f3b93c77004295029ca13aeb2880e7f0146a8ceadee0ce9198ce69ebef8a744e

Resubmissions

17/08/2026, 17:20

260817-vwe3wavfrf10

17/08/2026, 15:30

260817-sxt73scc2610

Analysis

max time kernel
299s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
enkD34B.tmp.exe
Size 3.1MB
Sample260817-sxt73scc26
SHA256 f3b93c77004295029ca13aeb2880e7f0146a8ceadee0ce9198ce69ebef8a744e
MD5 0295d8ce8fbda184b344dcfc8c17c305
SHA1 12da3a78f700381cad574eb8d818f324ad8bfdf2
SHA512 dfdca990654f0184c293e48b85ba0dbacfcbe35a2553353a9c051a52983da8b424d08adac2d71e863a97af76e95d87649ae62b631cb1771a1341b120abd31425
SSDEEP 49152:QBAesKrFX1wiWO+QU6h/jwXW/VWK1bkatU7szCtTqoRn:Qecx7EyV7NU7suQo
TLSH
T1BBE5D003E69981E8D55EC17CC7969632EA36B88E0B31B2EF17D40B253E17B909F2D345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3188	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1868	smss.exe
796	msedgewebview2.exe
1704	msedgewebview2.exe
364	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3188	powershell.exe
3188	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1868	4320	enkD34B.tmp.exe	86
PID 4320 wrote to memory of 3188	4320	enkD34B.tmp.exe	88
PID 4320 wrote to memory of 796	4320	enkD34B.tmp.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\enkD34B.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\enkD34B.tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\Temp\smss.exe
  "C:\Windows\Temp\smss.exe"
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdge\*'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\ProgramData\MicrosoftEdge\msedgewebview2.exe
  "C:\ProgramData\MicrosoftEdge\msedgewebview2.exe"
  2⤵
  - Executes dropped EXE
  PID:796

C:\ProgramData\MicrosoftEdge\msedgewebview2.exe
C:\ProgramData\MicrosoftEdge\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:1704

C:\ProgramData\MicrosoftEdge\msedgewebview2.exe
C:\ProgramData\MicrosoftEdge\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedgewebview2.exe

Path C:\ProgramData\MicrosoftEdge\msedgewebview2.exe
Size 632KB
SHA256 4b23a9bccca3879d0a4b75442f2cbef276102b17c28c51674b370fb6d51c6a1b
MD5 053ac43253c6af40fb1af3ee49699f4f
SHA1 a6d94f42cf340d5ca97a3da41c2d6819e3f9628a
SHA512 15dc94d93a7bb669815ce48855614d4290f265e2aee243de7ea4b99cfb478b6ea4512e475df9cd2c65cbf06dd6d847313cb1184e1aebf386a05fd4c3fbba328f
SSDEEP 12288:8I/ZCdMhBsZ5vtJJxM3b5w8KQffZK2sd:Gu2ZRt5MF382U
TLSH
T1E9D47D2696E400ACD0B3E179CE575412F63678070331A9EF339859A31F2B6E89B7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wmw0nxe1.55o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wmw0nxe1.55o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

smss.exe

Path C:\Windows\Temp\smss.exe
Size 1.0MB
SHA256 8b259e08d803f31cc8ecca85a75f5e6fd108bb15420d584afb0adc7958c939a3
MD5 473e81fd42b07fe330d4c844a4605ca1
SHA1 9dc45e3e3bedfe2775e2f82aeb7e415675f8f58c
SHA512 4ca684c249994846ed8179c68f7da592ad6add2fd3c74293973fcf230dc85774b6c25a492e6910a2497515e4cbfb9713fd3e43a2e758c5d34c147e1d072dee20
SSDEEP 96:n8LNtWXKzVGHK3oKO1lwQGIHm6fUHKthRUEWlmw3Q5tfPYx9VIsuEP:nEM6hJoP1lwmxfUHKlUEA3Q5tfAxrT
TLSH
T16635098EF6678CFADE284238CA73458670B6B7281F0277DB4754D0292C677D9A6312CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3188-4-0x00000177703D0000-0x00000177703E0000-memory.dmp

Download

memory/3188-5-0x00000177703D0000-0x00000177703E0000-memory.dmp

Download

memory/3188-12-0x0000017770540000-0x0000017770562000-memory.dmp

Download