e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe
Size 3.1MB
Sample260804-3cacaazzgz
SHA256 e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
MD5 c49750d6be3ff3f5e7940535c194c0fb
SHA1 6a3efa2da48e2692decdfd5bce0f5bbacb3153dc
SHA512 3378807659d599f60c4ae256f03f320490603fb9b8def560a022aede936502a4f398d01937ceb0b3c2d9a30117e067605046098d44389a86fce5d4823497b9e0
SSDEEP 49152:Jh4JI2+brARFaOrnPpF0b7cMRtGVRyrUCBvF7GHVW1QS4IU6isok8:DrUEOFu8q5+kH+/
TLSH
T1CDE54B02BA9B94ECC15AC474C3464A73AE2174CB0726B9FF42D496383F6ABE15B3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4744	SgrmBrokerSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemProtectionAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemProtection\\SgrmBrokerSvc.exe"	e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe

C:\Users\Admin\AppData\Local\Temp\e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe
"C:\Users\Admin\AppData\Local\Temp\e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe"
1⤵
- Adds Run key to start application
PID:660

C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
1⤵
- Executes dropped EXE
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 56B
SHA256 2e3e291e420659c50ecc626577b833bd9a123bdb0fb336c2a9a14f69d9dba809
MD5 62faaaa42d2fd5f47b7cd6bd5eb93b91
SHA1 d7a328f09270e5731f46b75a8ca4efdf3571b597
SHA512 e0f09ddb002d1050a4d36bc52435fa7ef3a67e9d2633e7e38d6468451f1eff1af766ba34ab504a700d611fd115d6bd3781276b3cceca19da99a2a82fa44626a9
MD5 SHA1 SHA512

Submit Download

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 106B
SHA256 bdfa0d687a153c261c1224f72326c187ba54fa3b463b041cc81f7989e81d2c01
MD5 036ac74f2d3fd00085a31facd1833619
SHA1 f4b0c4e9d515d015393de39c4f3b27f06c1e9b25
SHA512 c00fc0b75f952d6f12347ceb3fffe210bfdb34ceafa50ca9b1f584f9008759058dcc8dfee5d867b8f93c260cf06011b26f1adabffb0545f9ba9657352b5ad876
TLSH
T110B011BA0FCC003C0C2030A0C3FC0820CE0C3E23C3E82C80F0000E0CA0080C0803BA82
MD5 SHA1 SHA512 TLSH

Submit Download

SgrmBrokerSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
Size 3.1MB
SHA256 e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
MD5 c49750d6be3ff3f5e7940535c194c0fb
SHA1 6a3efa2da48e2692decdfd5bce0f5bbacb3153dc
SHA512 3378807659d599f60c4ae256f03f320490603fb9b8def560a022aede936502a4f398d01937ceb0b3c2d9a30117e067605046098d44389a86fce5d4823497b9e0
SSDEEP 49152:Jh4JI2+brARFaOrnPpF0b7cMRtGVRyrUCBvF7GHVW1QS4IU6isok8:DrUEOFu8q5+kH+/
TLSH
T1CDE54B02BA9B94ECC15AC474C3464A73AE2174CB0726B9FF42D496383F6ABE15B3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads