6fe29bdaab15baa7ae028e5b80c65a64fe74f50d7503e8ee507a852cd5758231

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SetupSenorClutch.exe
Size 571KB
Sample260811-yfa1rsxtfx
SHA256 6fe29bdaab15baa7ae028e5b80c65a64fe74f50d7503e8ee507a852cd5758231
MD5 080b78591e9024c70b814656b970459a
SHA1 15f008251cfb03ba51ae4515025d7c362a6464fe
SHA512 6a9c7d23f3b562a84ae92ee9490256b20a4937d0697babe0564f69f570f9731e1066e3e341a181620dc586f192dbbaf71a3b265098562955cd5d1baf7b8b00d0
SSDEEP 12288:ko90SPspiUEfWqN9g3voJ6RerAtSLsfieo:19spXBu9ggJqt6sfXo
TLSH
T1A0C4238526E246E2E0EE1F7990369392131B7E819A71F3854EDE307B2F319CA51D9F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5156	powershell.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5156	powershell.exe
5156	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5156	powershell.exe
Token: SeIncreaseQuotaPrivilege	5156	powershell.exe
Token: SeSecurityPrivilege	5156	powershell.exe
Token: SeTakeOwnershipPrivilege	5156	powershell.exe
Token: SeLoadDriverPrivilege	5156	powershell.exe
Token: SeSystemProfilePrivilege	5156	powershell.exe
Token: SeSystemtimePrivilege	5156	powershell.exe
Token: SeProfSingleProcessPrivilege	5156	powershell.exe
Token: SeIncBasePriorityPrivilege	5156	powershell.exe
Token: SeCreatePagefilePrivilege	5156	powershell.exe
Token: SeBackupPrivilege	5156	powershell.exe
Token: SeRestorePrivilege	5156	powershell.exe
Token: SeShutdownPrivilege	5156	powershell.exe
Token: SeDebugPrivilege	5156	powershell.exe
Token: SeSystemEnvironmentPrivilege	5156	powershell.exe
Token: SeRemoteShutdownPrivilege	5156	powershell.exe
Token: SeUndockPrivilege	5156	powershell.exe
Token: SeManageVolumePrivilege	5156	powershell.exe
Token: 33	5156	powershell.exe
Token: 34	5156	powershell.exe
Token: 35	5156	powershell.exe
Token: 36	5156	powershell.exe
Token: SeIncreaseQuotaPrivilege	5156	powershell.exe
Token: SeSecurityPrivilege	5156	powershell.exe
Token: SeTakeOwnershipPrivilege	5156	powershell.exe
Token: SeLoadDriverPrivilege	5156	powershell.exe
Token: SeSystemProfilePrivilege	5156	powershell.exe
Token: SeSystemtimePrivilege	5156	powershell.exe
Token: SeProfSingleProcessPrivilege	5156	powershell.exe
Token: SeIncBasePriorityPrivilege	5156	powershell.exe
Token: SeCreatePagefilePrivilege	5156	powershell.exe
Token: SeBackupPrivilege	5156	powershell.exe
Token: SeRestorePrivilege	5156	powershell.exe
Token: SeShutdownPrivilege	5156	powershell.exe
Token: SeDebugPrivilege	5156	powershell.exe
Token: SeSystemEnvironmentPrivilege	5156	powershell.exe
Token: SeRemoteShutdownPrivilege	5156	powershell.exe
Token: SeUndockPrivilege	5156	powershell.exe
Token: SeManageVolumePrivilege	5156	powershell.exe
Token: 33	5156	powershell.exe
Token: 34	5156	powershell.exe
Token: 35	5156	powershell.exe
Token: 36	5156	powershell.exe
Token: SeIncreaseQuotaPrivilege	5156	powershell.exe
Token: SeSecurityPrivilege	5156	powershell.exe
Token: SeTakeOwnershipPrivilege	5156	powershell.exe
Token: SeLoadDriverPrivilege	5156	powershell.exe
Token: SeSystemProfilePrivilege	5156	powershell.exe
Token: SeSystemtimePrivilege	5156	powershell.exe
Token: SeProfSingleProcessPrivilege	5156	powershell.exe
Token: SeIncBasePriorityPrivilege	5156	powershell.exe
Token: SeCreatePagefilePrivilege	5156	powershell.exe
Token: SeBackupPrivilege	5156	powershell.exe
Token: SeRestorePrivilege	5156	powershell.exe
Token: SeShutdownPrivilege	5156	powershell.exe
Token: SeDebugPrivilege	5156	powershell.exe
Token: SeSystemEnvironmentPrivilege	5156	powershell.exe
Token: SeRemoteShutdownPrivilege	5156	powershell.exe
Token: SeUndockPrivilege	5156	powershell.exe
Token: SeManageVolumePrivilege	5156	powershell.exe
Token: 33	5156	powershell.exe
Token: 34	5156	powershell.exe
Token: 35	5156	powershell.exe
Token: 36	5156	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 5156	5960	SetupSenorClutch.exe	89

