Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 02:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 2.8MB
- Sample260723-cpvwmsvthy
- SHA256 601080635c9ccd34b65b0fa5852282a58bac0eee8c01120beb1fd852a2d31e66
- MD5 8639f5e2de621eaee6e00e97be9c6139
- SHA1 8facc65ae4ac1ef7c2476cf39d34f2098c6d6c8c
- SHA512 f8f37858937eba7b92f9a2c03800b4fbc5edc3edc5242e635cfd93bb64513d4cb280858efdf4bfd5061900e9c6e34e6840df4ce232b52263dde368eecba37cca
- SSDEEP 49152:+sLYZ2QQlxKrAORzIwCHxDBtSYWhzV59WYIUk9EpAwpQqRIHtlbFU5jXjITCZ:+s4N2sr7KwkxD965w3U6EywuD+Vjl
- TLSH T182D52399FCB106F0D836C7FA928361AE711937408A659D13B6CD6B006C6362D7D3A3BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1628 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 5592 SmartScreenHost27dac.exe 5592 SmartScreenHost27dac.exe 5592 SmartScreenHost27dac.exe 5592 SmartScreenHost27dac.exe 1008 file.exe 1008 file.exe 1200 powershell.exe 1008 file.exe 1008 file.exe 1200 powershell.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1200 powershell.exe 1200 powershell.exe 1200 powershell.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4328 SmartScreenHost27dac.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1008 file.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1200 powershell.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 1008 file.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe 4328 SmartScreenHost27dac.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1008 wrote to memory of 1628 1008 file.exe 89 PID 1008 wrote to memory of 1200 1008 file.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\DeliveryOptimizationEA92\SmartScreenHost27dac.exe" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Stop-Process -Force -Id 1008; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\file.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Users\Admin\AppData\Roaming\DeliveryOptimizationEA92\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\DeliveryOptimizationEA92\SmartScreenHost27dac.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5592
-
C:\Users\Admin\AppData\Roaming\DeliveryOptimizationEA92\SmartScreenHost27dac.exe"C:\Users\Admin\AppData\Roaming\DeliveryOptimizationEA92\SmartScreenHost27dac.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\65E66638BBF63D4F125C15622F38F792
- Size 417B
- SHA256 f9d0a4b9ecdd80c682010fef1d23c51503ad5fa981696856b3d806357094932b
- MD5 b1a6b5732062305f970a1e9740ca919c
- SHA1 6475166aa97ef73bd7063b3d361fcdb8cb3bc98a
- SHA512 546bc488fd63131026dfa67e8a4c26c122dbf8402250f687d44d4ac437d96877b1b9cf7c709e5a29ca442a16aa05ac61997b602cff574bef0bf422e892e697e4
- TLSH T1DFE0A346A6355DC152A1FF00E5C4C44B0DFC51953E8DF4111774971069927EAE6612C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
- MD5 adac67e1d2da2d706db151c2db316b2d
- SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
- SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
- TLSH T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 528B
- SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
- MD5 047f3e9d21d6b325d592b1959e4362e6
- SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
- SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
- TLSH T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\65E66638BBF63D4F125C15622F38F792
- Size 192B
- SHA256 b25d978e4df113fa822da598377b7b77d00abd0e127d2298ac2b86cb8f276a20
- MD5 ae6d3bf3ad388dbda9f93c1f80b13099
- SHA1 ebc5e79376413c8071e43481fd09517e95267e01
- SHA512 f06d191c8d94593883b4165be2b626bba12c2fc8b95c9de4ceab787bd33dbd00a6a9a55fadaafadfbfcc3afd373218c3e9899165ede4ddb6c3b2b772030d4d94
- TLSH T10DC08C0036770203F260023F6D699A04A3F9DB25CA01D3862FB09BA80209A4AB8B2E20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 918954a92638591d1ae68a7f1947a69bb9473a0d0e6bcacf6ec7b8399c03ffa0
- MD5 3426da66d3086e32cad2ff14d8fc2548
- SHA1 e3de22105accb92a74127ffc12aaac9894f92977
- SHA512 be858be0baf5ece15239a4633841bd5ee8ef19a33ba2f88213f97fd1de577a07d623d75ede042483606c7d0aa4277488d0dd2ff1384464af0ca174af24209561
- TLSH T1ACC02B0433F14165F1300D7F1643571247FAF104DD4183000F305258C12DB435CF0C06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 06cc5893dcb48aafc7e4bf020f8daec00832377af65802b750336744e4f17611
- MD5 86746070f6c508d69b0577f214c4bc25
- SHA1 0d0acef4d3486a4cf8e6ea95aaa1e2c966b59eec
- SHA512 efe6c2aa020f5451f66322a257a8f470b8eb54102a85aa1e9d811d39970dd75c3b30d6cd5e521ee04a2851df9f4738d48c49edd5424d8bae1076afa0adf77330
- TLSH T12EC09B147365471AF14D253E79D51A0417B58105F5C6C3484B745534C5286411871D05
- MD5 SHA1 SHA512 TLSH