b2020c969fb90ba978584f81b75969891b4e8d83783c74bd02a18f6351cdd516

Analysis

max time kernel
300s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windscribe_2.22.10_amd64.exe
Size 39.8MB
Sample260621-pkr1eaes21
SHA256 b2020c969fb90ba978584f81b75969891b4e8d83783c74bd02a18f6351cdd516
MD5 a108b5d0a2b1cbd0271ae0005c51ead5
SHA1 fe42dfa0bd4073fe8d77b9effd1fe55735ea9454
SHA512 b27d5f610d20d53c8d46492ab06f4a2ecfea48793ac6dc44a4e5ab261ed010a84c0b634132e09e3ff259f2840504d3f4e77449fa5e0ceac92b8afaa3985599e2
SSDEEP 786432:wwetpyKLxWIdWuBLCqiBrmBKiAfV/Ta/Br23y6mLwv1SalNeku:wwetpnkmPiBsKiAfwpr2QL8XlN+
TLSH
T128973356F1688275D073C075C6A29755EEB3388A173086CB139687B93F23BE58E7A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
808	7zr.exe
2920	Windscribe_2.22.10_amd64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2920	Windscribe_2.22.10_amd64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	Windscribe_2.22.10_amd64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	808	7zr.exe
Token: 35	808	7zr.exe
Token: SeSecurityPrivilege	808	7zr.exe
Token: SeSecurityPrivilege	808	7zr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 808	4688	Windscribe_2.22.10_amd64.exe	88
PID 4688 wrote to memory of 2920	4688	Windscribe_2.22.10_amd64.exe	90

C:\Users\Admin\AppData\Local\Temp\Windscribe_2.22.10_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\Windscribe_2.22.10_amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\Temp\WindscribeInstaller7798\7zr.exe
  "C:\Windows\Temp\WindscribeInstaller7798\7zr.exe" x -y -bb3 -bd -o"C:\Windows\Temp\WindscribeInstaller7798" "C:\Windows\Temp\WindscribeInstaller7798\windscribeinstaller.7z"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:808
- C:\Windows\Temp\WindscribeInstaller7798\Windscribe_2.22.10_amd64.exe
  "C:\Windows\Temp\WindscribeInstaller7798\Windscribe_2.22.10_amd64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zr.exe

Path C:\Windows\Temp\WindscribeInstaller7798\7zr.exe
Size 921KB
SHA256 f998608126c11ee1ce7d219777042799dbc5f22bf93031d4374b293ac5027022
MD5 24d3197d0d8ffe822c62d970439d3c26
SHA1 124e385abc31d54fac42303f6d0d520a3d96cf0b
SHA512 acf8f18f075056e9dd53f8376abff2a99b89a664f57934e4a3df77f0fcfce30bd7043441823127cf41d4db3a0ab32b39148113ceefd8a01935f1cc8c975bd460
SSDEEP 12288:LZcsd0c7n+9FONoc0r6PxspOJsKe9Yhkst6UUElE/TzhWY2yhleWLr:vdtniYec86kExtPUEe/TzIyr
TLSH
T1AF152B66F6788271D073C0B9C5D29A9AEE723085173086C71286D77C3F57BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribeinstaller.7z

Path C:\Windows\Temp\WindscribeInstaller7798\windscribeinstaller.7z
Size 38.2MB
SHA256 b798df16c20b0eb37768f30875a248562b0bacf3530a8f56c0bb36b03bc1b2fd
MD5 2c142bc261ded3f18449ee50252f6474
SHA1 54be92d6f48ce68f1aa1d2f54485409b44809cf3
SHA512 9f43bbcaea6e304f0eace27f2bd3ca8aa0506ab78e8ad81b3aacc79747292f84d689f02b0a2b7bd1255795a4d30c43419f9634d54018cb8b27d8b8d442618dd2
SSDEEP 786432:8wetpyKLxWIdWuBLCqiBrmBKiAfV/Ta/Br23y6mLwv1SalNekP:8wetpnkmPiBsKiAfwpr2QL8XlNf
TLSH
T1C697334F74A7925C76BD9282D32A07209D633DAEF309436431EA56EC8AB7F0552F7630
MD5 SHA1 SHA512 SSDEEP TLSH