d2ce55038814ca164cbda2c3e22bc7ddd6cab62b1ebb642da7370d3e78092f06

Analysis

max time kernel
149s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProcessGovernor.exe
Size 1.3MB
Sample260704-txrbvsdw9k
SHA256 d2ce55038814ca164cbda2c3e22bc7ddd6cab62b1ebb642da7370d3e78092f06
MD5 5f646473b37fad590cdf06bfdc3c0ec9
SHA1 b0fbdcb957fd0524571c933c280c7b9f38acf1be
SHA512 f53193d98987c501d8ff467e0a5c546f76be5aa0b712a854de38b91be01f2c93a5de8387253295f3040e03323d74fa33f1c7584b9efab858965ef9ae6616f7ab
SSDEEP 24576:xUyt6Yi/DMQ+RsPifRNWT4vKvjYy+pFmM/UUZkVTvkIYk:W2EDMQ+RsPifRDSvjYy+pgM/1Q8m
TLSH
T1225527D455B905ACE066D8BC8A91CC8AE5EB7C0C073D7AFB02B036591F3EBD50A79E11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessGovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessGovernor.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe
1676	ProcessGovernor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1676	ProcessGovernor.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1676	ProcessGovernor.exe
Token: SeDebugPrivilege	1676	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	1676	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	1676	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	1676	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	1676	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	1676	ProcessGovernor.exe
Token: SeBackupPrivilege	1676	ProcessGovernor.exe
Token: SeRestorePrivilege	1676	ProcessGovernor.exe

C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessGovernor.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads