Analysis
- user interaction
yes - max time kernel
91s - max time network
103s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 12:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FluxusZ Windows 1.2.5_77240987.exe
Resource
win10v2004-20260513-en
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
FluxusZ Windows 1.2.5_77240987.exe
Resource
win11ltsc2024-20260710-en
7 signatures
150 seconds
General
- Target FluxusZ Windows 1.2.5_77240987.exe
- Size 702KB
- Sample260711-ph7m3sb14x
- SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
- MD5 cd85c75fa053954c4ae4ee338d3bcb63
- SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
- SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
- SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
- TLSH T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings FluxusZ Windows 1.2.5_77240987.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4828 NOTEPAD.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3008 firefox.exe 3008 firefox.exe 3008 firefox.exe 3008 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3008 firefox.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3640 wrote to memory of 4828 3640 FluxusZ Windows 1.2.5_77240987.exe 89 PID 4620 wrote to memory of 3008 4620 firefox.exe 92 PID 4620 wrote to memory of 3008 4620 firefox.exe 92 PID 3008 wrote to memory of 8 3008 firefox.exe 93 PID 3008 wrote to memory of 8 3008 firefox.exe 93 PID 3008 wrote to memory of 8 3008 firefox.exe 93 PID 3008 wrote to memory of 4652 3008 firefox.exe 94 PID 3008 wrote to memory of 4652 3008 firefox.exe 94 PID 3008 wrote to memory of 4652 3008 firefox.exe 94 PID 3008 wrote to memory of 4652 3008 firefox.exe 94 PID 3008 wrote to memory of 2708 3008 firefox.exe 95 PID 3008 wrote to memory of 2708 3008 firefox.exe 95 PID 3008 wrote to memory of 2708 3008 firefox.exe 95 PID 3008 wrote to memory of 2708 3008 firefox.exe 95 PID 3008 wrote to memory of 3952 3008 firefox.exe 96 PID 3008 wrote to memory of 3952 3008 firefox.exe 96 PID 3008 wrote to memory of 3952 3008 firefox.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\FluxusZ Windows 1.2.5_77240987.exe"C:\Users\Admin\AppData\Local\Temp\FluxusZ Windows 1.2.5_77240987.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4828
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4468
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1908 -initialChannelId {9010ec5f-25ad-44fc-bf11-30cce32fe7ed} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:8
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {c27460a6-44ff-4442-be2d-366f518aedf9} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:4652
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27323 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {bf5fd7f9-aa92-4183-9b45-7e8b50e973d3} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵PID:2708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27323 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {82112e74-387d-4549-8de0-d2bf1302dfa2} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:3952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2600 -prefsLen 34822 -prefMapHandle 1600 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2940 -initialChannelId {53416517-c841-43bc-bb76-6cc2f8c7ea0a} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵PID:6044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5288 -prefsLen 35089 -prefMapHandle 5292 -prefMapSize 270279 -ipcHandle 5300 -initialChannelId {4bd7ee5a-ef1b-4733-9091-f85caeb3f2d6} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵PID:4688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 33031 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {0814fdae-4bfd-4c6e-8845-2819a9a2f71c} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵PID:1340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 33031 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {72a23e8e-e089-4f90-a558-8f5ed5a7aaa4} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵PID:4704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 33031 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 5920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {7a155df8-a8c6-425a-b265-fc2b9c8881c1} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵PID:2728
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\file.txt
- Size 58B
- SHA256 1fe92d0bde1b0013fafc4498df9513f8d4d6dc61f019b2f74ea785cca4d9da1b
- MD5 ad789bc09f5ae37df55ba2581a9974fb
- SHA1 b7791b79d9217f74182a5611551e06a1ca2ecabc
- SHA512 dec746dc2af9c2f8e210f5a4d68c70a3f89723b96dde32ef4e36105a4d07e1d05060d231eefe5bc2d35b50889fc861e60d007f34944ed4c520fce916cd941629
- TLSH T141A0023599C42449C826CE4D39E498892011004705ADE299EC329602044B61664E214E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 ae41a3e334b720e55aebe23841f7300338265655fc453892fb78b8fd1e3876b8
- MD5 37796e17c01c3b5ac6c3145dfa296bad
- SHA1 24a52352ad0de31f6a1b64d3dc5e0e7037259250
- SHA512 c12fb70394bca952faa32e44ab61ff3666c39a30863cdfc4c77f974332b664bda05361c3755e51a1bf608bd60cf6a3a47261e3cb0e5ea50abdc758ce9e4fe8bc
- SSDEEP 192:EOv5zbo7pZmAyjXMCo/1d66JoztdzgCl6mc0dz:Hbo9ZmAyjANd66Joz/zgC1jd
- TLSH T15CE1F068EA28963BC408427BDCA21F414F3A384BD84E3F1535AD645C2D572DE7B8E1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 f862ae9457ab64d70a159b9620eaae44655e954fa87770110e18bc2d312ae708
- MD5 5afe99e378d96e6616949494e2798137
- SHA1 95aa15df60750b27dc9955f17ba36e6264cb96cd
- SHA512 6baa084d54b4a34d67da5fd553d85062bd4286459328058f31f5b3cac52d0cd263c1e85cc7b712ed8203ca045347661023d6132bd2a3d67740ade346610f900e
- TLSH T1AD219E5C39B94D6E68CBF29D74D1028E9B208E0745571D470E03EF8CCED1AEE326A439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\2c828f1b-4f91-47f6-918f-55ef5fabbbd9
- Size 235B
- SHA256 c86a19e6dea27818cf24afa6d412ab281083f054a3196c2b6f1fd1fe39540ca7
- MD5 67aec17b508494e3b735ef0afd952ed4
- SHA1 488f7edfdc238cdb0c37a31ecfb6630ad546e2e2
- SHA512 8bcd5a83a51ce91f2baab725be25596bb73756fb5d1f65be977b639c869fa79d172598c0d3168404880ab603da15db81ce07c7b79d21c7e4f06ab9e72755a80f
- TLSH T133D0978A25A8772C58140F02B0E1B8EA70948C3321705821DB6206B8CABCDC54122827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\3fbae230-baf1-4a94-9ce2-c672fed514eb
- Size 886B
- SHA256 b742b53b9b0c390f8b683627009c841bd2a47ff72515ca79fb6b933a872bb035
- MD5 b88e6ad97b88e36ff07b32b4d67cc1ef
- SHA1 07e7b62c3b54e645e228e06fa2478a6a64c7b59e
- SHA512 41d8a81373338890f1386db091a37976b52212ef20eb3b7783c8ec1677e93465f207f15f7a595e01a00c447eda67c3e1a1f8dbb6e7f7c3bd69f132cdb597d5e4
- TLSH T1E11100958AB87971CC78D18BD8A1BB428AE4742380C609147EA0AB180FAF51F9B57307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\4357b48e-736c-4b7f-a2af-7f410c303433
- Size 2KB
- SHA256 380fb0007c731b17e3b46945e1f8cb101d7cc5e2beee4ab98eb5d05b1a2ddff1
- MD5 031002ea7f50b7f4f04eb245b8d06601
- SHA1 2826dc4dd29e32528e13185850656aab3e7728dd
- SHA512 6648e78ad5dc45557c7677a26ee383351d9932b41d1a9f225047265befd095372aaf2088a8ddf358c4f4e17b42ee29a721e9ce9ec51c109557d73a473680a76e
- TLSH T1AC41649C3D789C769CDBF14C9482274ED7A0990304C628832D62EF4C8E966DE736B03B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5fc27cba-e54f-4a68-b9fc-3014b25a754f
- Size 883B
- SHA256 cbad9455c3189ac019d9c7f8f993acddb3c7fb1385077f7f71b152376c0a3efc
- MD5 5393726491eb936002fd8c4ab225cd9d
- SHA1 58fc90e203af388d4636f0b87d2292fda66132c8
- SHA512 9c2f21a9c905d450030d475e413e567d20831182c9689b1fba4221b4fcef2f311ab74ab5e361f217a00433558d137374827ec42ee1da06fa56d7ba74c8c55530
- TLSH T1D9110084C57579B2DC68C25BC9657B428BF9782380C640143DF16E040EBE51FDB5B307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\6f2af0ef-578e-4632-a277-92611255c98b
- Size 235B
- SHA256 e872741cffcf62113fa29b37960c62b0c014627bb26fd7b0829bb04f1ff81eb5
- MD5 e1d35d1d41999a72c9c77a8b50938080
- SHA1 77a7fd40e274d81d652a488a886ada2f1bda74e9
- SHA512 c093ae0b6fdab5f42cfdb27b98103978ddb4855dd3f1e4243fd08fa9e8ffb65f497722f014fd8a242b20a780d14301b8036258551614a2f0a59c18c163d08dee
- TLSH T116D097C418A8A72C08080F03B0E03ECA30888C3330B46C94EA904578CAFEDC84153C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\bea6a23e-fb64-4783-baaa-661c52acd69f
- Size 16KB
- SHA256 cd5b94e3978e2ce89c9cfa200ae721bad7daec026a84d7601878a34563a73ca1
- MD5 fb8dfeab2fdfceb85dd02f4ab01e6913
- SHA1 0b205a1758dc89d3503c3bf25437c7238f0b29f2
- SHA512 9d6f604a2f191f94ed5c6e9a618ac322b2ac4488d5c583a529e1fb09c42668be16f725c32d7bb99d3883b8a91e25363d4c195bb9f0ef40fb94d98c060d16d87c
- SSDEEP 192:G0vlZJntd2u6BIg1+O8ovTnGFyDmLij+AUJ4R9/Y87S2sR6nozV7BGaZkRHGOt:ftg/OF29YGSFR6noJ7BGIEHht
- TLSH T13772DA56686055BA8591E368D4F87FC7E2F538CF4C019FCA8BE4BD0869DE0AE112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
- Size 6KB
- SHA256 7bcc1791b6dfa97eb97f707d02f35735d9822bea4be993383fa8d1dbd2049905
- MD5 6da1a6b71428fe8d0138cf339f3cffed
- SHA1 70f1727c3181481ae1aef85db7a2806b17b9895b
- SHA512 67cc01263ce82afe672f1eb0cbcb451f9ee832bdd321dac33c57faeb12951f2fe5438e3200597f336728a875b441d3cc3d9a960dbe0a4635b1a2f31047a7fa49
- SSDEEP 96:xHdUTUZqGqofymp1zSQWSSlcdv9jUJDnUHgYETBw88u8L4cn7yT5GS:P0RofympbWSSFJ2gYeBw888
- TLSH T1D3E10F7850088B7F74B677ACAC648C315AB2413BBBBF68D710B65485054CF3846F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
- Size 6KB
- SHA256 6ee3af23d1d6064d0cc560fc15e5030508630d7b0b808aceeaebd019c642d915
- MD5 e5f4417db0b2fec5ce6013dfe3eefbd1
- SHA1 44203a44730aa1c81086ce014797e0e30cf8bbed
- SHA512 ce987de743139565a367ec295520a4bb00922ca8de63dd81730cb396835b9fe66528b98d64f51c351ab3378f575ecffc49747b72c3eb525fca8f4255c4aca428
- SSDEEP 96:xHdUTUZqGqofyP21zS7SSlcdv9j8nUHgYETBw88u8L4cn7yTM:P0RofyP2CSSEgYeBw887
- TLSH T1BFE11F7854088B7F74B676ACAC648C316AB2017BBBBF68D710B54485054CF3846F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.1MB
- SHA256 d6474b0e2b57732ae9320d918f76f8df841c07a5ccf5b5b38a73972b904f022a
- MD5 c3e50de456f959ee31ce06a8d687dac9
- SHA1 e7e4bd0c04da64254f503fdef9fb29187a4d0d12
- SHA512 10fcc526def8f66862217d4eaf2a5dc5596518738fde5fcce106cb6102e6a4255885be43b1e19a0e27ce45a7f958398fed27f3ebf4a784bd1ed67d69310bd073
- SSDEEP 49152:6McETBx27MCaUYV/isqMkxK+C/1GC1o8z:nceNisHMKt/1GC1o8z
- TLSH T134362AF820D1A257F3814033664593EF21EFD00C6037DA085BA956E9A578CEF9E16B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Fz1.pC2xlR4O.2.5.zip.part
- Size 26.6MB
- SHA256 40e2c9ec764631f56fa4ad17a491fbf6db6844dc79343428ba19dbbd2e264d5c
- MD5 083deec3589c66fb103b739ff3e50cfc
- SHA1 4ff48f8736f57db418608c50ba651fe3ca1629b7
- SHA512 9b395e4b8264226b081cab430801d1955654e3c5084e3da5399190b24215db9bf516f59815711c404bb06416cdd6aa5fa91d7397904d738dde4bd9180e1e9703
- SSDEEP 786432:Kjiy7i1ksb3YnTwWQXhihbQ76aw0Xfo3DDBtFa:jykFb3LWQXU276aw0Xg33c
- TLSH T17D5733A0A13338C28E099472727D95222D6CFFD5CBE3C7AB916F3B1DC93A9944DAC451
- MD5 SHA1 SHA512 SSDEEP TLSH