Overview

overview

7

Static

static

3

toptierperm.exe

windows10-2004-x64

7

toptierperm.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    70s
  • max time network
    76s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 23:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    toptierperm.exe
  • Size 34.1MB
  • Sample260816-3psdmacj6w
  • SHA256 feccb5ae519a678c11b87fa02cadd6ad49e3e601cc55d02012d7f52b969672ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
ransomware

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\toptierperm.exe
    "C:\Users\Admin\AppData\Local\Temp\toptierperm.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2900
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4580
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\TopTierSpooferLogs\spoofer_log_20260817_004216.txt
      1⤵
      • Modifies registry class
      • Opens file in notepad (likely ransom note)
      PID:4116

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Microsoft.Win32.Registry.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\Microsoft.Win32.Registry.dll
          • Size 117KB
          • SHA256 0c6fb02fe3e2fdc9b9e4737586caea80331424cd2806459ea49dd78848647e95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.NonGeneric.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Collections.NonGeneric.dll
          • Size 101KB
          • SHA256 9d9f9e4fd5ff8f56a86d867a54927705fa77d6c3e0ed94c2a52112f3ec4193bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Collections.dll
          • Size 253KB
          • SHA256 0937f7983c191dbb768c51bb9ae90621575c0a2cc3b185d85e31ac2f87001af2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.ComponentModel.Primitives.dll
          • Size 77KB
          • SHA256 7ace9d079c895f11c8afe54e420c8ca3a361e7fd7429b333a629094b08f73432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Console.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Console.dll
          • Size 169KB
          • SHA256 1c1fe3bc8d89607f8fb59b55fefa2a842ae97dcf521ede30fe76637e9fdaa86a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.Process.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Diagnostics.Process.dll
          • Size 329KB
          • SHA256 5e7871e795a2c833fce3b0d02373f672ecdafdaaebd1f459a7e714ac498af428
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.IO.FileSystem.DriveInfo.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.IO.FileSystem.DriveInfo.dll
          • Size 53KB
          • SHA256 f0266b4123ad8e3ae4b15d3b3b1cafe978c7ff1e2a039bdbbbd854c095dc49a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Linq.dll
          • Size 529KB
          • SHA256 ad19451aa60c394640b7bf5950102f948c08b61b1d496e4f10d897449f4b18e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Memory.dll
          • Size 153KB
          • SHA256 fd29c91ec1ae5ec2d98ad77f2863da6d583a3be596a1813959d02877cde057a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 8c01f630bb23c2fb142e6559cdcdf147105625defb36107019d4ab50d8854cd3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Runtime.InteropServices.dll
          • Size 93KB
          • SHA256 570a8140b838042a5d1135d5a20e39d18ccbfce13395c73b0b5bea935d311ea0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Claims.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Security.Claims.dll
          • Size 97KB
          • SHA256 c243e259a9d41bde55e01c1050c6e90a3c845b3ff18f64066f212ebb71bef35e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Principal.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Security.Principal.Windows.dll
          • Size 181KB
          • SHA256 f5f284590e72e565a8de13f7c31abf57defcdb71f32dcbc94152f976115efcca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\System.Threading.dll
          • Size 81KB
          • SHA256 baad7f0d2f3ef9a7b4ed7646093464edddbee0937f33de71be139a01a86375ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          toptierperm.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\toptierperm\n--qfCH0gFtQ\toptierperm.dll
          • Size 729KB
          • SHA256 0bb39743f08af0946ae9a1f779ce5b0808b95b96f455ed637fc873e40dab8a63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spoofer_log_20260817_004216.txt
          • Path C:\Users\Admin\Desktop\TopTierSpooferLogs\spoofer_log_20260817_004216.txt
          • Size 144B
          • SHA256 cc59b7eb4c8a7558544691597df136c7c41883ba049ef94649699de1745c70af
          • MD5 SHA1 SHA512 TLSH
          Submit Download