Overview
overview
8Static
static
1ProcessExplorer.zip
windows10-2004-x64
1ProcessExplorer.zip
windows11-ltsc_2024-x64
1Eula.txt
windows10-2004-x64
1Eula.txt
windows11-ltsc_2024-x64
1procexp.exe
windows10-2004-x64
8procexp.exe
windows11-ltsc_2024-x64
8procexp64.exe
windows10-2004-x64
8procexp64.exe
windows11-ltsc_2024-x64
8procexp64a.exe
windows10-2004-x64
procexp64a.exe
windows11-ltsc_2024-x64
Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
ProcessExplorer.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ProcessExplorer.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Eula.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Eula.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
procexp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral6
Sample
procexp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral7
Sample
procexp64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
procexp64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
procexp64a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
procexp64a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target procexp64.exe
- Size 2.3MB
- Sample260807-para5aff78
- SHA256 8404b6cfad9d998b10d2df6073e1275b7744c0416982bdc5cb7ef5b74348333d
- MD5 21f1e297353ff80d455f3445a1f13c03
- SHA1 71702649523154e6d64cb15cba13ae79c546cb8a
- SHA512 0779dad679f7fae8c2c2af3c6c2643e0b903d04eb410e2ef7336ee69f96298b7b8d69f6a1fc97da386c4d77fd767d74ed62a0e17785b4c0e3dda894ed1e48233
- SSDEEP 24576:zHeD1MZwPHRHEzLuzTCuwQxMAN0uL/guYtkPOe+42chxPe9MoQtF2:rW1MZwpHEqPwzANNYufOb42c/Q
- TLSH T16FB58E4393EC41E5E0779734896A8626FEF27C150B3496DF0245FA1E2F33AC25A76722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\T: procexp64.exe File opened (read-only) \??\V: procexp64.exe File opened (read-only) \??\Y: procexp64.exe File opened (read-only) \??\E: procexp64.exe File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\S: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\Z: procexp64.exe File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\R: procexp64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a procexp64.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2532 procexp64.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2532 procexp64.exe Token: SeBackupPrivilege 2532 procexp64.exe Token: SeSecurityPrivilege 2532 procexp64.exe Token: SeLoadDriverPrivilege 2532 procexp64.exe Token: SeShutdownPrivilege 2532 procexp64.exe Token: SeCreatePagefilePrivilege 2532 procexp64.exe Token: SeShutdownPrivilege 2532 procexp64.exe Token: SeCreatePagefilePrivilege 2532 procexp64.exe Token: SeDebugPrivilege 2532 procexp64.exe Token: SeImpersonatePrivilege 2532 procexp64.exe Token: SeSecurityPrivilege 2532 procexp64.exe Token: SeDebugPrivilege 2532 procexp64.exe Token: SeBackupPrivilege 2532 procexp64.exe Token: SeRestorePrivilege 2532 procexp64.exe Token: SeDebugPrivilege 2532 procexp64.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe 2532 procexp64.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2532 procexp64.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\AppData\Local\Temp\procexp64.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2532
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1