Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/05/2026, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe
- Size 2.3MB
- Sample260508-ed8dpscy7s
- SHA256 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373
- MD5 651328fda1e2d750a26eb8b40eb0f08d
- SHA1 b4e98a8538fcc9a4e1c093e7c25569f71dfb5af4
- SHA512 e218826388ddbd9a4ce333c05351f16a4d30269c202d6f275d7a2ff05a20368c7a99b2dd96eb4037ab5c1bb4e7c92c52179f92ed7f4d97bf3aa369f56a037bfc
- SSDEEP 24576:KHeD1MZwPHRHEzLuzTCuwQxMAN0uL/guYtkPOe+42chYBPe9MHQTR:UW1MZwpHEqPwzANNYufOb42cV
- TLSH T192B59E4393EC41E5E07A9634C95A8226FEF17C190B74A7DF0245FA1E2F336C25A76722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\I: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\J: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\L: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\M: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\W: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\X: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\H: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\N: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\U: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\V: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\A: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\B: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\E: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\G: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\P: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\Z: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\K: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\O: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\Q: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\R: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\S: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe File opened (read-only) \??\T: 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeBackupPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeSecurityPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeLoadDriverPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeShutdownPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeCreatePagefilePrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeShutdownPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeCreatePagefilePrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeDebugPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeImpersonatePrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeSecurityPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeDebugPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeBackupPrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe Token: SeRestorePrivilege 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1900 4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe"C:\Users\Admin\AppData\Local\Temp\4b81b3c4515ab0c2e69354f5c58627207e7624a322d46029f3836404a2923373.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1900
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1