Overview

overview

7

Static

static

3

proext.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/08/2026, 20:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    proext.exe
  • Size 4.5MB
  • Sample260824-yvrbasbr4v
  • SHA256 ca50deea4f55237a440734b7b95cc244a586686c42b5151a007b99ea113735de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoverypersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\proext.exe
    "C:\Users\Admin\AppData\Local\Temp\proext.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3668
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4588
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2104
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:4520
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1936
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
        1⤵
        • Modifies system executable filetype association
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4812
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
          2⤵
            PID:3772
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
              C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
              3⤵
                PID:412

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Size 471B
                • SHA256 a97932dceb13435cf51ac8f61690be728c8ba5ba657317d21073e78fbefd14f3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Size 412B
                • SHA256 bab8b50022ce2be86fca0eb1bd4b9e406110d8e69494ccc305f5b657fa129ad8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                OneDriveSetup.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                • Size 40.2MB
                • SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OneDriveSetup.exe
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                • Size 20.9MB
                • SHA256 ebcd1d48671ba61f32cd3dca2d2d15613f64199d51620ad0b160b399cc4c7aa9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DeviceHealthSummaryConfiguration.ini
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                • Size 77B
                • SHA256 79aafe78c4eaa63cb13d8042d068a4b79e916b19bf26743292119f3975e069ed
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                update100[1].xml
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4RT69VDH\update100[1].xml
                • Size 726B
                • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Default.conf.json
                • Path C:\Users\Admin\Documents\ProExt\Default.conf.json
                • Size 23KB
                • SHA256 f777e0f5fd3ae544a1ad36ba83ceeb8453a71fcb00ceba0d065d28a2258b7745
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1936-84-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-89-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-86-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-85-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-90-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-88-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-87-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-79-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-80-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download

                memory/1936-78-0x0000018E7F350000-0x0000018E7F351000-memory.dmp
                Download