Analysis
- user interaction
yes - max time kernel
898s - max time network
447s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sense.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
900 seconds
General
- Target sense.exe
- Size 503KB
- Sample260705-3kshtsb19k
- SHA256 f1106899437fb6ccbcbc3b068bc91f167e33be011bf744c9c3ff5211338aa7b1
- MD5 157a6686f0ff4ce5b616ac3e03421611
- SHA1 b68c0cdcb6082f3c4622563310542e700031195f
- SHA512 8ffa0ab5bcf424da880b1ec6e005fc9fddae1c11278ca315aea689d89780e78b9d25b8c8e9dcbb0e646a739d9967253ba07300f1681dee6a078f553a0ccf7373
- SSDEEP 12288:WPL5tOcJQKh0Vv0nMapxJjMXsMvyXExdHaYQOsnlYrG/4wKnDV:WPL5tOcJQ40F0nMapbjMXsMqXExdHaY7
- TLSH T111B48D0662AC03ACD466913C54A66747FAFA7E5843108FDF23F40CA81F97BE179BB251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FHvraSoVisMIcVgOQtBiYqMRqM\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\FHvraSoVisMIcVgOQtBiYqMRqM" sense.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4544 cmd.exe 3872 cmd.exe - Kills process with taskkill 2 IoCs
pid Process 4708 taskkill.exe 3776 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe 5084 sense.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5084 sense.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4708 taskkill.exe Token: SeDebugPrivilege 3776 taskkill.exe Token: SeLoadDriverPrivilege 5084 sense.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5084 wrote to memory of 4544 5084 sense.exe 85 PID 4544 wrote to memory of 4708 4544 cmd.exe 86 PID 5084 wrote to memory of 3872 5084 sense.exe 88 PID 3872 wrote to memory of 3776 3872 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\sense.exe"C:\Users\Admin\AppData\Local\Temp\sense.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c TASKKILL /F /IM VALORANT-Win64-Shipping.exe >NUL 2>&12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\taskkill.exeTASKKILL /F /IM VALORANT-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c TASKKILL /F /IM VALORANT-Win64-Shipping.exe >NUL 2>&12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\taskkill.exeTASKKILL /F /IM VALORANT-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1