hxxps://mediafire[.]world/data/bhgu-oloki-hyggu-uygbh/

Resubmissions

29-08-2024 15:44

240829-s6vj7s1emn 1

29-08-2024 15:41

240829-s43g2a1dqq 3

Analysis

max time kernel
14s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mediafire.world/data/bhgu-oloki-hyggu-uygbh/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	firefox.exe
Token: SeDebugPrivilege	2092	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 4284 wrote to memory of 2092	4284	firefox.exe	87
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 3472	2092	firefox.exe	88
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89
PID 2092 wrote to memory of 4100	2092	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mediafire.world/data/bhgu-oloki-hyggu-uygbh/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mediafire.world/data/bhgu-oloki-hyggu-uygbh/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6f3926c-0407-40d9-8180-c44d2af795a8} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" gpu
    3⤵
    PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2448 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8e5b42d-56fb-4921-acda-ef6b4125e7d8} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" socket
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3076 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfa65d0a-3643-40ef-a099-22f2bedd0ef8} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" tab
    3⤵
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2652 -childID 2 -isForBrowser -prefsHandle 3696 -prefMapHandle 3692 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {300f05c9-f7d4-411a-882a-f473efe24a90} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" tab
    3⤵
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4504 -prefMapHandle 4496 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4d79140-6742-43e3-896d-efa8d30adf83} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" utility
    3⤵
    - Checks processor information in registry
    PID:816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 3 -isForBrowser -prefsHandle 5488 -prefMapHandle 5484 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a9eb3e4-26ef-42d9-b201-84d87df12e20} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" tab
    3⤵
    PID:3748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 4 -isForBrowser -prefsHandle 5576 -prefMapHandle 5580 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd95b778-3746-4b30-8261-ce3903407b21} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" tab
    3⤵
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5792 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74d3ea01-63e1-414d-9fe7-0db6f498447e} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" tab
    3⤵
    PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 6 -isForBrowser -prefsHandle 3108 -prefMapHandle 3124 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f068105c-4791-4cc8-bc0d-aa6229c4982f} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" tab
    3⤵
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\activity-stream.discovery_stream.json

Filesize
40KB

MD5
3047dc06050302fabb70c012778ad5f2

SHA1
76019a976d6c8035f2518074dc8726c2530a0129

SHA256
d4f050231bb23ad4ed0fc862a6a9fa1d562ab9c78a2355eb0280ee31315cab5e

SHA512
16a1310ca272b2ed3d22887ce084147061218c16825044aa799b278f91a5ac75110e905668b44d2affe5eb335836bfeb1617ce65de4254d0137fa158329aa83b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\DB1742FABE0A7197269CB1791F8541A76CBE1308

Filesize
220KB

MD5
38ab3046783ab688c624f1a0d99f536e

SHA1
b90ee69a7768ba7bd72136bd01119ef3d5025645

SHA256
246cad32ba4621321fcaef8cdaf7d582cf6adb46f21c4dc581abba18e03ca9b2

SHA512
f514f5e9b768c3b6987c0249bb11f62a7b91db7d3c9a7c93c7a1d756de7d7d2888009200ed892184f1ef488629380dec284e035337407729be6aca36bb66c519

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin

Filesize
8KB

MD5
54c9f666e511436b642de9aa2195a4fb

SHA1
7dff2c75a6e29f8783ec188772a507930cb02f5b

SHA256
3bb7652c0f7756df15abbc2571275ded04ecffc9e77dcd96a18e09b174722a78

SHA512
bbe3ab9c3443a2949005ec739dad63b02e6ae6aba76429530b8de1c6719128a8316f7f8214ddf32b268d871259cba9a37fcda8040d14446880448bf01e16b175

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
656ae67e767cad7534c8f8649df38c63

SHA1
2db342b74a2bf806ec18e914d2482c2afc7b171e

SHA256
6c6e2738949eebc43b99e5ee8f4aad53eb207932ce26d763a694e02e83a1e951

SHA512
82b3c373f4269350b036947ea2a5dd77426c5e9937855eb764b1a946dd833244788d6a97e1a93bff955dd3f4f5a00fff1583267c57e4c7cc156766eb3b0504dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\3711adf8-954b-46d0-bb0b-ac25d793d85b

Filesize
982B

MD5
5bbd97c3a4702af09e9e8eb122424020

SHA1
8efc1b5879ae3db677f09f73782b5fbfaab76c32

SHA256
9d81ee8fb8ccfe516dd7796fe145931d92bec2f9587a5c6bdf8c98c7e833dbfc

SHA512
de52cc60910c8c847c1060a6eb0d858fde5c9e31b5209ff7af98f9efab54154409ab120b972be885fd06f3dd9c4e6789e7e8c1e8fd5b707c5e780c3c746a85bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\73f18729-529f-4eb3-b994-4d79129e7d1e

Filesize
26KB

MD5
0db2ac38d3aab40457960af9e9331b87

SHA1
1320379ac3aabd41f8a23e3b5c0187d0dc578cd7

SHA256
5a286040ca669caaffd74d6ab45bfbe5f04a62ed516e1c2f7dbf60f70b5d2ede

SHA512
3bbc80cbb38fafb4d6ce37522161f9f3af1d06d50c82fc8112fec7d079660a1d3e33487a86f4ea26b6b3a99a72124ddd448bf017b9861d6f096e1030066beeb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\78c04969-bece-42e8-ad98-d98ac6572668

Filesize
671B

MD5
ee689f93708c1188582c642a87e18352

SHA1
02d8c45a9211081caa50b1bab839344b0090ba5a

SHA256
1623131bb7b7cf05488b665d8d8d1be013780cae2fa05fa4e81c209fa00dfd35

SHA512
cf47afa92d691f5d2313aeb81aba0d251fe556992d7b8ecbc5ac9ad22406e9dd3940896dbea715dd954e50ce31e254bfe1ca8a57e70f47c28e621b7d8945ea7d

Download Submit