3815d51d128d38747900ae2a28188f901d8faada79930d039f6f0cb059f398b8

Resubmissions

05/05/2026, 01:40

260505-b3wvesaw5j

05/05/2026, 01:39

260505-b3cfsaev7w1

Analysis

user interaction
yes
max time kernel
9s
max time network
11s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/05/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload/Exodus.app/AppIcon76x76@2x~ipad.png
Size 35KB
Sample260505-b3cfsaev7w
SHA256 3815d51d128d38747900ae2a28188f901d8faada79930d039f6f0cb059f398b8
MD5 52defccaed40e16d3abdaa6457d0fae1
SHA1 857ab03de33140ab55acc04eabebd73084121af6
SHA512 719e6e91b8ba84f39cbfbc41d194fa1bb10eb093bdb7ba1b40c6ce11434817c692c18d13e97d3e64f912d1aeb6ce5aed01c0509bcee1f28066746077be8cefc3
SSDEEP 768:Ranivh5rcLeXoqD+FTa+RRVX+2p41zUSYr+9bnWs29mc6yH:oi/rcLeXoo+tamRVX+2az6Obnoml0
TLSH
T1F9F2E1F8E11B90C3C8C2C2F3288192EF9624D6F2C753E69F67B4D6944952395413CB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	mspaint.exe
4512	mspaint.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	firefox.exe
Token: SeDebugPrivilege	2032	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4512	mspaint.exe
4512	mspaint.exe
4512	mspaint.exe
4512	mspaint.exe
2032	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 2032	5936	firefox.exe	90
PID 5936 wrote to memory of 2032	5936	firefox.exe	90
PID 2032 wrote to memory of 5528	2032	firefox.exe	91
PID 2032 wrote to memory of 5528	2032	firefox.exe	91
PID 2032 wrote to memory of 5528	2032	firefox.exe	91
PID 2032 wrote to memory of 5872	2032	firefox.exe	92
PID 2032 wrote to memory of 5872	2032	firefox.exe	92
PID 2032 wrote to memory of 5872	2032	firefox.exe	92
PID 2032 wrote to memory of 5872	2032	firefox.exe	92
PID 2032 wrote to memory of 2500	2032	firefox.exe	93
PID 2032 wrote to memory of 2500	2032	firefox.exe	93
PID 2032 wrote to memory of 2500	2032	firefox.exe	93
PID 2032 wrote to memory of 2500	2032	firefox.exe	93
PID 2032 wrote to memory of 1436	2032	firefox.exe	94
PID 2032 wrote to memory of 1436	2032	firefox.exe	94
PID 2032 wrote to memory of 1436	2032	firefox.exe	94
PID 2032 wrote to memory of 1592	2032	firefox.exe	95
PID 2032 wrote to memory of 1592	2032	firefox.exe	95
PID 2032 wrote to memory of 1592	2032	firefox.exe	95
PID 2032 wrote to memory of 1592	2032	firefox.exe	95
PID 2032 wrote to memory of 520	2032	firefox.exe	96
PID 2032 wrote to memory of 520	2032	firefox.exe	96
PID 2032 wrote to memory of 520	2032	firefox.exe	96
PID 2032 wrote to memory of 520	2032	firefox.exe	96
PID 2032 wrote to memory of 476	2032	firefox.exe	97
PID 2032 wrote to memory of 476	2032	firefox.exe	97
PID 2032 wrote to memory of 476	2032	firefox.exe	97
PID 2032 wrote to memory of 476	2032	firefox.exe	97
PID 2032 wrote to memory of 896	2032	firefox.exe	98
PID 2032 wrote to memory of 896	2032	firefox.exe	98
PID 2032 wrote to memory of 896	2032	firefox.exe	98
PID 2032 wrote to memory of 896	2032	firefox.exe	98
PID 2032 wrote to memory of 640	2032	firefox.exe	99
PID 2032 wrote to memory of 640	2032	firefox.exe	99
PID 2032 wrote to memory of 640	2032	firefox.exe	99
PID 2032 wrote to memory of 640	2032	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Payload\Exodus.app\AppIcon76x76@2x~ipad.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27100 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {db6e776d-bce2-461c-8673-d12dd2458dbe} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {74eba41d-f5f2-4b19-8442-efc1300ddcd2} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3684 -prefsLen 27277 -prefMapHandle 3688 -prefMapSize 270279 -jsInitHandle 3692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3700 -initialChannelId {7d1ea462-2dc7-4c48-8149-4fae6cbb6fca} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27277 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {eb263a81-a231-42a4-9c13-b588207221b5} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34776 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2856 -initialChannelId {039db053-a2fa-4cd7-922b-7e17d1800876} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 34825 -prefMapHandle 4848 -prefMapSize 270279 -ipcHandle 4972 -initialChannelId {27944256-e3fc-47cf-9927-37b846865bce} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {597b9104-b592-446f-b842-31ce9695a9c9} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5484 -initialChannelId {fbc649ec-835d-40fd-a371-3af8c83b01b6} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {8a626a78-37bc-46f5-85cd-536addccf0c5} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dc9bfe158e1efbec5c149e7be8e32d35ecdd02009e0071f0481c8b08397630d0
MD5 21c4a97d34059e0984a0aa677ddefde1
SHA1 3cff2d918dd667dd346b5e556cc39962174dc44c
SHA512 113031932d1492655e775ee98cd4e24b0b415de90eb7e141d769bdc079ad37b23b3bcbccd52871613fc278e049d088e7b5474f4cfac58056bec17df64c2fab75
SSDEEP 192:JUvOv5zboBZmQCIyjfZxT1d66Joz1zgCl6mc0d:JUAboBZm/IyjfNd66Joz1zgC1j
TLSH
T1F0D1FF68F628463FC458023BDDB65B800F36788A989E7F25719C244C2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
Size 1KB
SHA256 17fd0215de97a7b91a88b712af51904d4795b8e1b130df4401c572074d54403f
MD5 8d92c9538bcf3ee0c8d07552f3247871
SHA1 4926a0eada248cee1ff050e1e182615a518610f8
SHA512 234809526c7f196d9361a16cfdf8b63676dc17e800168882705fbc254a3bba64cdb0cc33e5f4fd73b045da15144fb635092d5d0fcd207a77c595e646a522c4d8
TLSH
T15E214C6C39F98D7A98D7E29C7446028E53198A0704C71C435E42DF8DCDC9ADA326EC3A
MD5 SHA1 SHA512 TLSH

Submit Download

02adee69-ec8d-48d9-8028-462425ec1290

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\02adee69-ec8d-48d9-8028-462425ec1290
Size 2KB
SHA256 96fdf1909aa9c2d5caad806d22627ce4d9c07d49a918c577c03d329d216f2e23
MD5 07f6510387c4dccf3dff5ba8b52ccc35
SHA1 395ace243b754b42830f9476821c051cfae03a17
SHA512 6ccbb1eeaa3c663d42cab17bb5bbbcf43aba8d3aac31e3f504cf144f8b4c696237908207ae7078e3f1846a591b824b94794a0e1242141d645b044527b58d26b3
TLSH
T17A41215C35788C7A9CCAF15DD582338E5B648A0600C26D836E51DE0C8E967ED33AA82B
MD5 SHA1 SHA512 TLSH

Submit Download

12e49f45-3e6f-4bbe-9936-322ae6790e95

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\12e49f45-3e6f-4bbe-9936-322ae6790e95
Size 886B
SHA256 2f36e2181b572aaae28fceec0afc350e948180b26a7e41b3fdf8b46b9582711f
MD5 2ac4a6f2a7cda90d066446df13ef6fde
SHA1 e9037672e35e34ad28e428ce6c758f17ff6f71a0
SHA512 7a77b6db6a8ebed8def7cccadb329cdce187a098d977564352b46bb45f148da5f17c3b7ca9c3068b9af2053ba945528e6b536101bd084b8587e957cb8ee64a7e
TLSH
T1371144909620B9B3CD789257D9A5B7838FE5B027C0C74910BD900F184DAA51E53B7607
MD5 SHA1 SHA512 TLSH

Submit Download

1922232a-78ae-4030-8d0f-e5f457ea400d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\1922232a-78ae-4030-8d0f-e5f457ea400d
Size 235B
SHA256 27b7570d96baac62a6d7c0b00c627e703616879de6a59326be67d2e210a2424c
MD5 336a0b06eebebb7093bd88ec5aa8bef8
SHA1 2a7d6ce0497ec0567ee552d9fc2a500907326a95
SHA512 7b556846e6c987512ea787c49f5d40ff677079f8c9d968c495b656727982c123679158aa8eb452e069bc54d8ef0965422e47b2170b6bf3761b2a166c92a2c166
TLSH
T176D0979014A8AB1D08040F0FB0E42DC271848C332073B860CBA104B49DBCFC48212816
MD5 SHA1 SHA512 TLSH

Submit Download

99704fe1-c5ec-491e-aa6b-9fbbc7bb95a0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\99704fe1-c5ec-491e-aa6b-9fbbc7bb95a0
Size 235B
SHA256 0add4de60267d29dd72c480799286ca212858cd9685215989e8a73b9b8399421
MD5 3094cdc598882cab2365b5ec2c47267c
SHA1 ce3f512a1208112c7be09dbe03a67fcbf7efefb2
SHA512 e11fa47a29485285ff220837b51d4b1b7297ec975cc2112720d59a21b6e3b5bda2bc120c63a16c596da68a307cbed5c6f5f9a9e6f796e0b48cf827a164e4b59e
TLSH
T1C4D0978114A8A77C08004F0AF0E069C63048CC3310B05810AA6249748AFCFC4012280B
MD5 SHA1 SHA512 TLSH

Submit Download

e3578e55-623c-4699-8803-2a8f9a6cf9b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\e3578e55-623c-4699-8803-2a8f9a6cf9b4
Size 871B
SHA256 7a0bb22c267bb93e4a0cc75618ad203d1fb5b9291c08365d68f0d16f95c1aa5c
MD5 65d282c300e740ffe23f48ed1494b949
SHA1 70976f20b482ec54c38d5465fd4603d906c07485
SHA512 cf256146c7e3480aaea8d66215e9844fdfb5d07f49c63db46a5207ba281834de7de48d6d9b34387815e1f1139e08aff4952345caa6ffcb902211b94a5f5deaba
TLSH
T13B110080A72478B2CD6C825BCA967B429BE8B02780C684207EA01E184D6E51B93E6707
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 53e1847a6ecce3ce5e346edcb01741514f8750ec27301d9483705c88e471b8bc
MD5 f99c80b92e5293d767375c7082368c3e
SHA1 89d795d3f9a242eb85499126cf50a69f11a5810c
SHA512 acc5fa638ee9ec5aaa258ef15811be1a233fa53cd1a9b9f759a299a65695225fbe2f23020ea4ced2c2a7bfc90a5911bbf766f9f30791e5c27346f4171b5a8ed8
SSDEEP 96:xHLUTUSVqGq5fxKjqnjV1zSk+SSladv9jlHnAHVLBw88P8L4cnFs7GP:t9R5fxthB+SSDFBw88BqP
TLSH
T1C3E11F789408CB7F68B6776CAC6888316AB2413BB7BF68C710B944C4051CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 e54a8976897c5a7891bd2663249287f21e379fc7b2a7de11c47ab17dc7add23b
MD5 f45d4433ea4e2e1c91dec9825f41bdb8
SHA1 d807fe402e5c48f6bf6bcd4ece11c8e37b42709f
SHA512 17059c14c1a561c7d94d64e23c010ef9ca92132985cf7e3105fe5abfef34e7184ad4a64fc46bdcdfd59237e0394ff7f8bd74a9a7dd3b50eae9ce4d6fac1fb146
SSDEEP 24576:ZCWk+tIYI0Lgrb63BDcYrVQpa9dfH9EQ8lQyjH:Zjv7LO6pcYrVEa9d/9EQ+Qyj
TLSH
T111F52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download