Overview
overview
8Static
static
1ProcessExplorer.zip
windows10-2004-x64
1ProcessExplorer.zip
windows11-ltsc_2024-x64
1Eula.txt
windows10-2004-x64
1Eula.txt
windows11-ltsc_2024-x64
1procexp.exe
windows10-2004-x64
8procexp.exe
windows11-ltsc_2024-x64
8procexp64.exe
windows10-2004-x64
8procexp64.exe
windows11-ltsc_2024-x64
8procexp64a.exe
windows10-2004-x64
procexp64a.exe
windows11-ltsc_2024-x64
Analysis
- user interaction
yes - max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
ProcessExplorer.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ProcessExplorer.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Eula.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Eula.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
procexp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral6
Sample
procexp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral7
Sample
procexp64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
procexp64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
procexp64a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
procexp64a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target procexp.exe
- Size 4.4MB
- Sample260807-para5aff78
- SHA256 b29917ce089e46bc6238e3e9e20596599bcbe7aa10d4f688bc32db94d6e4dae8
- MD5 661ce61c70ec893d181a7fdd3f18496f
- SHA1 f15551b9b9ff4a998457e3a2c00472f6f1bb4f67
- SHA512 5b7b1c17062a4ab9d4326b85e4388696f944b54c54d82d57d8e63f9e496d738ba5a4b7ec66691ce4e0876f05401633958949217c8291d241be7b247998e4ac88
- SSDEEP 49152:rqOjhazaq04Zb20i3NmUQR/hW1MZwpHEqPwzANNYufOb42c/0eyDhs:rqwOaq04920i3N1ontIObnQT
- TLSH T18426AF41A3E880A1F47716B0997D8336EEF6BC354B7191CF5284FA1E2B32AC15A75723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\V: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\Y: procexp64.exe File opened (read-only) \??\Z: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\R: procexp64.exe File opened (read-only) \??\S: procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\T: procexp64.exe - Executes dropped EXE 1 IoCs
pid Process 4856 procexp64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language procexp.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 procexp64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 procexp64.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4856 procexp64.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4856 procexp64.exe Token: SeBackupPrivilege 4856 procexp64.exe Token: SeSecurityPrivilege 4856 procexp64.exe Token: SeLoadDriverPrivilege 4856 procexp64.exe Token: SeShutdownPrivilege 4856 procexp64.exe Token: SeCreatePagefilePrivilege 4856 procexp64.exe Token: SeShutdownPrivilege 4856 procexp64.exe Token: SeCreatePagefilePrivilege 4856 procexp64.exe Token: SeDebugPrivilege 4856 procexp64.exe Token: SeImpersonatePrivilege 4856 procexp64.exe Token: SeSecurityPrivilege 4856 procexp64.exe Token: SeDebugPrivilege 4856 procexp64.exe Token: SeBackupPrivilege 4856 procexp64.exe Token: SeRestorePrivilege 4856 procexp64.exe Token: SeDebugPrivilege 4856 procexp64.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe 4856 procexp64.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4856 procexp64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3172 wrote to memory of 4856 3172 procexp.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp.exe"C:\Users\Admin\AppData\Local\Temp\procexp.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\AppData\Local\Temp\procexp.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4856
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\procexp64.exe
- Size 2.3MB
- SHA256 8404b6cfad9d998b10d2df6073e1275b7744c0416982bdc5cb7ef5b74348333d
- MD5 21f1e297353ff80d455f3445a1f13c03
- SHA1 71702649523154e6d64cb15cba13ae79c546cb8a
- SHA512 0779dad679f7fae8c2c2af3c6c2643e0b903d04eb410e2ef7336ee69f96298b7b8d69f6a1fc97da386c4d77fd767d74ed62a0e17785b4c0e3dda894ed1e48233
- SSDEEP 24576:zHeD1MZwPHRHEzLuzTCuwQxMAN0uL/guYtkPOe+42chxPe9MoQtF2:rW1MZwpHEqPwzANNYufOb42c/Q
- TLSH T16FB58E4393EC41E5E0779734896A8626FEF27C150B3496DF0245FA1E2F33AC25A76722
- MD5 SHA1 SHA512 SSDEEP TLSH