a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe
Size 3.1MB
Sample260804-3ccseazzhw
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3272	SgrmBrokerSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemProtectionAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemProtection\\SgrmBrokerSvc.exe"	a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe
"C:\Users\Admin\AppData\Local\Temp\a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:3600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
1⤵
- Executes dropped EXE
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 56B
SHA256 c1acfc80c0786991a47f476f89134191e2c86e7231d0f9b2bc4c4a509a541fb9
MD5 57edb22c090c2fba94d73280ffc3f705
SHA1 36738f85b89c3137eca79c44e9c2ea89534a76c7
SHA512 fb9f3e8dfa23b27c5fc2c2491db7296d0d2f384f0924ef8ddc61924cdd4c289e3539267f45c06b83b3fd36e440a2e15812a17ce42902456b632134c2d4eea7c3
MD5 SHA1 SHA512

Submit Download

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 106B
SHA256 c946382620250c1f6b668ef0cb6ac06bdd58e7b1ddc26f273ea072727860d07d
MD5 8eebba9fefcfc8fb0a7da66f1a29c034
SHA1 c3ed9d0617bebd3c389fdba82c3175eb8bb94c9d
SHA512 29d09a66125074b42b21506edf87e4080b55d63441dfaf0ae94659663d806b1ddc4f3fe5743e20683885b9e9b3aca9880dc489c99e473cf382c9d9ecc89ce6ed
TLSH
T18FB099B00E8C08A82020302802F80820CC2C3A3383EC2C82F0008E2CA0880C0803BA82
MD5 SHA1 SHA512 TLSH

Submit Download

SgrmBrokerSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
Size 3.1MB
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads