b36d07468f290e3f90c192f1083e99ec3077f752bcc57b3f99aad2f99f413145

Analysis

user interaction
yes
max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CBSerialChecker LEAKED BY @ntpx.exe
Size 183KB
Sample260622-wpbmjsey2n
SHA256 b36d07468f290e3f90c192f1083e99ec3077f752bcc57b3f99aad2f99f413145
MD5 89defc220861e169fe4e4e257d076083
SHA1 87bb1d7729a15891ab55a21fd758b487b4dee752
SHA512 379a3315a484b336a9aa1cba4da97c7a5a62a048f1ecbcca7793b3bf1b5fcb95d2e8e1fa5545f0ddab3abd56dda098b2e0a2564b39e891ecdfc6fe8c66c52379
SSDEEP 3072:mL2CqyEL3hNoj1sHCQBl0KDSGp89k1odmWvD4pLxt:cqyEL3hNoj2CQQCpIk1osFx
TLSH
T1C304AF55B3E410F9E1778238C9915A02F7B6F4260320AB9F03F447765F236A1AD3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1200	WMIC.exe
1200	WMIC.exe
1200	WMIC.exe
1200	WMIC.exe
5504	WMIC.exe
5504	WMIC.exe
5504	WMIC.exe
5504	WMIC.exe
3828	WMIC.exe
3828	WMIC.exe
3828	WMIC.exe
3828	WMIC.exe
5724	WMIC.exe
5724	WMIC.exe
5724	WMIC.exe
5724	WMIC.exe
3124	WMIC.exe
3124	WMIC.exe
3124	WMIC.exe
3124	WMIC.exe
2540	powershell.exe
2540	powershell.exe
3564	powershell.exe
3564	powershell.exe
2772	powershell.exe
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: 36	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: 36	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5504	WMIC.exe
Token: SeSecurityPrivilege	5504	WMIC.exe
Token: SeTakeOwnershipPrivilege	5504	WMIC.exe
Token: SeLoadDriverPrivilege	5504	WMIC.exe
Token: SeSystemProfilePrivilege	5504	WMIC.exe
Token: SeSystemtimePrivilege	5504	WMIC.exe
Token: SeProfSingleProcessPrivilege	5504	WMIC.exe
Token: SeIncBasePriorityPrivilege	5504	WMIC.exe
Token: SeCreatePagefilePrivilege	5504	WMIC.exe
Token: SeBackupPrivilege	5504	WMIC.exe
Token: SeRestorePrivilege	5504	WMIC.exe
Token: SeShutdownPrivilege	5504	WMIC.exe
Token: SeDebugPrivilege	5504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5504	WMIC.exe
Token: SeRemoteShutdownPrivilege	5504	WMIC.exe
Token: SeUndockPrivilege	5504	WMIC.exe
Token: SeManageVolumePrivilege	5504	WMIC.exe
Token: 33	5504	WMIC.exe
Token: 34	5504	WMIC.exe
Token: 35	5504	WMIC.exe
Token: 36	5504	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5504	WMIC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 804	2364	CBSerialChecker LEAKED BY @ntpx.exe	89
PID 2364 wrote to memory of 2784	2364	CBSerialChecker LEAKED BY @ntpx.exe	90
PID 2784 wrote to memory of 1200	2784	cmd.exe	91
PID 2364 wrote to memory of 1632	2364	CBSerialChecker LEAKED BY @ntpx.exe	93
PID 2364 wrote to memory of 6140	2364	CBSerialChecker LEAKED BY @ntpx.exe	94
PID 2364 wrote to memory of 4688	2364	CBSerialChecker LEAKED BY @ntpx.exe	95
PID 2364 wrote to memory of 5852	2364	CBSerialChecker LEAKED BY @ntpx.exe	96
PID 5852 wrote to memory of 5504	5852	cmd.exe	97
PID 2364 wrote to memory of 4132	2364	CBSerialChecker LEAKED BY @ntpx.exe	98
PID 4132 wrote to memory of 3828	4132	cmd.exe	99
PID 2364 wrote to memory of 5144	2364	CBSerialChecker LEAKED BY @ntpx.exe	100
PID 5144 wrote to memory of 5724	5144	cmd.exe	101
PID 2364 wrote to memory of 5512	2364	CBSerialChecker LEAKED BY @ntpx.exe	102
PID 5512 wrote to memory of 3124	5512	cmd.exe	103
PID 2364 wrote to memory of 4052	2364	CBSerialChecker LEAKED BY @ntpx.exe	104
PID 4052 wrote to memory of 2540	4052	cmd.exe	105
PID 2364 wrote to memory of 5908	2364	CBSerialChecker LEAKED BY @ntpx.exe	108