C:\Users\Admin\AppData\Local\Temp\SetupSenorClutch.exe
"C:\Users\Admin\AppData\Local\Temp\SetupSenorClutch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -NoLogo -File "C:\Users\Admin\AppData\Local\Temp\SenorClutch-setup-5960\Install-SenorClutch.ps1" -Elevated
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install-SenorClutch.ps1

Path C:\Users\Admin\AppData\Local\Temp\SenorClutch-setup-5960\Install-SenorClutch.ps1
Size 19KB
SHA256 212e3413b5cff8536e216efa007a9d4ab126c29627570be671768be6ccee3c43
MD5 427c2bd0346fb37ce8594f671869fbff
SHA1 ec6501a8ac72193029e7d90dc3fd4b34ef696053
SHA512 ba13b529515c41b250ecaae5f5c78eedea18c233df23631a5e3288e9036b04e6e8883a1d824bb8da209def1c2ec373e176915a8a0bf93f59ba8cdcf00a693544
SSDEEP 384:YbWUXFiGXdYDjhOPEQClFioriZURFLjtAVwgO6O:YrXFiGtetkoriZURFXtWwgO6O
TLSH
T1FB92E42BAE44533729B1C362964EA6DAF707807F42704264725EA4093F3317E473F9E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_common.ps1

Path C:\Users\Admin\AppData\Local\Temp\SenorClutch-setup-5960\_common.ps1
Size 32KB
SHA256 0561c9916bc9e9e333fc4223ea946b236330ea3860148cb89db70e11fc1d266a
MD5 910f2d13c69c3656260e7b773f9548e3
SHA1 482af396120e8cda0862ad3ff90d718450e1abe6
SHA512 48b75d71884d30437eda3f7cedf26bfd7ec91875c809cf48e195ba27eef9d61f5733f74a96d80bccb15166e4f40dfe27f1771a0de232c99ed1a76f7c0a9498b6
SSDEEP 768:kBNE8Jc0J5BaMNjrRIY/861cnHgJAAmajW/uj:ko8zwY/861cnl3ajeuj
TLSH
T112E2B6137E0552361672D7B69B8BF198FB2A803B42264310B5DEC1883F7156DC27EEDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5156-38-0x000002545F3C0000-0x000002545F3DE000-memory.dmp

Download

memory/5156-44-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-51-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-50-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-30-0x000002545F310000-0x000002545F332000-memory.dmp

Download

memory/5156-49-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-46-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-40-0x000002545F3A0000-0x000002545F3AA000-memory.dmp

Download

memory/5156-39-0x000002545F640000-0x000002545F6F2000-memory.dmp

Download

memory/5156-35-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-45-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-34-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-33-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5156-42-0x000002545F850000-0x000002545F874000-memory.dmp

Download

memory/5156-41-0x000002545F850000-0x000002545F87A000-memory.dmp

Download

memory/5156-43-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5960-0-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/5960-1-0x00007FF908AEF000-0x00007FF908AF0000-memory.dmp

Download

memory/5960-3-0x00000000025D0000-0x00000000025DA000-memory.dmp

Download

memory/5960-47-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5960-2-0x00000000025F0000-0x0000000002602000-memory.dmp

Download

memory/5960-27-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/5960-26-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download