Analysis
- max time kernel
35s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe
- Size 5.3MB
- Sample260813-smdgksbn21
- SHA256 a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1
- MD5 3edb95bbb256b4887454811bf47629d9
- SHA1 03ee628b1bedce6785c05cadf099689e5caf44cd
- SHA512 dc110088fdd71562a92d9e34cc645b90c6e673230b9fcdba5cd8ad91ffd1f011b27ae80b1c9514a93996cdfa2762c94f48bb36e81e393fbaf4f759785621006e
- SSDEEP 98304:WQy4crIKACdOV6wpqmrTm7w/PaSO1pp4+Ru3TW:WQy4crIKACMNqmry2PK1CW
- TLSH T1BE467C217A91D125F4A141B1AA79EBB604687D700BB580C7B2CC3F6F2B716D35A32F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Expiro payload 3 IoCs
resource yara_rule behavioral1/memory/3464-0-0x0000000000986000-0x00000000009E9000-memory.dmp family_expiro1 behavioral1/memory/3464-1-0x0000000000400000-0x00000000009E9000-memory.dmp family_expiro1 behavioral1/memory/3464-2-0x0000000000986000-0x00000000009E9000-memory.dmp family_expiro1 - Executes dropped EXE 8 IoCs
pid Process 4760 elevation_service.exe 5052 elevation_service.exe 1432 maintenanceservice.exe 4688 OSE.EXE 1864 ssh-agent.exe 1768 AgentService.exe 1172 wbengine.exe 3636 TrustedInstaller.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\V: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\E: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\G: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\L: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\N: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\O: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\P: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\U: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\W: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\H: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\I: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\J: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\M: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\S: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\T: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\Y: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\Z: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\Q: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\R: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened (read-only) \??\X: a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe - Drops file in System32 directory 61 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\perfhost.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\dpbennjk.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\fxssvc.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\snmptrap.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\fiabhlfc.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\jkoqeooh.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\aikkcgmk.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\locator.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\spectrum.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\Agentservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\nkehdhde.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\alg.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\openssh\himjnelo.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\WindowsPowerShell\v1.0\cjqbipqb.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\msiexec.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\lsass.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\wbengine.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\svchost.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\dllhost.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\searchindexer.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\Appvclient.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\vssvc.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\gfbmjkkc.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\omicgmij.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\SysWOW64\qhakoooc.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\msdtc.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\vds.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\windows\system32\goklklhd.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe - Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\program files\google\chrome\Application\140.0.7339.81\hcejbjmf.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\flgflbam.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification C:\Program Files\7-Zip\7z.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Program Files\7-Zip\mnclgkoo.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\hicijpke.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\program files\google\chrome\Application\140.0.7339.81\elevation_service.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\program files\common files\microsoft shared\source engine\ljcahhhd.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\program files\windows media player\pjlqfjci.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Program Files\7-Zip\ckjgpiji.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Program Files\7-Zip\bglnccaf.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created \??\c:\program files (x86)\mozilla maintenance service\njjhbmhd.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Program Files\7-Zip\klncjook.tmp a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe File created C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3464 a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3464 a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe 3464 a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe"C:\Users\Admin\AppData\Local\Temp\a5b8aac7dcb57f901bc162a30495cc6bcb3df0415e121c1100bdcc1fc41e04a1.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3464
