Overview

overview

8

Static

static

3

agent-wind...44.exe

windows10-2004-x64

1

agent-wind...44.exe

windows11-ltsc_2024-x64

8

Resubmissions

05/08/2026, 10:11

260805-l72xcay1gv8

05/08/2026, 05:04

260805-fqmhfaaq2x8

04/08/2026, 21:53

260804-1rlyhsyxg18

04/08/2026, 20:26

260804-y74gdsxwcz8

04/08/2026, 14:36

260804-ry1wkscd383

04/08/2026, 14:36

260804-rysj7sgn813

04/08/2026, 14:35

260804-ryencagn7t8

04/08/2026, 14:15

260804-rknn4ayycy8

04/08/2026, 14:14

260804-rj8ymssdrh3

04/08/2026, 13:56

260804-q8pevsgj6v8

Analysis

  • max time kernel
    900s
  • max time network
    891s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    agent-windows-amd64-37628444.exe
  • Size 13.1MB
  • Sample260804-q8pevsgj6v
  • SHA256 249b8a6cd3c0bab8d929476c0f6e39cbdc940c649a3fea645bf9f8f9624c3198
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionpersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-37628444.exe
    "C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-37628444.exe"
    1⤵
    • Modifies visibility of existing users in the login screen
    • Modifies WinLogon
    • Drops file in System32 directory
    • Modifies termsrv.dll
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:4092
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2848
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -s TermService
      1⤵
        PID:3392
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4532
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1972
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5368
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:2420

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Defense Evasion

              Hide Artifacts

              1
              T1564

              Hidden Users

              1
              T1564.002

              Impair Defenses

              1
              T1562

              Disable or Modify System Firewall

              1
              T1562.004

              Modify Registry

              3
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              4
              T1012

              System Information Discovery

              4
              T1082

              Lateral Movement

              Remote Services

              1
              T1021

              Remote Desktop Protocol

              1
              T1021.001

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1972-84-0x0000023E01DE0000-0x0000023E01EE0000-memory.dmp
              Download

              memory/1972-105-0x0000023E01DA0000-0x0000023E01DC0000-memory.dmp
              Download

              memory/1972-81-0x0000023E019C0000-0x0000023E019E0000-memory.dmp
              Download

              memory/1972-119-0x0000023E14220000-0x0000023E14240000-memory.dmp
              Download

              memory/1972-73-0x0000023E001E0000-0x0000023E002E0000-memory.dmp
              Download

              memory/5368-252-0x000001D100000000-0x000001D1002BC000-memory.dmp
              Download

              memory/5368-235-0x000001D100000000-0x000001D1002BC000-memory.dmp
              Download

              memory/5832-16-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-48-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-10-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-11-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-12-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-13-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-14-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-15-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-0-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-17-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-18-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-19-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-20-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-21-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-22-0x0000000252600000-0x000000025260E000-memory.dmp
              Download

              memory/5832-33-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-34-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-35-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-36-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-37-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-38-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-40-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-41-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-42-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-43-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-44-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-45-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-46-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-47-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-9-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-49-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-50-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-51-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-52-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-8-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-7-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-6-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-5-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-4-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-3-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-173-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-2-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-236-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-238-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-240-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-242-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-244-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-247-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-249-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-251-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-1-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-253-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-255-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-257-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-259-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-261-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download

              memory/5832-263-0x00007FF6FE8A0000-0x00007FF70160F000-memory.dmp
              Download