a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe
Size 3.1MB
Sample260804-3ccseazzhw
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5988	SgrmBrokerSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemProtectionAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemProtection\\SgrmBrokerSvc.exe"	a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3496	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe
"C:\Users\Admin\AppData\Local\Temp\a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:5536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3496

C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
1⤵
- Executes dropped EXE
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 56B
SHA256 849f5984a3145d2dc3bf8ae13d8fd8c32464290ab77a8d4ed8349529b1910fb9
MD5 8e4c7db5c7a9489284de6d61aaeddf7f
SHA1 8470b200c3aae2924c4485418082bbccf695e8e7
SHA512 f1e2f17249bbb2c856c204be39cdc00c4fd949b6a4390c32c2f61205fe86231e1ecfdf0375d2bab137f06ae59519d38f4ff64469af5b4d1cc009bdce909973f2
MD5 SHA1 SHA512

Submit Download

sgrmbroker.log

Path C:\Users\Admin\AppData\Local\Temp\sgrmbroker.log
Size 106B
SHA256 629d7ab0476b73d7e1337effe75577d74f2bc52a6ab4072da245248d01552916
MD5 d54482593ca3f297a8fd5cb446ed80c1
SHA1 c358a3e086896d5bde5b929f72a3590641e862f8
SHA512 31461708f017487f06b024eaf4c1f55cf0453bc6db6731a0988e1201a242ec1880afabbccf7f76b72c1fe3aeffdad3cff7a4056720af0e27c660790f4bb0183b
TLSH
T179B011B00FCC083E0020322803F8A820C80E3E33C3E83C82F2000E0CA00E0C0802BA82
MD5 SHA1 SHA512 TLSH

Submit Download

SgrmBrokerSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemProtection\SgrmBrokerSvc.exe
Size 3.1MB
SHA256 a14f8f296dfcea7ced291030fc91724e2c94e3cdf7ec7cefe7a5d358cdf08cfc
MD5 436fc1906db2d54f953e5b38385bfa54
SHA1 7f40d98331aa68e330a0476787a33b9ba906de01
SHA512 a9d0bb7b4d557306bc1026dcb82f1be2dd8cb04d6d5ebe0c80d4311c78a1fd6514331e39431b09199d53913b9b5f43995162a395d5ffb6b29f237a51fa570311
SSDEEP 49152:m89o4a37EzB4/eEX8qLersKMdeZZ6jwoUIRrUpOjFw637KrhxoY4IU6iton:pRz+2EXcrTl6WyIH+
TLSH
T144E54B02BA9B94ECC15AC475C3464A736E2174CB1B26B9FF42D496383F6ABE05B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads