e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe
Size 3.1MB
Sample260804-3cacaazzgz
SHA256 e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
MD5 c49750d6be3ff3f5e7940535c194c0fb
SHA1 6a3efa2da48e2692decdfd5bce0f5bbacb3153dc
SHA512 3378807659d599f60c4ae256f03f320490603fb9b8def560a022aede936502a4f398d01937ceb0b3c2d9a30117e067605046098d44389a86fce5d4823497b9e0
SSDEEP 49152:Jh4JI2+brARFaOrnPpF0b7cMRtGVRyrUCBvF7GHVW1QS4IU6isok8:DrUEOFu8q5+kH+/
TLSH
T1CDE54B02BA9B94ECC15AC474C3464A73AE2174CB0726B9FF42D496383F6ABE15B3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1088	SgrmBrokerSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemProtectionAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemProtection\\SgrmBrokerSvc.exe"	e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe

C:\Users\Admin\AppData\Local\Temp\e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe
"C:\Users\Admin\AppData\Local\Temp\e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad.exe"
1⤵
- Adds Run key to start application
PID:1236

C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
1⤵
- Executes dropped EXE
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 56B
SHA256 0d51452c1a1f45fd33e268d874f2865da2b108a4d8af033f8e4223d145d299d0
MD5 ed1727ece53b96da6f76f3bcb3111e43
SHA1 4b9bfb5155d5bd8413de61b82ebd6613fbbcb032
SHA512 ad34b93ba590d879f866b6bed46b60428d023b0cfdfeb8b270dd90e52aa77c3ee57ff566ebbd9835c01ed1bf4c4d3b627128f1c25c61512233e0528cfbf2a0d3
MD5 SHA1 SHA512

Submit Download

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 95B
SHA256 ae4e9c46d1fde01d1595547706c1d5068f2065078f70a3904e696f74c58bc171
MD5 f4b33ead9fd477cf7bd252d1b3712d35
SHA1 cfd997827f495f158c5c120910fbec0c9dedb04f
SHA512 87ace44c08f765cccfe6ff477523731c3135a9f6a00874dd4dfa5e8daf1368247c8dbba232af65fd618c2951695ef53afaa9a4c5812bf9f228c93153a6d59149
TLSH
T124B001319F8C20B9463271655AFA20A1E95C7C07E3E92C0135958E5D6A261E6916339E
MD5 SHA1 SHA512 TLSH

Submit Download

SgrmBrokerSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
Size 3.1MB
SHA256 e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
MD5 c49750d6be3ff3f5e7940535c194c0fb
SHA1 6a3efa2da48e2692decdfd5bce0f5bbacb3153dc
SHA512 3378807659d599f60c4ae256f03f320490603fb9b8def560a022aede936502a4f398d01937ceb0b3c2d9a30117e067605046098d44389a86fce5d4823497b9e0
SSDEEP 49152:Jh4JI2+brARFaOrnPpF0b7cMRtGVRyrUCBvF7GHVW1QS4IU6isok8:DrUEOFu8q5+kH+/
TLSH
T1CDE54B02BA9B94ECC15AC474C3464A73AE2174CB0726B9FF42D496383F6ABE15B3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads