9b63507e006bc687b4541e5a10b7b141a258e891f549aa264f56c322a5cc92d0

Analysis

max time kernel
39s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
info.exe
Size 350KB
Sample260821-c2zelafk3v
SHA256 9b63507e006bc687b4541e5a10b7b141a258e891f549aa264f56c322a5cc92d0
MD5 c532f1f40ee761df98a19d84ff5a9824
SHA1 b2dc5e00275d92de6e2328253f61024a979208fb
SHA512 374d3a8456ac9ad9aef84f88fad59269875555cff2bbb38d28e8590461d8c04785bdd5f5b994a6819689aceedc9a234a5fb993c7a406299ff0aed876fd907972
SSDEEP 6144:OC0p9gsgD3N2CzE7sIo4OYyEvhN1AcdyLKUlMohr3sZ:Fcq3/E7s9NYyEvxAbmUlMo
TLSH
T131747E1AF7A504F9D177D138C8520905EB72BC5647A09BDF23E40AA62F237E09E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4952	powershell.exe
4952	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	2832	info.exe

Executes dropped EXE 3 IoCs

pid	Process
2124	Network.exe
2144	BridgeAgent.exe
3848	BridgeAgent.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2932	reg.exe
4396	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe
Token: SeManageVolumePrivilege	4952	powershell.exe
Token: 33	4952	powershell.exe
Token: 34	4952	powershell.exe
Token: 35	4952	powershell.exe
Token: 36	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe
Token: SeManageVolumePrivilege	4952	powershell.exe
Token: 33	4952	powershell.exe
Token: 34	4952	powershell.exe
Token: 35	4952	powershell.exe
Token: 36	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe
Token: SeManageVolumePrivilege	4952	powershell.exe
Token: 33	4952	powershell.exe
Token: 34	4952	powershell.exe
Token: 35	4952	powershell.exe
Token: 36	4952	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4952	2832	info.exe	89
PID 2832 wrote to memory of 2124	2832	info.exe	92
PID 2124 wrote to memory of 2932	2124	Network.exe	93
PID 2124 wrote to memory of 2144	2124	Network.exe	95
PID 2144 wrote to memory of 4396	2144	BridgeAgent.exe	96
PID 2144 wrote to memory of 3848	2144	BridgeAgent.exe	98

C:\Users\Admin\AppData\Local\Temp\info.exe
"C:\Users\Admin\AppData\Local\Temp\info.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'; Add-MpPreference -ExclusionPath 'C:\ProgramData'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ie'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Users\Admin\AppData\Local\ie\downloads\Network.exe
  "C:\Users\Admin\AppData\Local\ie\downloads\Network.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2932
- - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
    "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4396
  - - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
      "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 2144
      4⤵
      Executes dropped EXE
      PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 c9268a0cf25b47191b71f44f9cbd505bc7dfcbfe8b7edd2578cb20def46b55a5
MD5 26bd9cec3b7ee02369b5cc90d64c371e
SHA1 16f0836283f04e2d173daac7a2e0d208ca176267
SHA512 6f3ad42baa535175571f536dbbdea5fef1da66ec0c8364c53bf5be2692692a16841ad39bc8836665c8f929c3382646625c3584884ea90a4931318ef9b544510f
TLSH
T11051492C85FC453A0D47C22EE92B8ED6F535B67EAB459E407B26914891C3D0EDD89212
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 46ba36bfaf95513f731338ac9d13a101c4eabcc41f152decb71cccbb995c14e8
MD5 c10463debf4e6467034b8861b3e2ed8c
SHA1 a34d254acbba9755902a3d54fba16987ea59ea37
SHA512 df0afcc6f8342d1bdef6c00e4b68df5128b331acdf61cde2e50d4c80e13430cddc06d24308005f0aab4912bf69d6f3f6c84f729017cc63c3ea76923a89d9f1d0
TLSH
T13D516A2C91FC453B0D43832FD55B8EE6F531B63EAB469E407B26954891D3C0EED8A223
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 932B
SHA256 67d03fabdf6785484792a7dd247c766a0fdf0850d7b572e1c9fbead6add2459b
MD5 692a4b8daca11e1a7fcea654fa745a0e
SHA1 c3cb451c40c118a5b9840ce7648ca35b48eaa259
SHA512 39762976a447e1011d9e914e5bd168e9541fa2a99273c5635ab58185660237b9532b99ed504181199f64870c3c6507a9dd857b96aeca68b003018fbcc037a872
TLSH
T16F112B2840FC853A0D07C22FD96BDED9E071753DAB869B00B77681485293D0ED9CA213
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 881499d6b17f520a36d477ae71d02402ce5ebdc4333d4f34955b5c743b45bd4c
MD5 5c6bb48d4a71c5fbb4aa7984ee157036
SHA1 f54fa064a9b037cc025eb74dae7d2ecafce69523
SHA512 8c6b0f365ea96849eaac55e8b5db558053a1f67c26869ce7ab4f99f5bcb1449627296b2b73da29c885380416925900e129421ca06e03793804c701adffbc8885
TLSH
T16F31282880FC853A0D47C22EE96FCEE5F171B53DAB869E00776695449293D0ED9CA216
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 17b8cb8c9ae177213485220522a6f8ff87639d4e952bae4a38cd0abd97f483a6
MD5 612bae93cf87336beeb2e0f5857a1646
SHA1 4fe309119e75c992556a09b92f7370c9a5685288
SHA512 d05532d8e926f976cd321edcaff4f97f0ccfdffb01af75236c281ce82c162a0d818cb8f886ebebbbeed51d7b84efa89814c275a384053ca1aa5652916fcb6d85
TLSH
T106B01451D75745D4D5551DD351745D41415F44DDDD5547317D54C4C45155435D14300C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 117B
SHA256 4d5f1c299bf4c6fad368ee6ee77f249e6f1caac03a0514afa8d05789074b0f99
MD5 c6df0d075a0e6adef32b6be01e779368
SHA1 f0ad24c34b26e1936d0e2a7bc6ad74813d9f7c58
SHA512 34f2ab91cf804815747f28cd94d8deba0c81861ec478b4fa78b2ae68128cd24c3b871d9e6d838adfacc429d4dbf5845cceef960caa8ac43716057951d957d1c1
TLSH
T118B01252E36B8BF8D8D825F292B46F02C14F409DED658F21BE18C4C48416439E14300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 e36d8de6e12bcc2d20b66fb4f6e6b03bbe99e4bf53e64f8d868f78b67139a151
MD5 65b05324b31545391220d16637af711c
SHA1 96ceb5433e60eaa42f8fa4c5fd6a7b5901e3a559
SHA512 e197c6b23d7480929a2362ff16555c6237abb455d4fcd23a55c684802c480310d567d04d30456eccf5497b7147dbac82d11afd4a3ba556f6f4268adaa699642c
TLSH
T123B01252E76B4AE8E89916E362B4AD82814F84EDEDADC731BE98C484915A539E24300C
MD5 SHA1 SHA512 TLSH

Submit Download

Network.exe

Path C:\Users\Admin\AppData\Local\ie\downloads\Network.exe
Size 5.8MB
SHA256 e069ae9db2ddfa5eac643962b02c3a81c163f4bf46e2a9888520f0cebf5e3a37
MD5 082f864f9d77807b2de99583ca7332dd
SHA1 631668b574cd6b3a5fb62c0d2dfa40a9e30609be
SHA512 a46a901aa1c941c06dc16234c894d051986f15e39e0ba5a4a9d7201aed81498fc8b7730c00121cefb916a197dd35fe79beb5fdf223fcfef1bf324046f055e8ff
SSDEEP 49152:n0iEPoOCAqwy12sM05j9XQ2thQy/Z0ymc4ggu6a0WaBUFqxPvMNsg6/bHLDM/DHo:17x7xxtx0JFxUscR5vmEqkbeOohgOQ6
TLSH
T1AF564B55BA6B94ACD197C47483468A639E2130DF0B36BAFF418485383F6ABF11B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4952-39-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-51-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-43-0x00000178D8520000-0x00000178D85D2000-memory.dmp

Download

memory/4952-45-0x00000178D8270000-0x00000178D827A000-memory.dmp

Download

memory/4952-46-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-47-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-48-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-49-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-50-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-44-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-52-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-54-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-42-0x00000178D8250000-0x00000178D826E000-memory.dmp

Download

memory/4952-30-0x00007FFC3A19F000-0x00007FFC3A1A0000-memory.dmp

Download

memory/4952-38-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-37-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-36-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-35-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download

memory/4952-34-0x00000178D8070000-0x00000178D8092000-memory.dmp

Download

memory/4952-31-0x00007FFC3A010000-0x00007FFC3A9B4000-memory.dmp

Download