014aae3fddb8cfb858ff3e147d844e791621a61039a0d6aa9ea23db07fdaba3f

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windscribe_2.23.12_amd64.exe
Size 40.0MB
Sample260727-a2drsafl5x
SHA256 014aae3fddb8cfb858ff3e147d844e791621a61039a0d6aa9ea23db07fdaba3f
MD5 7471e853022851862218c6e54807dc64
SHA1 474f20ab11537c347260f0065ca98990ead09b11
SHA512 f4b20d00a6c9a464a7852dfab0a377c00722ddfbdab16ed3409f7ce03d7b30c39b4e2ff01f36339cdf2461f05ca9d571daea97f76311f1ae9415744f030102d2
SSDEEP 786432:eysV/RnJqIUgLvRbGlbJFtxx0gzcVvPYXSxp8xRaqTar5HczodV5XuB3FU1HSJ:eyoRJj1vRClntxx8VvP9xp8x9O8qXuBZ
TLSH
T100973356F55C82B5D073D078C9D2A695EAB234C6033185CB43A297793F23BE6CE7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
260	7zr.exe
3024	Windscribe_2.23.12_amd64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3024	Windscribe_2.23.12_amd64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	Windscribe_2.23.12_amd64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	260	7zr.exe
Token: 35	260	7zr.exe
Token: SeSecurityPrivilege	260	7zr.exe
Token: SeSecurityPrivilege	260	7zr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 260	1688	Windscribe_2.23.12_amd64.exe	89
PID 1688 wrote to memory of 3024	1688	Windscribe_2.23.12_amd64.exe	91

C:\Users\Admin\AppData\Local\Temp\Windscribe_2.23.12_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\Windscribe_2.23.12_amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\7zr.exe
  "C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\7zr.exe" x -y -bb3 -bd -o"C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e" "C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\windscribeinstaller.7z"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\Windscribe_2.23.12_amd64.exe
  "C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\Windscribe_2.23.12_amd64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zr.exe

Path C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\7zr.exe
Size 921KB
SHA256 f998608126c11ee1ce7d219777042799dbc5f22bf93031d4374b293ac5027022
MD5 24d3197d0d8ffe822c62d970439d3c26
SHA1 124e385abc31d54fac42303f6d0d520a3d96cf0b
SHA512 acf8f18f075056e9dd53f8376abff2a99b89a664f57934e4a3df77f0fcfce30bd7043441823127cf41d4db3a0ab32b39148113ceefd8a01935f1cc8c975bd460
SSDEEP 12288:LZcsd0c7n+9FONoc0r6PxspOJsKe9Yhkst6UUElE/TzhWY2yhleWLr:vdtniYec86kExtPUEe/TzIyr
TLSH
T1AF152B66F6788271D073C0B9C5D29A9AEE723085173086C71286D77C3F57BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribeinstaller.7z

Path C:\Windows\Temp\WindscribeInstaller4397982bd9190e8c5a282ab921aa5d8e\windscribeinstaller.7z
Size 38.4MB
SHA256 0a873825d94fcce9ab96b83ea904f83d27546b026ad187e664822c264de31114
MD5 26b6e4151aa561f47bd0a37197d57179
SHA1 dcf7cdcf4e8b54e1422b163d1f4987528192d4b4
SHA512 8b8a56a662aad703b8d1c87649c4927eaee00c5d61139c5789789e84159efd66c609d11b22a79e658785fd8dca87d3a093c0c83c5ca58912ffbabf4022da8551
SSDEEP 786432:JysV/RnJqIUgLvRbGlbJFtxx0gzcVvPYXSxp8xRaqTar5HczodV5XuB3FU1HSd:JyoRJj1vRClntxx8VvP9xp8x9O8qXuBN
TLSH
T1689733567C4DBCE58E09378DADD63A90E1AE34CA215DCD13C6F1AAECA231412CB578CD
MD5 SHA1 SHA512 SSDEEP TLSH