Analysis

  • user interaction
    yes
  • max time kernel
    91s
  • max time network
    103s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 12:20

General

  • Target
    FluxusZ Windows 1.2.5_77240987.exe
  • Size 702KB
  • Sample260711-ph7m3sb14x
  • SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FluxusZ Windows 1.2.5_77240987.exe
    "C:\Users\Admin\AppData\Local\Temp\FluxusZ Windows 1.2.5_77240987.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:4828
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4468
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1908 -initialChannelId {9010ec5f-25ad-44fc-bf11-30cce32fe7ed} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:8
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {c27460a6-44ff-4442-be2d-366f518aedf9} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:4652
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27323 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {bf5fd7f9-aa92-4183-9b45-7e8b50e973d3} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
                PID:2708
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27323 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {82112e74-387d-4549-8de0-d2bf1302dfa2} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                3⤵
                  PID:3952
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2600 -prefsLen 34822 -prefMapHandle 1600 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2940 -initialChannelId {53416517-c841-43bc-bb76-6cc2f8c7ea0a} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  3⤵
                    PID:6044
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5288 -prefsLen 35089 -prefMapHandle 5292 -prefMapSize 270279 -ipcHandle 5300 -initialChannelId {4bd7ee5a-ef1b-4733-9091-f85caeb3f2d6} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                    3⤵
                      PID:4688
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 33031 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {0814fdae-4bfd-4c6e-8845-2819a9a2f71c} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                      3⤵
                        PID:1340
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 33031 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {72a23e8e-e089-4f90-a558-8f5ed5a7aaa4} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                        3⤵
                          PID:4704
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 33031 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 5920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {7a155df8-a8c6-425a-b265-fc2b9c8881c1} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                          3⤵
                            PID:2728

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            file.txt

                            • Path C:\Users\Admin\AppData\Local\file.txt
                            • Size 58B
                            • SHA256 1fe92d0bde1b0013fafc4498df9513f8d4d6dc61f019b2f74ea785cca4d9da1b
                            • MD5 SHA1 SHA512 TLSH

                            data.safe.tmp

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                            • Size 7KB
                            • SHA256 ae41a3e334b720e55aebe23841f7300338265655fc453892fb78b8fd1e3876b8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            events

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
                            • Size 1KB
                            • SHA256 f862ae9457ab64d70a159b9620eaae44655e954fa87770110e18bc2d312ae708
                            • MD5 SHA1 SHA512 TLSH

                            2c828f1b-4f91-47f6-918f-55ef5fabbbd9

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\2c828f1b-4f91-47f6-918f-55ef5fabbbd9
                            • Size 235B
                            • SHA256 c86a19e6dea27818cf24afa6d412ab281083f054a3196c2b6f1fd1fe39540ca7
                            • MD5 SHA1 SHA512 TLSH

                            3fbae230-baf1-4a94-9ce2-c672fed514eb

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\3fbae230-baf1-4a94-9ce2-c672fed514eb
                            • Size 886B
                            • SHA256 b742b53b9b0c390f8b683627009c841bd2a47ff72515ca79fb6b933a872bb035
                            • MD5 SHA1 SHA512 TLSH

                            4357b48e-736c-4b7f-a2af-7f410c303433

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\4357b48e-736c-4b7f-a2af-7f410c303433
                            • Size 2KB
                            • SHA256 380fb0007c731b17e3b46945e1f8cb101d7cc5e2beee4ab98eb5d05b1a2ddff1
                            • MD5 SHA1 SHA512 TLSH

                            5fc27cba-e54f-4a68-b9fc-3014b25a754f

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5fc27cba-e54f-4a68-b9fc-3014b25a754f
                            • Size 883B
                            • SHA256 cbad9455c3189ac019d9c7f8f993acddb3c7fb1385077f7f71b152376c0a3efc
                            • MD5 SHA1 SHA512 TLSH

                            6f2af0ef-578e-4632-a277-92611255c98b

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\6f2af0ef-578e-4632-a277-92611255c98b
                            • Size 235B
                            • SHA256 e872741cffcf62113fa29b37960c62b0c014627bb26fd7b0829bb04f1ff81eb5
                            • MD5 SHA1 SHA512 TLSH

                            bea6a23e-fb64-4783-baaa-661c52acd69f

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\bea6a23e-fb64-4783-baaa-661c52acd69f
                            • Size 16KB
                            • SHA256 cd5b94e3978e2ce89c9cfa200ae721bad7daec026a84d7601878a34563a73ca1
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            prefs-1.js

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                            • Size 6KB
                            • SHA256 7bcc1791b6dfa97eb97f707d02f35735d9822bea4be993383fa8d1dbd2049905
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            prefs.js

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                            • Size 6KB
                            • SHA256 6ee3af23d1d6064d0cc560fc15e5030508630d7b0b808aceeaebd019c642d915
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            3870112724rsegmnoittet-es.sqlite

                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                            • Size 5.1MB
                            • SHA256 d6474b0e2b57732ae9320d918f76f8df841c07a5ccf5b5b38a73972b904f022a
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Fz1.pC2xlR4O.2.5.zip.part

                            • Path C:\Users\Admin\Downloads\Fz1.pC2xlR4O.2.5.zip.part
                            • Size 26.6MB
                            • SHA256 40e2c9ec764631f56fa4ad17a491fbf6db6844dc79343428ba19dbbd2e264d5c
                            • MD5 SHA1 SHA512 SSDEEP TLSH