5cf88d196b5f600e0aa2bf32871446e60f48a80e6dae6629642fec4cb610b11a

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProcessGovernor.exe
Size 1.3MB
Sample260420-v2verac13x
SHA256 5cf88d196b5f600e0aa2bf32871446e60f48a80e6dae6629642fec4cb610b11a
MD5 f1d91efc5a6b48a78fd4e3281e6ec55d
SHA1 abd109657e3ddb1697021189b1e71357973591a9
SHA512 7eae094f9346888ef4af7829b9edc2a00586f1aed9794cfa5222193cfd7740a0ea4c36a2d795d4f9532c0c4b8ff5a61c1d3677f0a16e74b1bf5e9f2ab54605dd
SSDEEP 24576:+08jwatdhVf5Up78pJJldBnt7XxT9x4pWx08:+LkYf5Up7c9Bn9hT74pWt
TLSH
T19C5527D415B905ACE066D87C8A81CC8AE5EB7C0C073D7AFB02B436591F3EBE54A79E11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessGovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessGovernor.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe
1352	ProcessGovernor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1352	ProcessGovernor.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1352	ProcessGovernor.exe
Token: SeDebugPrivilege	1352	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	1352	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	1352	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	1352	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	1352	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	1352	ProcessGovernor.exe
Token: SeBackupPrivilege	1352	ProcessGovernor.exe
Token: SeRestorePrivilege	1352	ProcessGovernor.exe

C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-5-0x0000027E87CE0000-0x0000027E87E7A000-memory.dmp

Download