a1ed36193b302a76a978ff933cc8ad9a875bd4a25a4240fb7cfca02c81d701e2

Analysis

user interaction
yes
max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenP-v4.2.1.exe
Size 68.3MB
Sample260809-s263fa1bme
SHA256 a1ed36193b302a76a978ff933cc8ad9a875bd4a25a4240fb7cfca02c81d701e2
MD5 aa2fe40831d8e337ad693571c3a91e9d
SHA1 de5f0dd806bad01c1150f99d551d7044cda960e4
SHA512 4d25c77b04845177b0954c6b86a39d51a4e4151f7d76fd028d81a395e76aaf02eee5055043b90366aa5f2f48ed57a147f1734aeb895ab6de7c3f09ea8c2afd22
SSDEEP 1572864:8VdsSCuUAOizL2S05lE5ouNNEV2E5xMHeYR9AwXMzBvYv4x0g6Zbq/zCG:pSsAOuLyEeuNNI2EQ39jXMlAg1Z
TLSH
T1EDF73319A3A042EEED2BE2768957C50BD772B8422373960F5675677A2F33731681E330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Office16\.genp_write_test.tmp	GenP-v4.2.1.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
700	sc.exe
2928	sc.exe
1976	sc.exe
4748	sc.exe
2828	sc.exe
4044	sc.exe
4812	sc.exe
4020	sc.exe
4252	sc.exe
3836	sc.exe
4612	sc.exe
4024	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1732	cmd.exe
2644	cmd.exe
3768	cmd.exe
3308	cmd.exe
1748	cmd.exe
1592	cmd.exe
4756	cmd.exe
3180	cmd.exe
1416	cmd.exe
2112	cmd.exe
1804	cmd.exe
4356	cmd.exe
4768	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe
4824	GenP-v4.2.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4824	GenP-v4.2.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4824	GenP-v4.2.1.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2112	4824	GenP-v4.2.1.exe	86
PID 2112 wrote to memory of 2204	2112	cmd.exe	88
PID 4824 wrote to memory of 1804	4824	GenP-v4.2.1.exe	102
PID 4824 wrote to memory of 1748	4824	GenP-v4.2.1.exe	103
PID 4824 wrote to memory of 4356	4824	GenP-v4.2.1.exe	104
PID 4824 wrote to memory of 1592	4824	GenP-v4.2.1.exe	105
PID 4824 wrote to memory of 4756	4824	GenP-v4.2.1.exe	106
PID 4824 wrote to memory of 4768	4824	GenP-v4.2.1.exe	107
PID 4824 wrote to memory of 3180	4824	GenP-v4.2.1.exe	108
PID 4824 wrote to memory of 1732	4824	GenP-v4.2.1.exe	109
PID 4824 wrote to memory of 2644	4824	GenP-v4.2.1.exe	110
PID 4824 wrote to memory of 3768	4824	GenP-v4.2.1.exe	111
PID 4824 wrote to memory of 1416	4824	GenP-v4.2.1.exe	112
PID 4824 wrote to memory of 3308	4824	GenP-v4.2.1.exe	113
PID 4356 wrote to memory of 4612	4356	cmd.exe	126
PID 1592 wrote to memory of 4024	1592	cmd.exe	127
PID 3768 wrote to memory of 4044	3768	cmd.exe	128
PID 1732 wrote to memory of 4020	1732	cmd.exe	129
PID 1748 wrote to memory of 4812	1748	cmd.exe	130
PID 3180 wrote to memory of 3836	3180	cmd.exe	131
PID 1416 wrote to memory of 4252	1416	cmd.exe	132
PID 4768 wrote to memory of 1976	4768	cmd.exe	133
PID 4756 wrote to memory of 2928	4756	cmd.exe	134
PID 2644 wrote to memory of 700	2644	cmd.exe	135
PID 3308 wrote to memory of 4748	3308	cmd.exe	136
PID 1804 wrote to memory of 2828	1804	cmd.exe	137

C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-v4.2.1.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\certutil.exe
    certutil -store Root mitmproxy
    3⤵
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AGSService" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\sc.exe
    sc stop "AGSService"
    3⤵
    - Launches sc.exe
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AGMService" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\sc.exe
    sc stop "AGMService"
    3⤵
    - Launches sc.exe
    PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AdobeARMservice" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\sc.exe
    sc stop "AdobeARMservice"
    3⤵
    - Launches sc.exe
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AdobeUpdateService" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\sc.exe
    sc stop "AdobeUpdateService"
    3⤵
    - Launches sc.exe
    PID:4024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Adobe LM Service" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\sc.exe
    sc stop "Adobe LM Service"
    3⤵
    - Launches sc.exe
    PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "CCXProcess" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\sc.exe
    sc stop "CCXProcess"
    3⤵
    - Launches sc.exe
    PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AdobeIPCBroker" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\sc.exe
    sc stop "AdobeIPCBroker"
    3⤵
    - Launches sc.exe
    PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "armsvc" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\sc.exe
    sc stop "armsvc"
    3⤵
    - Launches sc.exe
    PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AASIapp" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\sc.exe
    sc stop "AASIapp"
    3⤵
    - Launches sc.exe
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AdobeGenuineUpdater" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\sc.exe
    sc stop "AdobeGenuineUpdater"
    3⤵
    - Launches sc.exe
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "AdobeLicensingService" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\system32\sc.exe
    sc stop "AdobeLicensingService"
    3⤵
    - Launches sc.exe
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "ACCUpdateService" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\sc.exe
    sc stop "ACCUpdateService"
    3⤵
    - Launches sc.exe
    PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 32KB
SHA256 457217b91de99af07460101e521e6996461f792fa9d0620be7bf4ccf6b7872c7
MD5 6889001cd08852fe7214ad903d428792
SHA1 7b3f4e57c9e071d9c93b462915d1118a4e2eaeb4
SHA512 396d56bed0db5e0b6ef8859bb1edf4bf7bdee4cfba012eecc5d6b9e23581866f4cbb26a9e760771c7eacdcf842e5cc374769e78dbfef68383d93382d1ee414f4
SSDEEP 768:5dW2KVpXesOZH46c2GfVy9pOBl08E4M4fKef+VY43PKfF2OT5Kl5U:jKVpXesOZH46c2GfVGgBSD4M4fKef+Vc
TLSH
T103E2A70F99CF1667D1A1BD8E32F2BC931F2EB08DEADA4691538D013D394740562E7D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4824-31-0x0000022432700000-0x0000022432701000-memory.dmp

Download