PID 5908 wrote to memory of 3564	5908	cmd.exe	109
PID 2364 wrote to memory of 4844	2364	CBSerialChecker LEAKED BY @ntpx.exe	110
PID 4844 wrote to memory of 2772	4844	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\CBSerialChecker LEAKED BY @ntpx.exe
"C:\Users\Admin\AppData\Local\Temp\CBSerialChecker LEAKED BY @ntpx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get model, serialnumber, size
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get model, serialnumber, size
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol C:
  2⤵
  PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol E:
  2⤵
  PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol F:
  2⤵
  PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_computersystemproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid, identifyingnumber
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid, identifyingnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Get-NetAdapter | Select-Object InterfaceDescription, Status, MacAddress"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-NetAdapter | Select-Object InterfaceDescription, Status, MacAddress"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Get-Tpm | Select-Object ManufacturerIdTxt, TpmPresent, TpmReady, TpmActivated, OwnerAuth"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-Tpm | Select-Object ManufacturerIdTxt, TpmPresent, TpmReady, TpmActivated, OwnerAuth"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Confirm-SecureBootUEFI"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1f96efcec9fa31e3ace21796d899d94c4b3469eadedcc5017decdcc6aa34196c
MD5 35378e6d3b3ba0d7cbec4aed89f4b716
SHA1 77e6f54d19640651dfb4a079b2ed8afbb7563270
SHA512 0a91d12b5fe1faa75e1ed613b5eab275e4ac3cb9017cea08c4f8d4f9c432442bec7883459da2c2095b7c6f1b143bc7063b61797f93ff81d60a57045244a51241
TLSH
T12B216833B3DD8624CC9A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7bd185f88ac9e07467d494477bc8c24d61cdaf4958f1252a3753b3990828b2e4
MD5 c2e9bd31c78add34d521df97ca7b1aa9
SHA1 84b9797033b2c029b09d0593c0dafcad23b85ed3
SHA512 6ff5b5aaba112700078bfd07b36b03e89405595eb3ce33849146637327c6b8c544dfd47c732be883e78dea10e4efa2ad56ecc74fb57ad14e03251471895d52c5
TLSH
T192218737B3DC8625C89A413A10CEAC1036B787DB809ECEAB6B80D654B42F299DE60190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eqidzwdh.i53.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqidzwdh.i53.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2540-5-0x000002E5702C0000-0x000002E5703C4000-memory.dmp

Download

memory/2540-8-0x000002E56FFF0000-0x000002E57000E000-memory.dmp

Download

memory/2540-9-0x000002E5700D0000-0x000002E570182000-memory.dmp

Download

memory/2540-10-0x000002E557B90000-0x000002E557B9A000-memory.dmp

Download

memory/2540-11-0x000002E570200000-0x000002E57024A000-memory.dmp

Download

memory/2540-12-0x000002E5701B0000-0x000002E5701CE000-memory.dmp

Download

memory/2540-1-0x000002E557AD0000-0x000002E557AF2000-memory.dmp

Download

memory/2540-4-0x000002E557990000-0x000002E5579A0000-memory.dmp

Download

memory/2540-0-0x000002E570040000-0x000002E5700C6000-memory.dmp

Download

memory/2772-27-0x0000017E6DE90000-0x0000017E6DE98000-memory.dmp

Download

memory/3564-19-0x000002EF519B0000-0x000002EF519BA000-memory.dmp

Download

memory/3564-20-0x000002EF518B0000-0x000002EF518B8000-memory.dmp

Download