30a2da931923d8a05fb617fd0f08b3407f431f3a872446a5f19e8f0d9fb66541

Resubmissions

24/10/2026, 02:07

261024-cj6qyshs3l8

24/10/2026, 02:06

261024-cjjw7ae1913

23/10/2026, 21:54

261023-1r7j8agt5k10

Analysis

max time kernel
2s
max time network
4s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
icons/icon.svg
Size 416B
Sample261024-cjjw7ae191
SHA256 30a2da931923d8a05fb617fd0f08b3407f431f3a872446a5f19e8f0d9fb66541
MD5 3a7a322854c0496a4c759630891bd244
SHA1 325882ecd8b0d1efa6a997dd28a96289cf4498eb
SHA512 325d1c09905b617f1b3a250bc2c7cb5ac5bf12516bbf781fd1afa6b1a0efcf50bc454d81538ac8be86393b32573c80b0f9b759b6f2d1c9acd191014b7c0f9478
TLSH
T15AE0E5A446486A3CA2268E29FA68B6E4121F21414B4E1258D5252335E6994DE987FCEC
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 4152	3276	firefox.exe	82
PID 3276 wrote to memory of 4152	3276	firefox.exe	82
PID 4152 wrote to memory of 4808	4152	firefox.exe	83
PID 4152 wrote to memory of 4808	4152	firefox.exe	83
PID 4152 wrote to memory of 4808	4152	firefox.exe	83

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\icons\icon.svg"
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\icons\icon.svg
  2⤵
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {efdd053c-cf89-44e5-9675-6043ed60eea8} -parentPid 4152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {994e08b7-4a63-4112-bb24-385dff7b3395} -parentPid 4152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27323 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {6a316aa8-0476-48b2-b6ca-7478fa8b2213} -parentPid 4152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27323 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {a9ddeacb-6996-4a60-a67f-db28cc4c7bb9} -parentPid 4152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460 -prefsLen 34822 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4476 -initialChannelId {06e54d2b-2f0d-43eb-950f-863e3c93e124} -parentPid 4152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wi9zt29h.default-release\activity-stream.discovery_stream.json
Size 14KB
SHA256 9bcde3e3f96bee302ffc88c0b4b22f5b720d669da1f2c3576e52be19d5a23a0c
MD5 97bb5e04f52b71a173ad793a93becf6c
SHA1 b16d8ab0dc525f8d6b4afc989ba8ac32393427ad
SHA512 43c014d91573145381b8724f35e5f3c8889254ae69f51323a95cf6d3dcee57b512bc93367a8a7de54bec3d5f793309a4860d1ff7c15710991794bb0f646047d4
SSDEEP 192:i/y8ysK1cURPAe1hnMIBn6RNzamnfA9K68/yI0WuszI8IT5oa1bfxf/w8oogESeE:iyazRNvdj6IwR2sbfxQDPKGn
TLSH
T18F62FA9346DC61F71F9077DB2C4FB95B51E24646E3410AC8FC99DD2D81C92A4023BABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\prefs.js
Size 6KB
SHA256 dda08ae9c7a7ac43d5c6a8d5b1150a2b5945b8072139c1584086d710dd1182fa
MD5 c5dca4f45f0621f181c628359bbcdd13
SHA1 64b394b7f8349ddff45f0ba1b8d01b7d4c614517
SHA512 f4696dea554a2987e125f524ee0a88cd4c62b35ecb51f10c10377eda96e44f327972836b877ee62fd62bbdb28293d8594f179287ddb09bf9bc569876a6310808
SSDEEP 96:xHBUTUw3qGqYfWEr1zSDASSlldv9jFnHHwgBw88H8L4cnpVPIu:T5RYfWEr2ASSZwgBw88o3
TLSH
T1E3E1217894088F7F74B677AC6C6888315AB2013BB7BF68D750B95885051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wi9zt29h.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads