Overview
overview
8Static
static
1ProcessExplorer.zip
windows10-2004-x64
1ProcessExplorer.zip
windows11-ltsc_2024-x64
1Eula.txt
windows10-2004-x64
1Eula.txt
windows11-ltsc_2024-x64
1procexp.exe
windows10-2004-x64
8procexp.exe
windows11-ltsc_2024-x64
8procexp64.exe
windows10-2004-x64
8procexp64.exe
windows11-ltsc_2024-x64
8procexp64a.exe
windows10-2004-x64
procexp64a.exe
windows11-ltsc_2024-x64
Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
ProcessExplorer.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ProcessExplorer.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Eula.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Eula.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
procexp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral6
Sample
procexp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral7
Sample
procexp64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral8
Sample
procexp64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
procexp64a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
procexp64a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target procexp64.exe
- Size 2.3MB
- Sample260807-para5aff78
- SHA256 8404b6cfad9d998b10d2df6073e1275b7744c0416982bdc5cb7ef5b74348333d
- MD5 21f1e297353ff80d455f3445a1f13c03
- SHA1 71702649523154e6d64cb15cba13ae79c546cb8a
- SHA512 0779dad679f7fae8c2c2af3c6c2643e0b903d04eb410e2ef7336ee69f96298b7b8d69f6a1fc97da386c4d77fd767d74ed62a0e17785b4c0e3dda894ed1e48233
- SSDEEP 24576:zHeD1MZwPHRHEzLuzTCuwQxMAN0uL/guYtkPOe+42chxPe9MoQtF2:rW1MZwpHEqPwzANNYufOb42c/Q
- TLSH T16FB58E4393EC41E5E0779734896A8626FEF27C150B3496DF0245FA1E2F33AC25A76722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\V: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\Y: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\R: procexp64.exe File opened (read-only) \??\T: procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\D: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\S: procexp64.exe File opened (read-only) \??\Z: procexp64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4116 procexp64.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4116 procexp64.exe Token: SeBackupPrivilege 4116 procexp64.exe Token: SeSecurityPrivilege 4116 procexp64.exe Token: SeLoadDriverPrivilege 4116 procexp64.exe Token: SeShutdownPrivilege 4116 procexp64.exe Token: SeCreatePagefilePrivilege 4116 procexp64.exe Token: SeShutdownPrivilege 4116 procexp64.exe Token: SeCreatePagefilePrivilege 4116 procexp64.exe Token: SeDebugPrivilege 4116 procexp64.exe Token: SeImpersonatePrivilege 4116 procexp64.exe Token: SeSecurityPrivilege 4116 procexp64.exe Token: SeDebugPrivilege 4116 procexp64.exe Token: SeBackupPrivilege 4116 procexp64.exe Token: SeRestorePrivilege 4116 procexp64.exe Token: SeDebugPrivilege 4116 procexp64.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe 4116 procexp64.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4116 procexp64.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\AppData\Local\Temp\procexp64.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4116
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1