hxxps://atlas-trk[.]prd[.]msg[.]ss-inf[.]net/q/XmZg4pTEyDvpPN1XIPQe5A~~/AAAAAQA~/RgRoq2VzPlcLYXRsYXNzaWFudXNCCma7c-DIZqBVCepSGGFzaGxleS5tdWthc2FAZG90LndpLmdvdlgEAAAAAA~~

Analysis

max time kernel
7s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://atlas-trk.prd.msg.ss-inf.net/q/XmZg4pTEyDvpPN1XIPQe5A~~/AAAAAQA~/RgRoq2VzPlcLYXRsYXNzaWFudXNCCma7c-DIZqBVCepSGGFzaGxleS5tdWthc2FAZG90LndpLmdvdlgEAAAAAA~~

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	firefox.exe
Token: SeDebugPrivilege	4212	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4212	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4244 wrote to memory of 4212	4244	firefox.exe	84
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 700	4212	firefox.exe	85
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86
PID 4212 wrote to memory of 924	4212	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://atlas-trk.prd.msg.ss-inf.net/q/XmZg4pTEyDvpPN1XIPQe5A~~/AAAAAQA~/RgRoq2VzPlcLYXRsYXNzaWFudXNCCma7c-DIZqBVCepSGGFzaGxleS5tdWthc2FAZG90LndpLmdvdlgEAAAAAA~~"
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://atlas-trk.prd.msg.ss-inf.net/q/XmZg4pTEyDvpPN1XIPQe5A~~/AAAAAQA~/RgRoq2VzPlcLYXRsYXNzaWFudXNCCma7c-DIZqBVCepSGGFzaGxleS5tdWthc2FAZG90LndpLmdvdlgEAAAAAA~~
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1244b9c-0091-457c-a5bc-c66510fa8125} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" gpu
    3⤵
    PID:700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2488 -parentBuildID 20240401114208 -prefsHandle 2472 -prefMapHandle 2468 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81663039-415b-461a-8321-912d82b8986a} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" socket
    3⤵
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 1 -isForBrowser -prefsHandle 3224 -prefMapHandle 3428 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b21e03c8-eaa3-406f-97d5-6dcc3ba9c4c0} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" tab
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3932 -childID 2 -isForBrowser -prefsHandle 3956 -prefMapHandle 3952 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9c08431-b2d5-4ccb-a200-f3c3b4539b01} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" tab
    3⤵
    PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4800 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4788 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8c7ea1b-d49c-4d53-b0d9-669ed1e03dfb} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" utility
    3⤵
    - Checks processor information in registry
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 3 -isForBrowser -prefsHandle 5296 -prefMapHandle 5316 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04e5d778-72a7-4e32-8b13-008bdf52251d} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" tab
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5448 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4143baa-f825-49a5-9137-f22c61b49a8b} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" tab
    3⤵
    PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 5 -isForBrowser -prefsHandle 5752 -prefMapHandle 5748 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e435f3b0-77a1-4260-bdea-5f894e3e9259} 4212 "\\.\pipe\gecko-crash-server-pipe.4212" tab
    3⤵
    PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json

Filesize
35KB

MD5
29b67bba543f2e5646b8011dd38aa274

SHA1
bfbb98ca45213e49b07ff2649788e8a94c37c985

SHA256
d37296536c5dc6fd651d57b1487c383b3bd5a439a0190a0c408b0fb090735be6

SHA512
9d61bd07862598109aa95f17d2b28661ae00e974ad1915466aaee74c2abf03a29c429d1930a17905a99e5e6a3c878ee5dda188f79d603840263c30e753899e3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
99955453b2844f430778ae48a95e0c75

SHA1
460cc132c35b436214e6967505309c51fe897b2b

SHA256
4c15c366b3dbce93d75602c3f889e7133669dc863425b3d0c016d0e294cdddb9

SHA512
68b907d2aac90733c70598ae1518e749af35d7a17e0c650c73f80e04d9ccfb013a609ec117c50b6b4cb301916e2f66011291731d07389a67480a757ebb861c29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\3b8b0329-895f-4093-bfa0-ccb922a7f358

Filesize
982B

MD5
6750b8a8fe25a7af873bc8c92c6aaec4

SHA1
9914a0d59eb9a8aed330239f87215f61c2754fb2

SHA256
869035eeafd7b6ab1ef49893a800b8d0b4d57a3fbc6b1116272f8bc540789f18

SHA512
90fee34d091490097166dbcaeff9185049e424bd3d87720ff544a055de1295d370e026feafb7f21319edd53302b526e55f1971e80e4184062f81cc3a3c4b7a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\6a1cf962-325d-4cf8-ab4b-e785b9f69c4e

Filesize
27KB

MD5
aa31e4cf913fd93f166e608ec9464554

SHA1
1f836b2be25d8acdf14f054bcddf23fcee836a7a

SHA256
143cd13b1721f8557aa14e5f4ce481fa06919c5530dbc8ec99a5e23b9c5b7e0f

SHA512
84f11b94068d2dee9e5b80ad93866ed9054ad6e05fdc6dadd43e777d5d250557af7966689415bb1218f3c31f09b73f70107ce4dda404839ffb47753baeedefe5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\9fd1c3e8-f0e2-4a31-9786-bdf93074df65

Filesize
671B

MD5
df3e44280676e800565c635810046b94

SHA1
1b9401c9d926f96ae6a956a3c86849b0068732a0

SHA256
274e8f828023f2e959b17e8c79cad660a3e269373884e09b67f59ff9a41dd8e3

SHA512
4912825dd9a2e1afcadfc6f2ff49277633a0651e74101f2ac0ed51a283721ce9cf3d251bf7e0b05087931ba4ce5e9371a21d7e3defe697dd36bd124f6a7fcba8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

Filesize
11KB

MD5
1c501f375af5145117d71376e3ba4091

SHA1
e685b433d7247d45f4f72a3d4c3ef30a2c311c65

SHA256
6a1a98baea2db64ef651c22f12dcc11ed835c196514642316b17e7b7b4883ac5

SHA512
7140e5369edb89623f5971c135f91a4b578323d935143fb3459f1d3759c6c3b247a21cda6864f24198b43ae22f02fad5f50ded935a3afd0fbbcbe1802cc1df61

Download Submit