ef4f97e1ba4224abfb7e6e41f14256e2dbb611d25a652dc7031afda73e13ab9c

Analysis

max time kernel
23s
max time network
173s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DLL/ENSTRMAPI.dll
Size 2.6MB
Sample260707-sqlblagx7p
SHA256 ef4f97e1ba4224abfb7e6e41f14256e2dbb611d25a652dc7031afda73e13ab9c
MD5 ab7046f0a6100335bdbfaf4923df0d09
SHA1 cf113ecac3d82557aa1c604e7ebbacb960dc553c
SHA512 b3bd1b0c6497adbeba6a5b606f6205440820d4a6e55b48dc4e5fbe49568fb963c9ea1c8fdbdd82cb76daca40f96a770ea59eef0c1b4b23b01ab29efe1ef60b3f
SSDEEP 49152:K698NqkPci1nojSCrJEfs+PhzZ3p0TTT5WzfJ5ProZx4LbDuOZRwq/Rf:58N3uTTT5WzfD
TLSH
T12FC55C987F9DC071EA4F527420B9BB4DA65A638827308DC3E258B95FAD711C02D379CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	3320	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{4C6E0719-532A-4D3A-A040-438DA9608A47}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5596	explorer.exe
Token: SeCreatePagefilePrivilege	5596	explorer.exe
Token: SeShutdownPrivilege	5596	explorer.exe
Token: SeCreatePagefilePrivilege	5596	explorer.exe
Token: SeShutdownPrivilege	5596	explorer.exe
Token: SeCreatePagefilePrivilege	5596	explorer.exe
Token: SeShutdownPrivilege	5596	explorer.exe
Token: SeCreatePagefilePrivilege	5596	explorer.exe
Token: SeShutdownPrivilege	5596	explorer.exe
Token: SeCreatePagefilePrivilege	5596	explorer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2300	sihost.exe
5596	explorer.exe
5596	explorer.exe
5596	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3320	3116	rundll32.exe	87
PID 2300 wrote to memory of 5596	2300	sihost.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\ENSTRMAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\ENSTRMAPI.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 640
    3⤵
    - Program crash
    PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 236 -p 3320 -ip 3320
1⤵
PID:4556

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5596

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1124

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 587B
SHA256 b2209b771ee60d35244635ab8f98535ef42b3831cc6d543be82fcdb2195a3fb9
MD5 86216871fabf666e84644714fdc629cb
SHA1 9b1be9c9acfb6a32819a65d5586fc058e9710931
SHA512 dc3c8aa856b9ef6002334df7b4eeafaa0afe2297adafd1169ccde639b8d71c37bef94bfc20624da9038f5ee15b4b0368aad1c9980cf74099e74008b988f150ee
TLSH
T1EAF05CD7D7E55692C021123DC8D675D47532E5DA6AC9A32342117F0D7D2F7410E540FC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-20-0x0000019403DF0000-0x0000019403E10000-memory.dmp

Download

memory/1124-3-0x00000194001C0000-0x00000194002C0000-memory.dmp

Download

memory/1124-2-0x00000194001C0000-0x00000194002C0000-memory.dmp

Download

memory/1124-1-0x00000194001C0000-0x00000194002C0000-memory.dmp

Download

memory/1124-48-0x00000194143B0000-0x00000194143D0000-memory.dmp

Download

memory/1124-17-0x0000019413FF0000-0x00000194140F0000-memory.dmp

Download

memory/1124-16-0x0000019403A70000-0x0000019403A90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads