1618b0270398824725f0449703a59f68ce25941d73003130abf584f759b8d4af

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plugincore2.04.6/plugincore2.04.6.exe
Size 5.8MB
Sample260728-ap826aeb57
SHA256 1618b0270398824725f0449703a59f68ce25941d73003130abf584f759b8d4af
MD5 eb3c2c0fc411764b281c8b45c94a7ec6
SHA1 dcec68639a726c2ec209293a262d5b0ebf994dc9
SHA512 a829c0cbad9feefe924bf3b211640ef6e7d5284faf07c186c1e5159f62ff52f88fddcb1463b0a22934bd90227e8071fb21333258819b0c1188f259c940954939
SSDEEP 49152:x4EY/auow7FBLiN7GG3TRV3xcif/+oDtN1678QM1CAdRM5878CF7zAS3/yiGSYIy:RP1KG3vxMoDRE8HjkCKdS/mo8
TLSH
T1335618826269C09DD0EB9734D95A5EFBD6B2BC11C7304A8F01523D5D3EB62A45B3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1712	msiexec.exe
Token: SeSecurityPrivilege	716	msiexec.exe
Token: SeCreateTokenPrivilege	1712	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1712	msiexec.exe
Token: SeLockMemoryPrivilege	1712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1712	msiexec.exe
Token: SeMachineAccountPrivilege	1712	msiexec.exe
Token: SeTcbPrivilege	1712	msiexec.exe
Token: SeSecurityPrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeLoadDriverPrivilege	1712	msiexec.exe
Token: SeSystemProfilePrivilege	1712	msiexec.exe
Token: SeSystemtimePrivilege	1712	msiexec.exe
Token: SeProfSingleProcessPrivilege	1712	msiexec.exe
Token: SeIncBasePriorityPrivilege	1712	msiexec.exe
Token: SeCreatePagefilePrivilege	1712	msiexec.exe
Token: SeCreatePermanentPrivilege	1712	msiexec.exe
Token: SeBackupPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeShutdownPrivilege	1712	msiexec.exe
Token: SeDebugPrivilege	1712	msiexec.exe
Token: SeAuditPrivilege	1712	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1712	msiexec.exe
Token: SeChangeNotifyPrivilege	1712	msiexec.exe
Token: SeRemoteShutdownPrivilege	1712	msiexec.exe
Token: SeUndockPrivilege	1712	msiexec.exe
Token: SeSyncAgentPrivilege	1712	msiexec.exe
Token: SeEnableDelegationPrivilege	1712	msiexec.exe
Token: SeManageVolumePrivilege	1712	msiexec.exe
Token: SeImpersonatePrivilege	1712	msiexec.exe
Token: SeCreateGlobalPrivilege	1712	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1712	msiexec.exe
716	msiexec.exe
2996	plugincore2.04.6.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1712	2996	plugincore2.04.6.exe	89

C:\Users\Admin\AppData\Local\Temp\plugincore2.04.6\plugincore2.04.6.exe
"C:\Users\Admin\AppData\Local\Temp\plugincore2.04.6\plugincore2.04.6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Windows\Temp\SSA_Viewer_3.1_x64.msi" /quiet /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1712

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SSA_Viewer_3.1_x64.msi

Path C:\Windows\Temp\SSA_Viewer_3.1_x64.msi
Size 69B
SHA256 bbbf64d20bb15a76d9834399ada051bbfac190643ad166fad4062df5dfdb7945
MD5 dba503d35d892bf53b2646194fa29f82
SHA1 380791880370f9473e50b09b02e017ff33de5bea
SHA512 c19868ff1f275affc2a9df5488f535982ab4c0809c8d48ada92c2474927677803d35b2eb4f30fdabd2c379c2033351f09089c222012c6b4502a0981402b5b3e5
TLSH
T18EA0220C020BAFAE0FA3C8AAABCABC3380F002C008A2AB000008C0E80000280CC803C0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2996-26-0x00007FF8AE6E0000-0x00007FF8AE71B000-memory.dmp

Download