Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2023, 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fluxus/Fluxus V7.exe
Resource
win7-20230705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fluxus/Fluxus V7.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
Fluxus/Fluxus V7.exe
-
Size
3.9MB
-
MD5
b4f9cbca656fd34c4dbb1d706a7f1ad3
-
SHA1
2b95d88a80ccb619b581c420f7435c660cfbb28e
-
SHA256
1e022d3886700317e5c41977de8fd595db5fbb3529164048ed09ee7efdb5711d
-
SHA512
5ed86eaf8ae42d9a8f0dca9776e25b3c2232434b32088df7feaa8149886594f1d4b1e37c597597eacebdb4082e0263441a6b78def5eef2ad610a6875c28fe969
-
SSDEEP
49152:UgLIR9JyCns59qfuce05XlWycazyClY1YH8PnGpv80tbvvqVUcH:UgLIRfyC7egWJa3lY1U82kmvvoUc
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3828 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5060 Fluxus V7.exe Token: SeDebugPrivilege 3828 taskmgr.exe Token: SeSystemProfilePrivilege 3828 taskmgr.exe Token: SeCreateGlobalPrivilege 3828 taskmgr.exe Token: SeDebugPrivilege 4732 firefox.exe Token: SeDebugPrivilege 4732 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe 3828 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4732 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4440 wrote to memory of 4732 4440 firefox.exe 95 PID 4732 wrote to memory of 2104 4732 firefox.exe 96 PID 4732 wrote to memory of 2104 4732 firefox.exe 96 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 4544 4732 firefox.exe 97 PID 4732 wrote to memory of 1428 4732 firefox.exe 98 PID 4732 wrote to memory of 1428 4732 firefox.exe 98 PID 4732 wrote to memory of 1428 4732 firefox.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fluxus\Fluxus V7.exe"C:\Users\Admin\AppData\Local\Temp\Fluxus\Fluxus V7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3828
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3548
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.0.1090996149\451752605" -parentBuildID 20221007134813 -prefsHandle 1824 -prefMapHandle 1816 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5288aae9-2c39-4f1f-833e-53f3beec358a} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 1916 267fbadcb58 gpu3⤵PID:2104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.1.196701483\417978728" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2292 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8df986f-e92b-4da2-9b86-7bac1bcdb017} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 2316 267ef072b58 socket3⤵PID:4544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.2.637501713\1593062125" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3084 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e88be567-d1cd-4999-9822-2298918a63db} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 3268 267ff8a4058 tab3⤵PID:1428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.3.167386397\1973883868" -childID 2 -isForBrowser -prefsHandle 3480 -prefMapHandle 3476 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ada7c78-d52b-437d-8bfc-6d39bce6ece4} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 3492 267ef062b58 tab3⤵PID:1648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.4.1557289722\1341579855" -childID 3 -isForBrowser -prefsHandle 4388 -prefMapHandle 4384 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fecb480e-95e6-46a8-8a1a-5708e16b851d} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 4188 26800d84b58 tab3⤵PID:2276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.7.1717764093\1888645516" -childID 6 -isForBrowser -prefsHandle 5280 -prefMapHandle 5284 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a033c03c-e77f-47b6-b796-040c3ee98350} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5272 26801cf0758 tab3⤵PID:3504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.6.111508\1352144305" -childID 5 -isForBrowser -prefsHandle 5084 -prefMapHandle 5088 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2127a89-af36-4b3f-a9e7-0aa96e29c5dd} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 5072 26801cf0458 tab3⤵PID:380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4732.5.1979305951\1967870378" -childID 4 -isForBrowser -prefsHandle 4932 -prefMapHandle 4972 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a912ee8c-15f8-46b9-830d-3e94b5a2900d} 4732 "\\.\pipe\gecko-crash-server-pipe.4732" 4924 26801a9a558 tab3⤵PID:3336
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\suuk1m1w.default-release\activity-stream.discovery_stream.json.tmp
Filesize152KB
MD5d8a5570c9415c98a1475ba5d41bfe242
SHA1dfc35967a14150565cea5d67b47412d563c28b95
SHA25603a960a1cd12e5228d445a1423915ea0e3a4457fd4dc68a003f4ebcd474f90bc
SHA512091bb582acc1fa11f523fba7672eda814e76843cd2c04e5ca2f08c5b7415dbdd5a2352244761815a90c9a655565f0b84d08fc51b191e3c640d679c693a052678
-
Filesize
6KB
MD5df3c23c1cdead944f100dad5a6a0e6ba
SHA12ab0cfeab39435dede0fe04345dbd364e03a1519
SHA256c8ad7a790b38ce3e899e6f260c79505c60da9715f7af131f2d32f98cd6273e51
SHA512b9b81a9b3d236abc6eb80373a008b9f8d2985ca537dfd0cd067c943f8941025c7fee658794d2a80fac09be01674ec0bbc9092db97fc7e089f4dfba8e54ebeb29
-
Filesize
6KB
MD5ae4f373040e407c8825da3b7d1bea83e
SHA15743dff7b037fa05f7f9250cc9d82b21362bebd0
SHA256897054750f8a215526c60c54cf0db212f8fbe4d53f782f9ce293d81053568059
SHA512380ceedc6dc351d040471d1a8f9d9daa62745c15a6ee5ad811d9bdec79ef739d3de3decf1303dd9519cce9941cd096a137ab6d8b672f12427a6538dea61c9fa6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5001f81719eca6beb2fb3aa7910a116e0
SHA1d35085b478be55e81a451527696d8de11becd04f
SHA256ab5eec7263e5cfe76578dbdc1a433fe02117c8e7f98bb0c466610d46787b890c
SHA512d0439d5ecd1ca165443d3ed5948869c42b21b1858b92c85e9898328e0ae4816a46ba65ad8c16be56a8979261eafa6e34e343403ae14d0a0d2f30f87c1dcc141d