33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421.exe
Size 3.1MB
Sample260805-as7cqsgn3v
SHA256 33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421
MD5 f465c160022f5ea04a0b2ce1e571e84b
SHA1 26b28f7c4f09d962dea18a5054bb5ea309875a86
SHA512 cce18a7449b24957eb0e321803336bb46ed84be00ceccd5ddefdb4688fc518e8bc8ed4244861a4a7e36076f776b7b6b65abfaf87d0dc67d969a00f3a500e9e1b
SSDEEP 49152:WayGtD9w8DKJiDPHbojxtcISlmFMIx7GrUpOjFw63L6dxf34IU6itoy+IKPi:oehm2PctlaWyi3H+N
TLSH
T1CDE55C42BA9B94ECC15AC474C34A4A736E2174CB1726B9FF46D496383F6ABE05B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	DesktopSessionSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\DesktopSessionMedic = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DesktopSession\\DesktopSessionSvc.exe"	33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4712	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421.exe
"C:\Users\Admin\AppData\Local\Temp\33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:2732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4712

C:\Users\Admin\AppData\Roaming\Microsoft\DesktopSession\DesktopSessionSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\DesktopSession\DesktopSessionSvc.exe
1⤵
- Executes dropped EXE
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktopsession.log

Path C:\Users\Admin\AppData\Local\Temp\desktopsession.log
Size 56B
SHA256 4c303ba16bbd93412fd04c1c96368a779afe3f2af26cce07ca2a739956fbe37e
MD5 1585ed8cefe3770626b95330c4570abf
SHA1 cd83cee851ed1a356d6484e913ede95135772e35
SHA512 4bf473c5d695f249de19ae25768089565cde68c6a9d6fd4e07249be7e1df6142e4622d93ed95c026efbd7678f8867a3bfaee526ed7b141b2e32670fe8feaef48
MD5 SHA1 SHA512

Submit Download

desktopsession.log

Path C:\Users\Admin\AppData\Local\Temp\desktopsession.log
Size 4KB
SHA256 8a60d8bc59eddfe0bfbbbefc8054788b2887d75e07b330444f48a7ca874dfcad
MD5 aeac825007c3aeb6708c1cd82af0801e
SHA1 59e78112ebce0ae961ac6525adfffd74cf3e84ac
SHA512 3d033ecb60ea968564a8dd283502bca882b1f9451769fa91d1c5a1be5d2203d0c6ed66dc61ca9e2224790535a9938e219eb2d50e55b79733761015bd18c66c41
SSDEEP 96:pV0d090z0t0V0R0F/0A0F0ft0nB0p0M0N0V0p0B0aB0F0l0p0Sg0c0t0Rb0x0J0s:pOGmQ2OqFcFef26yxWOy6de+yqh2RIK1
TLSH
T146919E33AF8D726507A675F02A8FD1C5A43825E329FD984273B9011632A7EE4D5A32CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktopsession.log

Path C:\Users\Admin\AppData\Local\Temp\desktopsession.log
Size 167B
SHA256 29c03fcf083a497c15122667b8a2800f772e7c2652d8ba8269da0c6d6038f82c
MD5 d7d3875139fbf202d9de95dae75bcade
SHA1 6cf8b1f66d290a49fc8ad4d2b8d898f36a2560e0
SHA512 7affd70e627f30f20bbc3f4dd4b146cdd7b2b8166f654b866951410359c12521fe576d99b5999740b9c235a770f48d64e5a0ac8884ef367c19d8129af9e871bd
TLSH
T168C08C325F8C383833B138E014D98090E038A8A328F878223367030931629E0C05329C
MD5 SHA1 SHA512 TLSH

Submit Download

DesktopSessionSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DesktopSession\DesktopSessionSvc.exe
Size 3.1MB
SHA256 33141849d2e99e652e7e4304c5fea91ed9c8b2b8948e97eb86abda068b083421
MD5 f465c160022f5ea04a0b2ce1e571e84b
SHA1 26b28f7c4f09d962dea18a5054bb5ea309875a86
SHA512 cce18a7449b24957eb0e321803336bb46ed84be00ceccd5ddefdb4688fc518e8bc8ed4244861a4a7e36076f776b7b6b65abfaf87d0dc67d969a00f3a500e9e1b
SSDEEP 49152:WayGtD9w8DKJiDPHbojxtcISlmFMIx7GrUpOjFw63L6dxf34IU6itoy+IKPi:oehm2PctlaWyi3H+N
TLSH
T1CDE55C42BA9B94ECC15AC474C34A4A736E2174CB1726B9FF46D496383F6ABE05B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads