bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

Analysis

user interaction
yes
max time kernel
15s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GeoIP.dat
Size 1.2MB
Sample260826-thephssarg
SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
MD5 8ef41798df108ce9bd41382c9721b1c9
SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
TLSH
T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3552	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\dat_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.dat	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\dat_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\dat_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\dat_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.dat\ = "dat_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\dat_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	OpenWith.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe
1192	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3652	1192	OpenWith.exe	96
PID 3652 wrote to memory of 3276	3652	firefox.exe	98
PID 3652 wrote to memory of 3276	3652	firefox.exe	98

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GeoIP.dat
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\GeoIP.dat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\GeoIP.dat
    3⤵
    - Checks processor information in registry
    PID:3276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {a43279e4-eea3-404f-8953-23828b7445f0} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27135 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {f410b05d-741a-4422-9930-3a50a713bc5d} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 27276 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {bca417cc-a826-4c10-8f03-2ca5c43af60e} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      PID:2412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4072 -prefsLen 27276 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {90e2d7f5-11c9-49cc-9e81-eda042298af9} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3084 -prefsLen 34775 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 4336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {dc0c4131-b7e7-427d-b1cb-4636481b4984} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      PID:2316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4992 -prefsLen 34931 -prefMapHandle 5032 -prefMapSize 270279 -ipcHandle 5040 -initialChannelId {4eaab07c-aa4f-488c-b9a1-e8908f5e60c0} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      PID:5604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1556 -prefsLen 32900 -prefMapHandle 1608 -prefMapSize 270279 -jsInitHandle 1612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1616 -initialChannelId {9dcc46af-6322-4961-acca-bb782711355f} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:5900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {ad510680-e887-44eb-b4d8-8438ba4c5fb7} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:5908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {f67e57a7-45c0-4bfa-898c-d63f495fb225} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fc34096a735ef05b697058f1a27d5904c368ccdb1a6c01adf4cb52b45c777112
MD5 2ce4ea7c4be9fc02c7af42dce4671318
SHA1 a325a4917a322b2188b1b820865257bf69a125e9
SHA512 933db5765b5ad37961c64507abc8feb7865a4ca163f9f46b982edb10684433cc15e06b9074ac926d7e91b023457ee3969b27f2b0b8bd09974a86036a2b8a5df1
SSDEEP 192:HOv5zbowZDLyjl+9Ls1PK1d66JozGzgCl6mc0dz:4bowZDLyjsnd66JozGzgC1jd
TLSH
T1ACE10064EA28867FC408427BCCA61F410F39389ADC4E3F19369D65482D572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 74b04b486b903d8261533f1f711274061db80710a289d405dd5042adfda95da8
MD5 6f17e3a3766b0a1ab6097879a763736f
SHA1 2ce75d52553946b229e559cadf5b71ead4440baa
SHA512 042a7bbe408af33bf43d3312bc15f822e6ce6a90e73fc72fa8a4b31c9cc199a48e3ef8cf8e7501afd8f2e25fdc5aa543abf8036a3642d7fbcbfd43eaeb946d60
TLSH
T17D21375C39B84D6E9DCBF69CB485028EA3A18E42048B1C434D43FE8CCE81AD9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

21d37667-b5f5-4d57-906a-749bfcb6cdb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\21d37667-b5f5-4d57-906a-749bfcb6cdb3
Size 235B
SHA256 0a7c73eba9b9cbd267d27d51829e6d2af4c221d0775fdab254379b9ef38e122a
MD5 b7a2a75a096aa19c1c2ee5f302501e43
SHA1 0dc324521f2a711842319d69e06c0e696991b850
SHA512 14d10e6487eba15da81a96ae437ca711f60f8c435e813e5d63f96cd70250ca860dd5f798141562469b1b285dda45d4b51af9a805e26dd89d98bc9634263813c4
TLSH
T157D097D02898A35C08240F02B0A03CC2308D8C3324B86810D66509F489F99C89192827
MD5 SHA1 SHA512 TLSH

Submit Download

7f84ab3a-a755-43a7-a802-3d8959401e47

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\7f84ab3a-a755-43a7-a802-3d8959401e47
Size 886B
SHA256 f7eb6a40be95f28664e05afab87257a5c86bcabf6bff107759cab5946fe321ce
MD5 62b35bd9159d0ac0e9380c6c9c88650c
SHA1 c745919418b4f86d02ad56bc06fe07b49eace28d
SHA512 3a45c8dd99fe34ad7b8d018dcd2910c78a0072182370b8be72798207c19d8b3e6f32518cafd6b238de69d5ec99f03d7f838374aa831471069f5e4dbd45d8d366
TLSH
T116111041C9787471CC68929BD4A17B4347F4652380C628147E91171409BB61E93AB307
MD5 SHA1 SHA512 TLSH

Submit Download

a06a0c7b-b1d3-4b0e-a5cd-afa909be90e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\a06a0c7b-b1d3-4b0e-a5cd-afa909be90e9
Size 2KB
SHA256 6b25e9697e1bfa9c8ac7c6a52360d62920ea6d8aa8bd7cce88131386077045e1
MD5 c70cdc0aa42f38370f94af48d590e44d
SHA1 bb01e63317dae2c7a1416d96fab794fc028bc3ea
SHA512 aa1d280ea55b9a3f9fc1e5c6ed684f6e9af13612f3d36e6111b1f19c36c63ad3ffae484351a72ea58bf9c9ea9ef4503576f5df9d059e4db54f62d2828ccd4f1b
TLSH
T17A41251C367C4CB68D9AE29DD892378E57B48A5700C128437E52DF088C9679D33AA53B
MD5 SHA1 SHA512 TLSH

Submit Download

c55c5942-f7f1-457c-88c9-e1113f65d25a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\c55c5942-f7f1-457c-88c9-e1113f65d25a
Size 883B
SHA256 11135cee31f975e73b538a76975f4f4b7fa3fa400aee4ca4d1388d670f2f19d4
MD5 72875836412c1fe33fb128e07939cd7b
SHA1 f5760d4e58fb937ccd1bb81e16488391f422d0cd
SHA512 a907cffd00c06989e90e55d88013e1469264fcc0387edbd9a58730b0b062484814afaa46e1178a9653a4bd199cd3466b5c7712cc595bac345ff2a80ac67a9133
TLSH
T127110081EA347872CCA8C20BC8913B424BF8752380C659147EA14A240D7AA1EE3AB21B
MD5 SHA1 SHA512 TLSH

Submit Download

e9eceaf1-4092-452f-8a61-2d5f71c14196

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\e9eceaf1-4092-452f-8a61-2d5f71c14196
Size 16KB
SHA256 8f808983c0c649169a2db4769b98c79e1c4d6edc7ee7e470cd028f6882735d22
MD5 d42a7c068b87f0e78bb68f0c28d1b80e
SHA1 18e841f69544a2088057029068c7dd546afa7745
SHA512 5e73a11a101ee935511aba9f49fa8d2e758b1337988ad2ba1e7cf14ead720a59a8bbe5ea1604afa226c90880c8d4c78fff646dd51babd3ff7eafa21979f5b5c9
SSDEEP 384:292G1w745Rcly8bSSxdRrKWBXY3LRbh3l:+1THuXBXYbRFl
TLSH
T14D72D916246055BA8251E2A998FCBFC3E6F528CF4C419FCADBF47D0869DE09E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eda122a4-c251-43ff-bcea-f40757059ff5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\eda122a4-c251-43ff-bcea-f40757059ff5
Size 235B
SHA256 86b1fda08e19c5fc10c568cb89e3f6de1eaf235108686f0a86ba3eba3d6e12d0
MD5 94b625009b6bdbdc9e35e780d7781715
SHA1 3b8022f4cf5be976dab15b934c7dbbecdaff8bc4
SHA512 61b5fcefe0b726b96b966908eb2646d964000039a325cf9dc943ea31b8deb9e737d7542f1346da26c723344d49b61534a6f1472b6b9f91918544ee6c4df8b652
TLSH
T100D097882498371C08108F0AF0A1A8C630898C336068A82089A0453899BCEC84259D1B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 7461cf01fbe56aaf3a78bec84e7c7ffeffaa06e3cffd989c21d23e458d3925e4
MD5 51bb8efa3c87ca644765d2a9069c4812
SHA1 95c0ff2a845810540edc60deded012d50d170009
SHA512 edbdf0bb4847636134dc9cb10fe9e3d000f08545b063d8ae8d320060b38af8f5fc222e5273da6dec839edbbb276d6af201712f4db7b036e51b615201e89ae102
SSDEEP 96:xH07wUTUzqGqvf8nm1zSjCSSladv9j8n/5H1Bw88n8L4cnDOT:acORvf8nmCCSSl1Bw88L
TLSH
T173E12E7895588B7F64B677ACAC6889706AB2013BB7BF2CC750B654C4005CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7oeP7cbj.dat.part

Path C:\Users\Admin\Downloads\7oeP7cbj.dat.part
Size 1.2MB
SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
MD5 8ef41798df108ce9bd41382c9721b1c9
SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
TLSH
T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads