Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
b2e98f0e67b3f3c31acdfe13939b2717.msc
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target b2e98f0e67b3f3c31acdfe13939b2717.msc
- Size 7.2MB
- Sample260718-l8lazsbs8z
- SHA256 d2b62eee5728ff226066619e52120810d010d149e7424eaabd15fbbaf7a64813
- MD5 b2e98f0e67b3f3c31acdfe13939b2717
- SHA1 34fb3147e9ad4d6e616a853512b840b6bbbd8b98
- SHA512 3e0537eeb8cc090604d1dbe6a2bfb5b991fd98e0e097bbd22dff7bb6aecbd91f16a9fece25ea4104a171c9e78190e288c2a9cdbef1c67e77d03a895432ee5ea9
- SSDEEP 3072:jZk63hzYKAhEqqC0B8XrbEftngiHvIKy3m1TsSFruJY1H8vhtptmQRAZZndUT2AW:d
- TLSH T1EB768DFA7400C14F7A3A89FFFA9C1FD554849E1BD5CC9B4481A8D86DABFC10A26184DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" mmc.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch mmc.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" mmc.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\IESettingSync mmc.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1368 mmc.exe Token: SeIncBasePriorityPrivilege 1368 mmc.exe Token: 33 1368 mmc.exe Token: SeIncBasePriorityPrivilege 1368 mmc.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe 1368 mmc.exe