096d5ca6ffb135a45e156cf451b30d8db80d587704cd52a1a9d59fd315a5db2b74fb2f45886cb9abd06ac9907b8e709f7449be41eedc90ff84b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
cd85774b86186f49a90847e68ad74aa1

SHA1
ac5e5f0e077cfacbccfdde5dd72e2f042665471e

SHA256
e52a2f0931e5fa715f17a38df1eb5be948024c25e5de43229d6835c5225a68da

SHA512
35e2e64d90f3b0f9e839a533bd0aa6e17e9b0c6509cee6c46ef67db01ec805cd0c62b9e7ba874a438be6a3ac435b2d21cebd3ee6a51728d157bd49941c8d1a29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
393959d3e95540a23cdf2afbecf9e50e

SHA1
b76b890c24e9ebfcc6f208092af47b0414e10ef9

SHA256
44fb000b26f0f9b8e09c69aff9fda4bd0a3a10b3aa6f2bc3dad165add249ddee

SHA512
6c52ccc27832d54159c588e16218247b3e3f5cfbe881e3f2d28a5b11e1bde7ed3f455be9c0d0701b8de699d8d1b786ecd0901af141fa519fbf7f22157c6b9d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
83a99058963e84496c4c5cc52965953c

SHA1
7fcf862a2053cb85277cd7dce7f9d7b461f3d1ee

SHA256
e7175e8f191b330e332e34a010d33d725f71b0d0f5f370e8edccbda17a480fe6

SHA512
a1a0cde3ffb05541e28df631998fb2e96d0e388f2650f98681ffe029ddbe01637515a98b941f735ca838217efcc7bafa93708231a86402276521b4eaba51b62e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
cdd46513a1de347d532f23a88bac117a

SHA1
49669616bbf06b3fef175a3a594e93d9cb105fb9

SHA256
7eb5cb5e0c49ecb5009eec3e23768475778a9f7cd5634bae92941061368a9ff9

SHA512
1df746e145a821cd2a1651b37b70edb56181a6565aead6f4bca45bad4a3c72c61c3553d55c3972fbf62e5259c6c4d0ee9728c3602c1e7feba239dd635b6306f1

Download Submit