3b7ea4318c3c1508701102cf966f650e04f28d29938f85d74ec0ec2528657b6e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Procmon.exe
Size 3.9MB
Sample260424-kyaaases7p
SHA256 3b7ea4318c3c1508701102cf966f650e04f28d29938f85d74ec0ec2528657b6e
MD5 c3e77b6959cc68baee9825c84dc41d9c
SHA1 bc18a67ad4057dd36f896a4d411b8fc5b06e5b2f
SHA512 f825521149f4e771c9f51abaa4fa956258a5393754ec7422692dc0c24c120ed9f103dd3953b47b7bb331dd4095b3e97b95fb35c4dfe03ce39574ba4b39b76d7d
SSDEEP 49152:C9TJDVmHMAlNXFJelNOBLVKcu6NvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCd:O4sA5JelIBs9JlmzSzko2zjCf9fP
TLSH
T1FB167E1333D440E5E26952308ABBC67AD6767C79077245DB26E84E4F3F32AD52A38732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe

Executes dropped EXE 1 IoCs

pid	Process
4664	Procmon64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\.PML	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\shell	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Procmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\shell\open	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Procmon.exe\",0"	Procmon64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4664	Procmon64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4664	Procmon64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	Procmon64.exe
Token: SeLoadDriverPrivilege	4664	Procmon64.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4664	Procmon64.exe
4664	Procmon64.exe
4664	Procmon64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4664	2428	Procmon.exe	79

C:\Users\Admin\AppData\Local\Temp\Procmon.exe
"C:\Users\Admin\AppData\Local\Temp\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\AppData\Local\Temp\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Procmon64.exe

Path C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
Size 2.0MB
SHA256 3e15995894f38b2eead95f7ff714585471f34f3af3d8f50a7f83344781502468
MD5 223b222ce387a7f446d49a1ee9b572bb
SHA1 8ed888a02861142e5eb576385568c2ba0ddd8589
SHA512 037b4787af5fb129a3b1e0ac9565e59d5a55ef26ccf93bc9adf685c08422071ee0d0eb4667cd2ce0d725c7dea0209c1d7d48baf58cd18dfb58de35bf7feef1a2
SSDEEP 49152:LNvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCw6IxKX:ElmzSzko2zjCf9
TLSH
T185A56D5723E800D8E16E927489B7CA3AE6B27C55037286EF16E84D4F3F33AD51939721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2428-59-0x0000000000C30000-0x0000000000C7A000-memory.dmp

Download

memory/4664-61-0x000002227A050000-0x000002227A0FF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads