760f3242ffc9539dc12bd2c28b03f2ffcc43ccf8829aeaa3daeacd36a3950cf9

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malware.exe
Size 4.3MB
Sample260415-lr74esbs2r
SHA256 760f3242ffc9539dc12bd2c28b03f2ffcc43ccf8829aeaa3daeacd36a3950cf9
MD5 28901a0151d6ff9066d0f3ce38f0adf9
SHA1 a6a73679c67c897f2f52c181bf8125beed1fc480
SHA512 5d9b9c71b84cdfc01dabe8bbb27c92f251a4ffde1408d161b120e11e995eee1b0b4a1ea85273d14684abacdbe8665a0c5eaac7c54c3470e12f766e324e13431e
SSDEEP 49152:g5CdFXiOinzxL5LY2ROMlFMQ4vh7Yl/+Jsv6tWKFdu9CqPTvG7KEpHFhh6DhqacH:g5CvyRU5JJsv6tWKFdu9CqifMa
TLSH
T18E266B9EBA7E5395D4BBC1B0A7B38196E1307C419B7066CB2384536C2A335F09DE72D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 2268	1964	svchost.exe	80

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3452	malware.exe
3452	malware.exe
3452	malware.exe
3452	malware.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
2268	dwm.exe
2268	dwm.exe
2268	dwm.exe
2268	dwm.exe
1964	svchost.exe
1964	svchost.exe
2268	dwm.exe
2268	dwm.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe
1964	svchost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	malware.exe
Token: SeDebugPrivilege	3452	malware.exe
Token: SeDebugPrivilege	1964	svchost.exe
Token: SeDebugPrivilege	1964	svchost.exe
Token: SeDebugPrivilege	1964	svchost.exe
Token: SeDebugPrivilege	1964	svchost.exe
Token: SeDebugPrivilege	1964	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1120	3452	malware.exe	17
PID 1964 wrote to memory of 2268	1964	svchost.exe	80
PID 1964 wrote to memory of 2268	1964	svchost.exe	80
PID 1964 wrote to memory of 2268	1964	svchost.exe	80

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1120
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\system32\dwm.exe
    C:\Windows\system32\dwm.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268

C:\Users\Admin\AppData\Local\Temp\malware.exe
"C:\Users\Admin\AppData\Local\Temp\malware.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-1-0x0000027BD00D0000-0x0000027BD00D1000-memory.dmp

Download

memory/1964-24-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/1964-43-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/1964-6-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/1964-8-0x00007FFBF0804000-0x00007FFBF0805000-memory.dmp

Download

memory/1964-10-0x0000018EB11F0000-0x0000018EB11F1000-memory.dmp

Download

memory/1964-11-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/1964-2-0x0000000180000000-0x0000000180050000-memory.dmp

Download

memory/1964-16-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/1964-13-0x0000018EB5400000-0x0000018EB58F0000-memory.dmp

Download

memory/2268-31-0x0000000180000000-0x00000001804F0000-memory.dmp

Download

memory/2268-35-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/2268-38-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/2268-26-0x000002A919FD0000-0x000002A919FD1000-memory.dmp

Download

memory/2268-44-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download

memory/3452-0-0x00007FFBF0760000-0x00007FFBF0969000-memory.dmp

Download