1618b0270398824725f0449703a59f68ce25941d73003130abf584f759b8d4af

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plugincore2.04.6/plugincore2.04.6.exe
Size 5.8MB
Sample260728-ap826aeb57
SHA256 1618b0270398824725f0449703a59f68ce25941d73003130abf584f759b8d4af
MD5 eb3c2c0fc411764b281c8b45c94a7ec6
SHA1 dcec68639a726c2ec209293a262d5b0ebf994dc9
SHA512 a829c0cbad9feefe924bf3b211640ef6e7d5284faf07c186c1e5159f62ff52f88fddcb1463b0a22934bd90227e8071fb21333258819b0c1188f259c940954939
SSDEEP 49152:x4EY/auow7FBLiN7GG3TRV3xcif/+oDtN1678QM1CAdRM5878CF7zAS3/yiGSYIy:RP1KG3vxMoDRE8HjkCKdS/mo8
TLSH
T1335618826269C09DD0EB9734D95A5EFBD6B2BC11C7304A8F01523D5D3EB62A45B3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	plugincore2.04.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	4840	msiexec.exe
Token: SeCreateTokenPrivilege	2876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2876	msiexec.exe
Token: SeLockMemoryPrivilege	2876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2876	msiexec.exe
Token: SeMachineAccountPrivilege	2876	msiexec.exe
Token: SeTcbPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeLoadDriverPrivilege	2876	msiexec.exe
Token: SeSystemProfilePrivilege	2876	msiexec.exe
Token: SeSystemtimePrivilege	2876	msiexec.exe
Token: SeProfSingleProcessPrivilege	2876	msiexec.exe
Token: SeIncBasePriorityPrivilege	2876	msiexec.exe
Token: SeCreatePagefilePrivilege	2876	msiexec.exe
Token: SeCreatePermanentPrivilege	2876	msiexec.exe
Token: SeBackupPrivilege	2876	msiexec.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeShutdownPrivilege	2876	msiexec.exe
Token: SeDebugPrivilege	2876	msiexec.exe
Token: SeAuditPrivilege	2876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2876	msiexec.exe
Token: SeChangeNotifyPrivilege	2876	msiexec.exe
Token: SeRemoteShutdownPrivilege	2876	msiexec.exe
Token: SeUndockPrivilege	2876	msiexec.exe
Token: SeSyncAgentPrivilege	2876	msiexec.exe
Token: SeEnableDelegationPrivilege	2876	msiexec.exe
Token: SeManageVolumePrivilege	2876	msiexec.exe
Token: SeImpersonatePrivilege	2876	msiexec.exe
Token: SeCreateGlobalPrivilege	2876	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
716	plugincore2.04.6.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2876	716	plugincore2.04.6.exe	93

C:\Users\Admin\AppData\Local\Temp\plugincore2.04.6\plugincore2.04.6.exe
"C:\Users\Admin\AppData\Local\Temp\plugincore2.04.6\plugincore2.04.6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Windows\Temp\SSA_Viewer_3.1_x64.msi" /quiet /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2876

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SSA_Viewer_3.1_x64.msi

Path C:\Windows\Temp\SSA_Viewer_3.1_x64.msi
Size 69B
SHA256 bbbf64d20bb15a76d9834399ada051bbfac190643ad166fad4062df5dfdb7945
MD5 dba503d35d892bf53b2646194fa29f82
SHA1 380791880370f9473e50b09b02e017ff33de5bea
SHA512 c19868ff1f275affc2a9df5488f535982ab4c0809c8d48ada92c2474927677803d35b2eb4f30fdabd2c379c2033351f09089c222012c6b4502a0981402b5b3e5
TLSH
T18EA0220C020BAFAE0FA3C8AAABCABC3380F002C008A2AB000008C0E80000280CC803C0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-8-0x00007FFF473D0000-0x00007FFF4740B000-memory.dmp

Download