Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe
- Size 709KB
- Sample260808-e96vrahp3v
- SHA256 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd
- MD5 c807246624e9e6d61da0effcbe6c3a95
- SHA1 20827f876cd7a1b83536c32ac957b4d3048f7a0c
- SHA512 3ea404d8f789b4a8aad767b182c606bbae4d315d9aa4dbae70d3f9430fd4d802bb6116505fbfddf6c18754227da736d219c63eb0273b228acc1d5ca1550baa92
- SSDEEP 12288:8qOx8TBvmTL4KbrtKGymYBm4NNbrnSiVs6pHXNomPs+U9jk+:8qOxfT9pymcNNfS3womok+
- TLSH T19CF47BA033C80B5AE2BF0B75E4701588A776F856DFC7EF8F598290A91893781CD54B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncreaseQuotaPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSecurityPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeTakeOwnershipPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeLoadDriverPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemProfilePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemtimePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeProfSingleProcessPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncBasePriorityPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeCreatePagefilePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeBackupPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRestorePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeShutdownPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeDebugPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemEnvironmentPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRemoteShutdownPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeUndockPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeManageVolumePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 33 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 34 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 35 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 36 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncreaseQuotaPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSecurityPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeTakeOwnershipPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeLoadDriverPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemProfilePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemtimePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeProfSingleProcessPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncBasePriorityPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeCreatePagefilePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeBackupPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRestorePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeShutdownPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeDebugPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemEnvironmentPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRemoteShutdownPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeUndockPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeManageVolumePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 33 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 34 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 35 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 36 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncreaseQuotaPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSecurityPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeTakeOwnershipPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeLoadDriverPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemProfilePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemtimePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeProfSingleProcessPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeIncBasePriorityPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeCreatePagefilePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeBackupPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRestorePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeShutdownPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeDebugPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeSystemEnvironmentPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeRemoteShutdownPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeUndockPrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: SeManageVolumePrivilege 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 33 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 34 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 35 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe Token: 36 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4320 wrote to memory of 1660 4320 ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe"C:\Users\Admin\AppData\Local\Temp\ff681433ecfd97b00d9af48707cf443da1ecda7dde8a302cc379ef50fa48c4cd.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query /TN Pavise2⤵PID:1660
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Pavise\Pavise.log
- Size 642B
- SHA256 4a0091d687c0dd3fad77774488187e1013f20bbc363d053b348c5a557513e320
- MD5 ccf947b1145c39c25e39f1525f8fa703
- SHA1 9d8234a23552de03ab43f0d72096b7e244b4ff45
- SHA512 ce69e5e5f2118cc4b97e2529633d5a17ccb6ba1dc15d9490c3e46fddf6eac88c3f8fdfb9ae8402a9f7dd65eb258b074ed7d7e07d5560459e048829d7868bcc7e
- TLSH T1FAF07D144FF705793A02492F0A638E0CA0853B08F318F69BFF299F0E41C0E189AD9E46
- MD5 SHA1 SHA512 TLSH