Overview

overview

10

Static

static

3

pgerpgpell...ml.exe

windows10-2004-x64

10

pgerpgpell...ml.exe

windows11-ltsc_2024-x64

10

Resubmissions

09/08/2026, 03:01

260809-dh7sassybt10

09/08/2026, 02:56

260809-dfbxvage3210

Analysis

  • user interaction
    yes
  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 02:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pgerpgpellpgelpawre.html.exe
  • Size 293KB
  • Sample260809-dfbxvage32
  • SHA256 92988b46aaa066d1128e2c8a66f7a27e34933d060b380cee1b90a2a4cd257b34
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pgerpgpellpgelpawre.html.exe
    "C:\Users\Admin\AppData\Local\Temp\pgerpgpellpgelpawre.html.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /delete /f /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E" & exit
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4428
      • C:\Windows\system32\schtasks.exe
        schtasks /delete /f /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E"
        3⤵
          PID:2664
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 1 /rl highest /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E" /tr "\"C:\Users\Admin\Music\$pwnWindowsHealth.exe\"" & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 1 /rl highest /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E" /tr "\"C:\Users\Admin\Music\$pwnWindowsHealth.exe\""
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3292
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c netsh advfirewall firewall delete rule name="Windows Control" & netsh advfirewall firewall add rule name="Windows Control" dir=in action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes & netsh advfirewall firewall add rule name="Windows Control_out" dir=out action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3100
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall delete rule name="Windows Control"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:3648
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="Windows Control" dir=in action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2224
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="Windows Control_out" dir=out action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2876
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Music" -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pgerpgpellpgelpawre.html.exe" -ErrorAction SilentlyContinue; "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp57DF.tmp.bat""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3836
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:3220
        • C:\Users\Admin\Music\$pwnWindowsHealth.exe
          "C:\Users\Admin\Music\$pwnWindowsHealth.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2796
    • C:\Users\Admin\Music\$pwnWindowsHealth.exe
      "C:\Users\Admin\Music\$pwnWindowsHealth.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
    • C:\Users\Admin\Music\$pwnWindowsHealth.exe
      C:\Users\Admin\Music\$pwnWindowsHealth.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2460
    • C:\Users\Admin\Music\$pwnWindowsHealth.exe
      C:\Users\Admin\Music\$pwnWindowsHealth.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3368
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3704
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4404
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3520
        • C:\Users\Admin\Music\$pwnWindowsHealth.exe
          "C:\Users\Admin\Music\$pwnWindowsHealth.exe"
          2⤵
            PID:1544
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1960
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:584
        • C:\Users\Admin\Music\$pwnWindowsHealth.exe
          C:\Users\Admin\Music\$pwnWindowsHealth.exe
          1⤵
            PID:3388
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:4336

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Windows Command Shell

                  1
                  T1059.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Modify Registry

                  3
                  T1112

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  2
                  T1082

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  $pwnWindowsHealth.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$pwnWindowsHealth.exe.log
                  • Size 425B
                  • SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DiscoverCacheData.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  • Size 1022B
                  • SHA256 b613afcc5012ff926e22716aa8ff569706cda515a151944e73352220f86996e4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  AppCache134307179418272802.txt
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134307179418272802.txt
                  • Size 80KB
                  • SHA256 72f18c71f0fe93c290375149547c8461bf99dd1589a97434e659862f456c06b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_ozl35tks.2zd.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozl35tks.2zd.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  pwn.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\pwn.dll
                  • Size 13KB
                  • SHA256 034ba1de657750175614a6670f006f5bb4ebce820315b4c8cfe2976bbe9d2ba1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmp57DF.tmp.bat
                  • Path C:\Users\Admin\AppData\Local\Temp\tmp57DF.tmp.bat
                  • Size 151B
                  • SHA256 4200f7ac234e4650dd18a071b48b3ca9b9166d04ce5f89102467a0d9ef9ab689
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/560-0-0x000002CF41020000-0x000002CF41070000-memory.dmp
                  Download

                  memory/560-1-0x000002CF5B690000-0x000002CF5B6A0000-memory.dmp
                  Download

                  memory/560-5-0x000002CF41420000-0x000002CF4142A000-memory.dmp
                  Download

                  memory/3176-61-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-67-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-36-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-39-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-38-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-37-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-40-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-41-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-42-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-45-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-44-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-43-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-46-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-47-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-48-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-49-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-50-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-51-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-52-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-53-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-54-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-55-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-56-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-57-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-58-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-60-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-59-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-34-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-63-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-62-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-64-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-65-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-66-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-35-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-68-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-70-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-69-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-71-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-72-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-73-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-75-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-76-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-77-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-74-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-79-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-78-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-80-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-81-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-82-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-83-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-84-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-85-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-87-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-86-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-88-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-89-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-90-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-91-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-92-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-93-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-94-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-96-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/3176-11-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
                  Download

                  memory/3176-95-0x000000000CD10000-0x000000000CD20000-memory.dmp
                  Download

                  memory/4980-20-0x00000248F4680000-0x00000248F46A2000-memory.dmp
                  Download