Analysis
- user interaction
yes - max time kernel
898s - max time network
551s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/08/2026, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
eae.txt
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
900 seconds
General
- Target eae.txt
- Size 6B
- Sample260815-yyd55sshkh
- SHA256 21d715c5efc091457b2eb3af4f09094c06feb768ba5183f3081b93e65bccf65a
- MD5 e623f466340bb1b71638e9b2e5cc4717
- SHA1 7fe04352835e0d0da3a66740c370b15061d93fa8
- SHA512 cdf674763aecaba57f79bd85ae2a07274cbde127588ffa82181e6a8612c524654e2962ab7033df847319ef8d71f98d115baa31b9aebb5d60b359c730226e2b02
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://justbetter.best/
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 29 2132 mshta.exe 30 2132 mshta.exe 31 2132 mshta.exe 37 2132 mshta.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4820 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://go.microsoft.com/fwlink/p/?LinkId=255141" EXCEL.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings cmd.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3464 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2252 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3156 firefox.exe Token: SeDebugPrivilege 3156 firefox.exe Token: SeDebugPrivilege 4304 taskmgr.exe Token: SeSystemProfilePrivilege 4304 taskmgr.exe Token: SeCreateGlobalPrivilege 4304 taskmgr.exe Token: SeAuditPrivilege 2252 EXCEL.EXE Token: 33 4304 taskmgr.exe Token: SeIncBasePriorityPrivilege 4304 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe 4304 taskmgr.exe - Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 3156 firefox.exe 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE 2252 EXCEL.EXE - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3464 4820 cmd.exe 82 PID 3376 wrote to memory of 3156 3376 firefox.exe 84 PID 3376 wrote to memory of 3156 3376 firefox.exe 84 PID 3156 wrote to memory of 2496 3156 firefox.exe 85 PID 3156 wrote to memory of 2496 3156 firefox.exe 85 PID 3156 wrote to memory of 2496 3156 firefox.exe 85 PID 3156 wrote to memory of 3588 3156 firefox.exe 86 PID 3156 wrote to memory of 3588 3156 firefox.exe 86 PID 3156 wrote to memory of 3588 3156 firefox.exe 86 PID 3156 wrote to memory of 3588 3156 firefox.exe 86 PID 3156 wrote to memory of 1708 3156 firefox.exe 87 PID 3156 wrote to memory of 1708 3156 firefox.exe 87 PID 3156 wrote to memory of 1708 3156 firefox.exe 87 PID 3156 wrote to memory of 1708 3156 firefox.exe 87 PID 3156 wrote to memory of 1872 3156 firefox.exe 88 PID 3156 wrote to memory of 1872 3156 firefox.exe 88 PID 3156 wrote to memory of 1872 3156 firefox.exe 88 PID 3156 wrote to memory of 1268 3156 firefox.exe 89 PID 3156 wrote to memory of 1268 3156 firefox.exe 89 PID 3156 wrote to memory of 1268 3156 firefox.exe 89 PID 3156 wrote to memory of 1268 3156 firefox.exe 89 PID 3156 wrote to memory of 3168 3156 firefox.exe 90 PID 3156 wrote to memory of 3168 3156 firefox.exe 90 PID 3156 wrote to memory of 3168 3156 firefox.exe 90 PID 3156 wrote to memory of 3168 3156 firefox.exe 90 PID 3156 wrote to memory of 1780 3156 firefox.exe 91 PID 3156 wrote to memory of 1780 3156 firefox.exe 91 PID 3156 wrote to memory of 1780 3156 firefox.exe 91 PID 3156 wrote to memory of 1780 3156 firefox.exe 91 PID 3156 wrote to memory of 4872 3156 firefox.exe 92 PID 3156 wrote to memory of 4872 3156 firefox.exe 92 PID 3156 wrote to memory of 4872 3156 firefox.exe 92 PID 3156 wrote to memory of 4872 3156 firefox.exe 92 PID 3156 wrote to memory of 2396 3156 firefox.exe 93 PID 3156 wrote to memory of 2396 3156 firefox.exe 93 PID 3156 wrote to memory of 2396 3156 firefox.exe 93 PID 3156 wrote to memory of 2396 3156 firefox.exe 93 PID 3156 wrote to memory of 1916 3156 firefox.exe 94 PID 3156 wrote to memory of 1916 3156 firefox.exe 94 PID 3156 wrote to memory of 1916 3156 firefox.exe 94 PID 3156 wrote to memory of 1916 3156 firefox.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\eae.txt1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\eae.txt2⤵
- Opens file in notepad (likely ransom note)
PID:3464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {d13f422d-2385-41a4-a627-346390f138f9} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:2496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {eb4f0b49-dce6-4f4c-826f-50f6821d9351} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:3588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27274 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {180fea3a-04de-42ad-8eb3-9f0a05ff499b} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:1708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27274 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 3976 -initialChannelId {84772040-0712-4214-8a3f-b4ec01d19b90} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4516 -prefsLen 34773 -prefMapHandle 4520 -prefMapSize 270279 -jsInitHandle 4524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {ec62b566-b0e6-42e5-bcc5-c1cbf3045e91} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:1268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34822 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {538b9723-d000-46cf-933c-1b0a710a8f82} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:3168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3056 -prefsLen 32952 -prefMapHandle 3060 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3244 -initialChannelId {face92f1-8d3f-4218-b707-586c1be9adab} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:1780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4380 -prefsLen 32952 -prefMapHandle 3212 -prefMapSize 270279 -jsInitHandle 3264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4468 -initialChannelId {80707e55-fd7c-4aaf-b527-24a3f0859311} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:4872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {66badf4e-ba65-40b9-aee7-62d0892d372e} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:2396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6188 -prefsLen 33031 -prefMapHandle 6192 -prefMapSize 270279 -jsInitHandle 6196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6204 -initialChannelId {71c96786-2796-401d-bc93-e8dae5289636} -parentPid 3156 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3156" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:1916
-
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" "https://justbetter.best/"1⤵
- Badlisted process makes network request
PID:2132
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4304
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62413C4DFC2265D6CD933169FA83CB7C
- Size 456B
- SHA256 ee9b852cf87a1a92c6a9dd3d6cf227c20533a0bd6c0d2ab4bb7fb055b1504503
- MD5 035f8665dc8d84cad1c65433370c2bae
- SHA1 a561071407878c90e99172e973a815f01aca2277
- SHA512 62fb5c3b77dfae40fc3a0f9725600ed4ec6f4870fcf7b31d926bd012a48ac238fa902f9b6c13833a5707b55c9ae326bd8b7b0dbc55e17bdfab29ea38816c0b8f
- TLSH T1BDF097A9452F6E8601E1BA52E894D02229F880818A9FF4660620E61011C2B0E99F3188
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 528B
- SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
- MD5 047f3e9d21d6b325d592b1959e4362e6
- SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
- SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
- TLSH T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62413C4DFC2265D6CD933169FA83CB7C
- Size 192B
- SHA256 698c0c8cc9f7c68e6633805815efa835f6c6552a88a8ef18f8eff79fbaca1743
- MD5 9cfcffa109d3371ebcf48b47867b36d6
- SHA1 40b957a472492260d6abb8232bac36fe7327fe0e
- SHA512 20625a73b69d6db7877f7c5733810d454d49ebfcbc65d42a213996075a331f75d11e312feb1429462e53e0e1471a7f2d80fd8baff56400b70a665ee88e83a4ff
- TLSH T1A7C08C2032F62226E28A023E689026090FFCAB08D10947840B76012E98196511CB0E0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 68fa05aa21b50b560ac0b940a52195c88c973be257fed44c66c1503afd428636
- MD5 af01b8cd8d35aa1d558839d36f0d6b3a
- SHA1 75e066b2714ccc611d9ebf5f13b85be4c77c6964
- SHA512 07b699e4019baf84db943beaa14774349130af788bba1e9765677dcdb421d99b309a078c0939dfff663a1a47fd8ef720b36fffe290434b044e1ecb7dfd32bfc1
- TLSH T1BEC09B14B3654715F10D513D7DD5161417B58245F6C6C3544B745535861C7400871D05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4RT69VDH\DLQ50I3H.htm
- Size 1KB
- SHA256 bdcad6d4f7ac4a4acf5cbfc82f1633c5047acbabed8d662b2f3c66836144813a
- MD5 acd1b5662580747ef536e3c96a88ac9a
- SHA1 7606bcd67da3b4320040605ce45ecb0f45485dcf
- SHA512 09e215fcf579c4aa92e9cff1160c6bc1d4d3fe75b49ff16daa8c680683042ad44dd9be581a3d00e11fdd647de37b5fd5b54b628777fa59f615ecf04d7fe4db2d
- TLSH T1C83171916C2998758273237914FFD18CFAB3521B3A48E3A038CCB5472F31A201B86DF9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\thumbnails\6c21d1d4ddbd537eb8dc63fd29af2844.png
- Size 1KB
- SHA256 5fa0608bb3291da5006676cc5880c90c3d591c29e0f96ffad8a35cc961522560
- MD5 a4e3dec615867334fc01bb2b71796edb
- SHA1 6ca3970f02d7ab704f5b82849c2f9163a9bdb9e1
- SHA512 ff4192657fc611ae0938c3962a541eac877a66d372924a8df62aa8e99f6be4431c6b706df232aff96269746a448fa8a23e7d1c8a9d809d74782baa78a0af62e7
- TLSH T11F21C68EE2D329ED6A24CB77161F12C1F38971CDE493655E550C99C3CC1C87104266A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 5baa9a2979cb7a2793d75a3b5d2b88484361a7ec4e279fdbae485d284969d3be
- MD5 7fc7978a7524909081b3a13d919b83c2
- SHA1 b25f1643bd8fea4d6413a22d09ac3e2fcf3a126b
- SHA512 7b366fc0fbee9b4e1229eae873e3b58483e2113c4fc0c7bdcf294db97a109f7eadba9b0e847511b5cd255239b5fde3de7a3aca632962fd89b89b47826ea11bcd
- SSDEEP 192:A1d66Joz0dzgCl6mc0dCOv5zboHcLayjSMN:6d66JozQzgC1jLbo8Layjl
- TLSH T12AF11FA8EA29863FC408027BCCA61B400F35389B984E3F1971DD65492D5B3DD7B8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 a6dc9f96b24edac0f62bc9a14e2f80d7ba6871d08d5c7627bd0d7961ee23eee8
- MD5 7b0d59e008f889e4b77caa68c94fbc4b
- SHA1 8c3b65e7261eeb1cbdc23ff2b89a59e1d2120639
- SHA512 e303f1e75842c91528ce532af9da005d9c06a1aef4e17250e1566fc066178e20d3bcf599bceefc539fa3bbe366a6f8facde727d347e7e2118beee01e603244b6
- SSDEEP 192:C1d66Joz0dzgCl6mc0dhOv5zboQZLayjw:Md66JozQzgC1jUboQZLayj
- TLSH T140D1DC68E629963BC418023BCCB60B500F76389B984E3F1971DC744A2D972DD7B8D27E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 bcf4f6117867505292fa83d37dbfc3f7c3467eb2a0072edd4b2b554741fc57cd
- MD5 73ef3dc70b0e26b070c49d3eecdbee88
- SHA1 8fb8feaad2f234967b8d472a65e8f65c7e92f354
- SHA512 781b09913fb8f0bc5b575c8e58ab11019087535d058960ee677b5c25ea15af75a78cd56145006c373d1277649fdd60f4833d76728739686e81554bfb49e2f863
- TLSH T1B7216DAC3EB94D7AB9C7E69CB490028E57254A4A04C71C834E22EFCDCE85ED9316943D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\534a64b9-4bbf-4a59-b285-f4ab1a0e7b2d
- Size 886B
- SHA256 c8f7cbe4997a8c094a63a28f478171cf1d71a02e2d6f54852a3f4e1ebf930897
- MD5 00550b044f255310b11b2b71bff3d25b
- SHA1 f444182884c160d1b757e7e5e3751c15b44f2e15
- SHA512 c023106ee8095c5d488f1d244864de3d6c65f14dc5320d3b22ba19b41dc7e593cc813e041695597ca982522b56d266aab5f1601e51ef43421c13b9923fbe39a6
- TLSH T1E2114484CA20B8F3CC68D25F84E1BB414BF07423C0C60A147D955F040DBA51EB37931B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\55eece4d-84cb-486c-a2d8-dbaccbd1e44a
- Size 2KB
- SHA256 5936ae3990846ef6a9b34c31f5c3167de265f64a05978fb5b0a207167da92002
- MD5 e7b53d93ac7e54ff93f7d28740f2b0c0
- SHA1 08bdfb9052ea8956822c1ad4b0ca8170358cba12
- SHA512 0ad92ec8003b5105f7e16bd8c948f95c03603c41d28c887b20927e4eb0ec8589eafa7e4ccb4a4eaec9672188330b093db121dd3815dd3132582f9c8cc5dc0d85
- TLSH T1E75199699160D8BEC87DA31EDD2537828BF3140B408F194E9EDCAE0B157FD5EA368605
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\a73d7f16-c4fc-4741-aee6-d386a1e4fd0b
- Size 2KB
- SHA256 514d2ee93ed9de2fe2b4891b1058f6126fe151d10d8f9294d39b61396aa025a5
- MD5 8da0da688578b4532de3e9b3cd1667f5
- SHA1 a62dd91ffa71177969e41034a026256923f1f488
- SHA512 35d60b34892c0ceee356fa37026b91af2e366aa6a65e78c2cb377bd1c24d88522a94d2a84867beb1bbf7f91892d9c7de9f33b9da994e282355d672eb69a181cc
- TLSH T16A41155C35749CF75CAAF29DE591234D5764890300C62C432E66DF0D8C9669D337A53F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\a8a5b067-ec50-4569-a202-bdc61d7a637f
- Size 235B
- SHA256 419826e714a4ffb8a37109704b4aa49382bb55833b4f6e79ed1150102a9725bf
- MD5 d3c4d3a418782777da1556b69c08b813
- SHA1 80665a8343a57052c86bfc9be7b17dc04ffc48a7
- SHA512 22a67f41f62b1ef4601db4c519cf05c24899c1f5703323c173f997edf81618ea90ad0a9bc8769405689bb2b7df6d2f58f590e4fa49d87e7751dc6b4fdbeacef3
- TLSH T123D0A5855854675D48144F07F0F059D530544C3754E86850D56145F859F9DC54171957
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\ad844c97-87c9-4236-87d3-aa0cebd5e42b
- Size 883B
- SHA256 85912a5f7ea356fe8b76a292d3b5f40e576ca710c113cc928237a44504341e6e
- MD5 dd8ea4d5dba72ff5919d40505af18d1f
- SHA1 a15e2bda17c8d5e8c59fedf9908c51da7f395997
- SHA512 d4350a854f1d568be114c85270255bf60aef90108006a58463f6df3c2de8aae034ed028653a83c2128cc4416c66b5b995139b84df6973e2c188e62a57af2e5c7
- TLSH T1B31100C1E630B4F3CC68924F89A577414BF8B52780C655143DA55E050D7E52EB3BA70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\d5c3ccfc-4071-4d31-985d-21f4c8446a30
- Size 235B
- SHA256 170542d7b408a1302ce9891e92e1aa3eb2c2dfd6a1a379a575d9fc296eaa9299
- MD5 7d15610567650be095fa698d3d39619c
- SHA1 69e31991d63463dd39b194fbb72bdd12799966cf
- SHA512 8a15ad099fcea8043e6ed2bfe43597dc28d7a166b0f964bae1197f15c3e17e05a36b927eec24dcc11559c8ab9dd1d5acb84d8dacd9a836428936e55a0133f7bd
- TLSH T101D095C43454677C4C100F16B0F1D5C631444C3314B06410D6B245759DBC9D44161827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\fc7b4541-f154-441e-ad1f-1e53310e020d
- Size 1KB
- SHA256 1d63072f9b5388fe2e4fca6ee3d2e510654a8358e0113e4f601f219c0b334050
- MD5 152d67bcb086bd7351f827bfff76eb1b
- SHA1 a63c2275cfe436bb8823076650c49d39cdbc8c90
- SHA512 a21567653edfa1943072d1f6412dfc340b170e94d45380c9e9479393f467b2e6bf72d4ef2a5db2ac2d9f5f345b46272a4d98beec449cb5dbe4d6cc8981a3343e
- TLSH T1874129DC485258532C25E89CB2537B2B415228328A5C07CA6FFC4D2A35FB1A7C6677CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
- Size 6KB
- SHA256 45bccc1f9b69ee79998c32b7908594bc38768c6c82a4a3445640f30208530ad3
- MD5 e769aed6c80c9a4c6239f6928bc11523
- SHA1 507a3bcb6fdc359ab4c36200ea08fd1000a3bb6c
- SHA512 693e8cd7b46572470a07291f5b8b4ea249ce6394a02b9a626eefc481e522e39ed502d9406aebbfb10f9b66d3c907bbfdf69239401e1ccdbcd7b2b8a55a4ce7f9
- SSDEEP 96:xHcUTU1qGqQfA2GM/31zS7svZSSlZdv9jbnJH9zzBw88H8L4cnc1qGDGS:C4RQfA2T/3tRSSB9zzBw88d
- TLSH T1F9E11D7895088B7F74B676ACAC6888316AB2013BB7BF68D350B554C5051CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
- Size 7KB
- SHA256 8323072faaa781dd09ca0f5e5c23d15fa47010e93749f2b2796fdaf46ff3b219
- MD5 e00825453192a126f6ba7d7113d32fca
- SHA1 cd6df8b486a446d957b9407ce00a4b1f2c7bf346
- SHA512 a9a030f9eeff763d1117b6b7b05c0556b83b7f83e56e1a9c8d72b535fabed04a9f67134723fa4e695568d9400c67dca015c73ea902effa8098e6238d6820f437
- SSDEEP 96:xHcNTU1qGqQfA2GM/3ObzS7svZSSlZdv9jbnJH9zzBw88J8L4cnc1q8rDGS:CJRQfA2T/3iRSSB9zzBw885
- TLSH T1E0F10E785508CF7F74B676ACAC6888315AB2013BB6BF68D710B594C5051CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
- Size 6KB
- SHA256 bda350f57cf3f71bd7f16f903e875e46d23a8fd879d133d4c14ca945a8aa0c32
- MD5 c2b7784c0c58da40d21c74134ff40ef6
- SHA1 d5c5d99a91e258c7e17abd36ef38fd8752f234c3
- SHA512 0bafad48e3679737de6d1a0a62c2ff1262155414a8c0582a2ea5d03019182897177a55832294963d247f081fbbfe3668ef6603846e462c77ef62605f4e80b112
- SSDEEP 96:xHcUTU1qGqQfA151zSrSSlZdv9jynJH9zzBw88H8L4cnc1qGq:C4RQfA15KSSI9zzBw88e
- TLSH T1C9E12F789408CF6F74B6776CAC6488316AB2013BB7BF68D710B55489054CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.2MB
- SHA256 51bd703f992b34fa6281a59972801afddfbf8e1e3becb3cadfa3bf727c5e7a47
- MD5 c8cf02422c538087a229d28de4c50d22
- SHA1 a4841786da29a6c70a4f38398c27119591c0d234
- SHA512 7ac871067af8d90ebb22fc39cf5c6c85f029d7b22e2004eda1dd2415cdc3a39db371cc0abcf211919aafbeaadf3380119269c1457aea0af9d82ff8814aa7521e
- SSDEEP 49152:HIbfpQBfzagT0lbDoYsV1gSiHbZMIlFj+tcAE6G:obfpQBfzag/1TiHbZV/jWNRG
- TLSH T14E1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
- MD5 SHA1 SHA512 SSDEEP TLSH