Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 07:30

General

  • Target

    https://google.com

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://google.com"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://google.com
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1784 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cb91985-6920-4f3b-ab23-d67ba4ef671b} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" gpu
        3⤵
          PID:3488
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {150844f9-3123-4dff-a9de-593ab458a0ef} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" socket
          3⤵
            PID:3620
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3376 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b4e50f9-b143-4133-a4d6-a7354c8b965b} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" tab
            3⤵
              PID:2668
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3604 -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 2728 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52a2d0f6-5f36-417e-acc2-08d39f4e97b4} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" tab
              3⤵
                PID:2924
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4668 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4672 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a4d8b16-be91-43cf-accc-bb8333bb5d8d} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" utility
                3⤵
                • Checks processor information in registry
                PID:4832
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5212 -prefMapHandle 5268 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {740cf312-b7b0-49f1-8bc9-2001d0728bb0} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" tab
                3⤵
                  PID:3828
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5512 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7811f2c8-ab2f-44a3-a79c-f72d94556001} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" tab
                  3⤵
                    PID:4372
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 5 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71bd6e35-bbb3-4d35-8b2d-a94f1b5306a2} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" tab
                    3⤵
                      PID:2800

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                        Filesize

                        13KB

                        MD5

                        4423ec5619b8cc148f7b2ec0c4681943

                        SHA1

                        4b863a32964280237436645ac2f397006ccda044

                        SHA256

                        f0728f6717441c296ad377226d6195c5c599115dbbd8fefab463798a0cb57860

                        SHA512

                        8f421a18171009b3db0e9751cf418da08ab1439ab1adbdbbd3b091ba614c50e24f82bb98392b60ca90f30d3cf0f8e28cc1cbdf07a2d4f0395c88ea5cd9521d71

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                        Filesize

                        8KB

                        MD5

                        faecc4dd8dc4b94b79ff51e56e9abdcc

                        SHA1

                        59bb63406a2ae6294b48139fa08bf4a1d2294631

                        SHA256

                        2c45cc9a780658e6b913e2625f999476a4c3c1e552d53b329bd991b990ae0ac3

                        SHA512

                        10e5ddddcf460321677f10a153c1c7cd00cda11ea5d38bdbba146759e2f958b2b9f0c6feac807e34d2ec0f07e7abc8d95ab5d7e1da46b71505e2110519a37152

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        6de2abef449e87ed2c0037aed7610c79

                        SHA1

                        64ce6f5e73e6c835f96a12fc93af01556477f7ef

                        SHA256

                        bd483d0fb4b3095c1d05522cc5b7228315ebc19cbf7cc8e6860d61b9e041f68a

                        SHA512

                        24552e7f4a37d73be03f93f7e21b1c76055ab05c20893175222fddf0e1572d8e192b3a4579bb6fd46c9f1eeb0098f950f26260c65cb91d738aacbe10158b830f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        15KB

                        MD5

                        5d6443fe500dfe8d3125747173755adb

                        SHA1

                        bf0b5016fb9729ab04d5f5079d9b65ad30883235

                        SHA256

                        d80e0282eefb6bf97411ea7df9518450ca33758f9c543ed9e932e1b24902f126

                        SHA512

                        63c55edd33ebcabe23fb2c78f8a183db6f4a9ac242c827cea2abf4c700345ce20eacb1d081828f6b5107531e3ba72a465d6404df22cab9c0f6d4101756327b04

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        15KB

                        MD5

                        8390533cc78d8d5d25e11b0363a0251f

                        SHA1

                        97409fca5bba103071056bb280b02abfca7868f9

                        SHA256

                        ec5634c45edff93ae7c8e8f065b8fcd44b3d5b8169d4b4efed961fee65a68e7c

                        SHA512

                        2349e92127ac19cfcca5b665c864ee641cfeb5422a727001073e873211407e7c16be4e4ca809632937be3445b97be2fd49b80463c2cf1006835950a7846d2e01

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\1ee5a219-7f61-49b5-b369-6cf56cc9c2c9

                        Filesize

                        26KB

                        MD5

                        8ec6d4439e057de64c28f8f359dddda8

                        SHA1

                        5baf2936d21407d4dd1806c581d779abacaa5f73

                        SHA256

                        fa079ae97513d206f8f19a5cfdcbf62cc28f95ff55bf74a8c2cbe3cc768e1350

                        SHA512

                        124f848d4c7f1e1160f4f47462dc70e07f62c98023dd03999f4a1e5d535d9a2e2d2f8fc0ef656b910a84328d9230c85059f4ec092770490da253cb7364cb2502

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\2d568f1d-189c-48d7-8f49-1980190bed00

                        Filesize

                        982B

                        MD5

                        6c92e6661ae21f1b377443128f823cdd

                        SHA1

                        9e287577c96e802c1aca52d7b7d24da803def8cc

                        SHA256

                        c9482dd1e48e380eb42b560cd1e7479c00e6e283279e9b0883dcc81a484ac981

                        SHA512

                        503aed61eb0bc4694d5d88dcb4eb4d70cdfd59c4a4c6bd6a4bbb7ce325fd82ceaa6a05e48914f20e6518d4db0378e5db1ef433c45e3f3b8d1c1a5cb314e644c8