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4760
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5052
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1432
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4688
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1864
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
PID:1768
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
PID:1172
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3636
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.4MB
- SHA256 ef8281883b06453fff66e3ac5982f53ec7892f9146d929e3d85c3306517b018d
- MD5 450206cd2f2f2b979d30f4ac7273c8c3
- SHA1 a49284a595c46aaab11f6e0916a9c2e39e17642d
- SHA512 213ec671336bf5dcbf864b2288649353d195d14aaec3cc48ab13af0e2d5321a5a40da911934fb72c8aa0f252b272aa3dde141fd4e28f262287ec8165b51d57a9
- SSDEEP 49152:9b+632BuPkFKRrdE6ohtstBhuXjfS4LWxn/NN:D3q66jBGN
- TLSH T148C57C03F29900E9E06ED178C7569136EAA1BC890B34B6DF1790B3552E7BEE45B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 498KB
- SHA256 8198b9899bc771491b57dbd59ad0af8a633709b54aa29bfd4d7dfcae18a3a52a
- MD5 e9f4d6cbd8e0e8f594b8c7bd8029c75d
- SHA1 04b3be97d41132ab0bae08360c331faaa7492494
- SHA512 81554866d32f634c69199e62ef3a9a14f8b738c40acd606b30a084430a570dd9a0c6f8047bc34680f37831e787d555fe2c0f961ccfabfb822e0a76597bd67277
- SSDEEP 12288:91XLsswWkxy2lRq2czA1zYSM8HeWjC3tihH1:zXYfDtczAxTM14CYH
- TLSH T16EB4BE2877D04BF5FC175179CDB58616C261FD810760EBAB0BA88A612F235BC9C3EB58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 477KB
- SHA256 6681dcca255d4f4a9682b48686a08567d3e3f012ab6657aecd9515e7bcc75988
- MD5 a8e69ce1ba5a5f46a34832039d069233
- SHA1 b994b64f3d1a9aa8d4a1ee5f4e3220f8d930b363
- SHA512 8e74112ead7dc561e4f45dcd30d1faee4b7f3d9098243ee9bcea1a2a61403356a1f81287de3dfacc3453e7cd004bdc2eff09f4069add2a5bb79f8d347a907644
- SSDEEP 12288:pmw5HEjsChNjBFgl0WDm+CTY1x8h5Bve16CH:kwuWOW8hfMH
- TLSH T14EA48C4622A40CF8E4A6957D81578332EBB2F8352F6DD31B1260C7475F63291ED2EB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.5MB
- SHA256 60ecfbea1eb5abe90eaee6e4e9eadbbf5cb5ca6ea480012a455257940086f971
- MD5 16ce233f28aab2a42e12f4428f3be44b
- SHA1 4cbfad1b8a3e9bddf7d28a98ca30831193714992
- SHA512 825c538e33e61057727891f78078eb8051b2e9de117f44bae8c75adc87c00248315971591f31d68f67a0cdf0105956a68b9168f0a1ef1e597fde1a236f865089
- SSDEEP 49152:jB+taZ3usBWOBr4tEGE0bqx0z+n217aau1gllLvV:Vu6Jmyxd2dlh
- TLSH T19BC58D13F2D911D8D05AE478974AA233EA62BC490B34B6DF0A9073562E77EE46F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
- Size 658KB
- SHA256 03cbedb52b1abef3acda64d4c7ffa2036a9f72e29e8b2a2f26304482e7f62a78
- MD5 8fdba47f55ade9f726e8a623915cdd1e
- SHA1 918a9e8bde21ea14f076bfcbbd9c77e0cf0441d1
- SHA512 9efda49729bdc1634f3c7e48c9a69d89c8b402ac3b6f315b76f954c5835a99357dcce7477af1114a994b3736f4795038a5a57b981d0eba524bb049f423870458
- SSDEEP 12288:o5rGVcwW2KXzJ4pdd3klnnWosPhnzql+SczALOVO+JH1LSQN7kd3fap:WrZwW2KjJ4Td3kJnbsPhnzqpcMOVO+tY
- TLSH T15CE4BF836FD421F6DC3EC4B1982749610A22BC79EB9057DF59C8B17D09702D09A3EE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 16fbf35535c40f48b7ba9a4ff95ec5bd9a44b09148789f9de30438a229c3226a
- MD5 3d0644167b8ec832dea7e24359145534
- SHA1 681dfc562ec0e57fda7944c3fd78de3e8097242a
- SHA512 a6a2fdf56c1eea21b4407a673a166a676276295faf164144ab93e947aab8fc9b6bd588954257694e24597023978ca99a5ed36e5150d209fb266a7424eb80e98d
- SSDEEP 24576:CoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBb9EzwwXg/bJ1TF8q:Ca0h2GEkuAe73q3ppB6zwwQVL
- TLSH T15E657D1D67DC82B5E0BAD27CC9A6814BE6B2B4160B3166CF5191813D3F37DE84E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 612KB
- SHA256 4face3eb0ca9693cdeb0e9140bab9f19f282ad5bb3069730cdcdb2ba6c31c493
- MD5 2433aeebcd91256521461e4d66cd3e8d
- SHA1 4a1885b4c4178f105c4fd7a403a4cc8f95f49955
- SHA512 1239399407f0e5125bb2b3e6d461475b0012dc2be214681da060263c813cdc0ed90fb17889a3a59729a5b151575aa713e31ad13defcb93e493365073e83c0b94
- SSDEEP 12288:3ObZA4LWOsvAYFT50a2FwIy74blMACkMjvWgMsE7KK:YtL3UTOBFw974BOFe
- TLSH T1DAD4BF19F6A1C0F4ED6391FD89AAC5DAE3B2F46903149E9B03580716DE136E54E3FB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\dpbennjk.tmp
- Size 998KB
- SHA256 ea01918dccac2a883b079a25de5766f91d3fd41820d7011bcc387afd3f127541
- MD5 3a3549bf68ebe8b94e0ecd5715c1e9a8
- SHA1 30a37f6627cfa48a5972b495e1eadb168d5d8bea
- SHA512 15260b771b78445b0d4f31048a244a14589f5d394fa3229d9b81ee9b80a58f6358dc3d34353583b0bf9b1194dd3963663b96c1a2f506af330aace472078d7f7a
- SSDEEP 24576:r1QT7EcpfxR+N5AWAz3ooiYzjMqb0MzHKO:WTDxR+N5YzTljMSzq
- TLSH T1BA258E1EA7F805E6D27EC5799A238512EA73B471077193DB42A4C13E0F2B9D81E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 1.7MB
- SHA256 2630671915c08aa64294179ed20ab8470f63d24dfd7748d0c32edc64d3773282
- MD5 2c746488cfe61632e498d57bebaf8104
- SHA1 ecd1181353dbb60322a5d9d44367ee178d4cb79c
- SHA512 e6be5598df71dd816d3c1bde2d648455b014b78c83bda86a113be052bb68fb0de7399efd3728d21eaec76f489969017dcd513da9fbcff9ee4f0df25ea831edbf
- SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKVIKT3o+M:u0zuNIUM
- TLSH T1FD855A3DA2BC40A8D8AAC375C5451799EA71742E3F2025DB0070C57CBF2AEF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\servicing\TrustedInstaller.exe
- Size 193KB
- SHA256 73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
- MD5 805418acd5280e97074bdadca4d95195
- SHA1 a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6
- SHA512 630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de
- SSDEEP 3072:hi7zaxGadwQ4QabJJCe7y/Wch545uddUSSr1Z22drtSrRZGSDByb:gOvyflbJJCe7GWch5+IS5ZNxSrPGS4b
- TLSH T1AA142A3932AC10E4D9B95278D5624325FFF2B464271261FF42A0827C1F2BBECB97A751
- MD5 SHA1 SHA512 SSDEEP TLSH