hxxps://github[.]com/Kade-github/FNFBot

Resubmissions

30/06/2024, 04:47

240630-femn3atfpa 1

30/06/2024, 04:44

240630-fdaywaxdmr 1

Analysis

max time kernel
85s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30/06/2024, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Kade-github/FNFBot

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	firefox.exe
Token: SeDebugPrivilege	464	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
464	firefox.exe
464	firefox.exe
464	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 4404 wrote to memory of 464	4404	firefox.exe	77
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 3340	464	firefox.exe	78
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79
PID 464 wrote to memory of 4844	464	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Kade-github/FNFBot"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Kade-github/FNFBot
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.0.1060217447\1752965135" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da185317-dd78-4536-a87f-ef62addf1e85} 464 "\\.\pipe\gecko-crash-server-pipe.464" 1848 17ee0014e58 gpu
    3⤵
    PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.1.1497672865\1406309756" -parentBuildID 20230214051806 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4966046d-9bd0-46f3-8a2a-558d2ac3e60c} 464 "\\.\pipe\gecko-crash-server-pipe.464" 2392 17ed3289658 socket
    3⤵
    - Checks processor information in registry
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.2.337832579\1083216960" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2940 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 940 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba04ebe6-b23b-4f1e-a350-fedfd5c6f263} 464 "\\.\pipe\gecko-crash-server-pipe.464" 2956 17ee2f50558 tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.3.995252873\1263678601" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 940 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a200bfc-ecc3-4374-9f4b-a877e2f83fd1} 464 "\\.\pipe\gecko-crash-server-pipe.464" 3628 17ee5f1c558 tab
    3⤵
    PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.4.1328723553\178593173" -childID 3 -isForBrowser -prefsHandle 5020 -prefMapHandle 5072 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 940 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9783f7a1-417a-4c7e-bf37-f01f867725f0} 464 "\\.\pipe\gecko-crash-server-pipe.464" 4728 17ee78c3558 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.5.1388368777\345446361" -childID 4 -isForBrowser -prefsHandle 5184 -prefMapHandle 5188 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 940 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1628ef82-c40f-43f8-b30c-a383ddb2f717} 464 "\\.\pipe\gecko-crash-server-pipe.464" 5172 17ee6f0a258 tab
    3⤵
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.6.1995833376\1335953396" -childID 5 -isForBrowser -prefsHandle 5460 -prefMapHandle 5456 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 940 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a1aaf7f-a6de-480d-aeaf-4449a8c4daf2} 464 "\\.\pipe\gecko-crash-server-pipe.464" 5472 17ee6f0cf58 tab
    3⤵
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="464.7.1505211477\1507807561" -childID 6 -isForBrowser -prefsHandle 3772 -prefMapHandle 4812 -prefsLen 28034 -prefMapSize 235121 -jsInitHandle 940 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18fa34ed-8650-4158-89c9-474720c53aa6} 464 "\\.\pipe\gecko-crash-server-pipe.464" 4876 17ee0012a58 tab
    3⤵
    PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
ec7f12f05f8c1344cdb344c32e48cfa4

SHA1
da37a1da62feb108410401b3de644f8f40fd75aa

SHA256
9e23c348b605e8e9ca46906bf9df5103bb165f2240f70c4a9230a98ff6cd1530

SHA512
1e3474a97570c3001e3c3751378a50121d31b2f2d1d48b305ba6ca22c1271f915ea56b2e64a99bf3fcf4d1ffe2321cf44d5fd867a1accf75be7edf8b81ef721d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js

Filesize
7KB

MD5
e40cd88056477b29eb0f34ba8186c0be

SHA1
0225a06e5bd7922b348f8078aa7ba1a271e91e47

SHA256
68cb563d44b7e470e052c45738ab108461795cc888ba46c4f0a643039d53c01e

SHA512
0b6555265ce8c1eaae6b7fff3c53b8bec1faa2c3323f75359711b9c6ca1851f044ce53e8d74da9b38c83cfdd024a35142c3abc466aeca73b4dd51486c09a446c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js

Filesize
7KB

MD5
c8e9d977fb1db31eb9853a209a83cb56

SHA1
2123c6a655375061b15ee14b182f8407b31220a2

SHA256
5ba3ddc05f1ea55398dee331ac8e258d33ecefea6cda8a5ae85d687560d058e4

SHA512
10df8ce8458fcce996decd98d8f394f23dc40d8246d219de5758beb39ee5c43014ab747dac6508362d2d32cd93c2a3469b93ad8d3461da2e17c17f251838ceb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js

Filesize
7KB

MD5
a3442eb7b6d3ec4814dc9bcf781fa64c

SHA1
7969fa3315e8d54c4e63749f8af07b4829b852a1

SHA256
cfc4053409831b34fec88cf0b0ef94085beba9ce01e6d1fa61454e7fd0b8a750

SHA512
c0e43826f0e0f930228dc795f727e767bb03ab3aee417628d5384caa32b2c9a3566ee5693210d1d8b5fd6cf0421e0d92f0fe191622c27ad578dd34bf13932d46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1017B

MD5
e8581d76c1e58c051833bed9d3778e79

SHA1
4505ac0cae7ddf728b3578e3a9543b41bd996664

SHA256
bd4c203d1505e7078622ee9765df7c68f4d80e0e7f46988ed8ba7a4398afbac5

SHA512
f54c203c53e0f8279f59d30de43ec48bb9fea780ebcfaa81e57ac7b56a6eeeb32eac86cc0258f47781ffddcd95e939178834df722dfd838056bab0c99ec653c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
166d44ac9b6f84d33dbfb6674e1b0fa2

SHA1
28c0197eb4de4e83e4e09cf904d8d1981b30f252

SHA256
0ecefca2be50cc2d0a9c3fd5541af826835bdfcdc07641e31586d850e3dc66aa

SHA512
153a3886ccf08b7a8bb98244086542f70cad98b0259ecbc472bf519e649767716c758475148ca5e9d4d1f63d193ad801069f8717831b0adce1d8009f5f56f5e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1016B

MD5
bcb97151e3a482c3140764ae90b9c77a

SHA1
2e679a518a368b5d936b8d9c8b7b1a46d62698f9

SHA256
5fb3e616199667bafc5f6d4a7e93545bfbdae3ab655e2ea1de88caa01f10cdb5

SHA512
b554850d83f9e41ac0500253a2042fc2ba604942338ac50b3a8230f6bc63c1efc7cab9d0ee558e57e1701bd28754a2937159c63beb653d3166b36951e8da9232

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
03f3b8781edd77882f67d2ad88cb8fd6

SHA1
f9e8b9f751bfe4a1b7cece1bbe140351052691c1

SHA256
e954959919730084fa617d7ec67c6984e2f9f83320c241f4f4dfe16b852d4f8a

SHA512
371dbba801e7d65213cc3e73342b54950378ba905af3a291c77cc84b17e7095b5811260e014eda0536739d829f050071b8c2197292d91423a89ba2ed818af370

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore.jsonlz4

Filesize
867B

MD5
cbbe6aace8004e8f6c5ec5094c108a83

SHA1
8819614545fa21d49d23046a7b3d81d43088c4a9

SHA256
06c1c90805bf2372214f28ed9f263ebc86842cf734a91308fe501f37204a9016

SHA512
32b8758120561afd2b6bccfdb460cbd03fada900eab6ce59962d97969885f45bdad37e54965fd0e72e71069087066fe204b95f213d922bc3c9d38a94b8e936ad

Download Submit