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\db7bf5c9-1e5f-45aa-b71e-118e0103f9ac

                        Filesize

                        671B

                        MD5

                        b4c032e644e9ecfa5f6eabf3cab77c8b

                        SHA1

                        96baf3e4a1e326868d3f25e16e289e7a25db8025

                        SHA256

                        a9c6d3016aded2b1eca462fa3e9d457ed47160fc960af2e193a1cb933ea037cc

                        SHA512

                        0b28bfeb980f6ce2cf1d3b0b238bfeb9d6c8dee7916cd7aea940cd255c4201301eb9841c9ce053f1ddb7011664c2133b677b526454a77681614be5f27698c298

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                        Filesize

                        11KB

                        MD5

                        eb15fdc2f6a47d6f30650559769d360e

                        SHA1

                        57125f4f0f04f6931905c3bfe3d50569a6c80db9

                        SHA256

                        f3d9fc37a09c9d42e73866aaee3ac5613492ac0a48e5592c28cae7de1373088b

                        SHA512

                        a462620b96e192d4137bef8bdafd543e7acf41ffdeeac15abfc45101405d9ed3b2eb710179ec05ca8e829d2609646cde509c3331f347eb2485f86cd366598707

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                        Filesize

                        13KB

                        MD5

                        8140a126c6677d7e8719ac67bb7d5568

                        SHA1

                        7c23c51bc3e969b8a258b62da5400360747f6f42

                        SHA256

                        99bec2ea0ce0f9bd02fcae06b5b283e879f02794ddca8dfa7fa364017d42442b

                        SHA512

                        a420b490bfa69ae7733864458421613894e10be13ce076514064e6d676f8748f45716a44bd8ca5f2f7a4eb7c249cd5f611dd95391846c079e875c783ab4ddf1d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                        Filesize

                        16KB

                        MD5

                        7738c6b7f53f434de7eb5d16bba1b414

                        SHA1

                        665a4ab7d2f89d1f55e2ea85a5c40ca45c990617

                        SHA256

                        4a42bc9fc5289aa769507f967037d773864fb86ea02be71681bb6077300de19c

                        SHA512

                        d83736f53fb1b330499b87d81a8feab0e58abf08e96abe5e73850b93e4a3fa6972074dd091da5744c5b606f4ca82fcfded410f251d920bd2a6579cb266ab8680

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        4KB

                        MD5

                        64efb55f1bc67307cb538e77d2525473

                        SHA1

                        44c53dbb40a9bc1698e4998723ee14b00ef8bf34

                        SHA256

                        a977b15ed6b830baf749b1cdb2fcf8eea401778630594263cc64e2a4dee43d0b

                        SHA512

                        7ea8eaa37429daa53e9c2a25e6fbf198f27aaee69c659314bc9ed271ca4420b9583432709a52f1fa3b58ab318d4a7e006786c7b7b3a93ae15c14e5ce14ba5c4e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        4KB

                        MD5

                        230f2d2eddd64a85f2ba03ff60c5fb18

                        SHA1

                        dc07dbee51e8a59c7baacdba4c99343c57248ef2

                        SHA256

                        27a852b7aed6b1e4ecbf106f911b6dac8c65092b1d2163590229c24d035f2dcc

                        SHA512

                        80ea5d02964c7ef199e41c21c900ecceef210cd98ed1e8589fa20c48d367056a75802508f2e399e23ea1d29a863e88d1b574cd035b784c8db2b9f293511c8f52

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        4KB

                        MD5

                        cc332f2dc720d3a09fde048504050331

                        SHA1

                        d52384baca26d0b782a551b6f8c6735802e0123d

                        SHA256

                        788abe6c5ee77cc883d4262cb327f9a0f3ac88ed0293a91035c78737f56cbe31

                        SHA512

                        eacd6d2ca2edfd02b2364c97e0d6e6d662eac4c4ffe8c00f9774df76e622c5bc4e8ef378891173d5314e897ac9c2f43e21cd96c4c84f9154577c3dde32e98f60

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionstore-backups\recovery.baklz4

                        Filesize

                        4KB

                        MD5

                        d0842d29f6a13676af279355cb82abec

                        SHA1

                        8cbb16b66b0f69df655a503e7c57b09ddf0625c9

                        SHA256

                        1def06e929b4cc982ef7fa9be88c6555f6da720d381847724d0ccc913fe27863

                        SHA512

                        bad3cf6c9d6a0617ca60fe355d127c4bf3c398823e115079e87e7e6b161f0f514574858c4c9e13f06ae4178ee2c7eba09f81976e452e17efb1fe21027c24ba5f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        984KB

                        MD5

                        577b3e4fbf733a7d25511a33cc7efc8c

                        SHA1

                        12390c3aafd2a21e530d6aa8c256bb510694afbf

                        SHA256

                        a84609adabc8e472c2d2911b384052604231851260d391945219318fe4c3aa91

                        SHA512

                        488888e5df4b6318448de51081630510b7a06a95f12844c967af2ffbeb9aab6b16c8a6ddb37ee95c939f81f25047bef4bf4fed626d2ff36354195b0a0bb361bf