Analysis
- max time kernel
314s - max time network
315s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/09/2026, 19:44
General
- Target a1ee3d64aaae2a8fbe1c015622a7cf0e842a2ac417df341160163bbe0d1dd652.exe
- Size 75.3MB
- Sample260907-yf9jbsvblf
- SHA256 a1ee3d64aaae2a8fbe1c015622a7cf0e842a2ac417df341160163bbe0d1dd652
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1ee3d64aaae2a8fbe1c015622a7cf0e842a2ac417df341160163bbe0d1dd652.exe"C:\Users\Admin\AppData\Local\Temp\a1ee3d64aaae2a8fbe1c015622a7cf0e842a2ac417df341160163bbe0d1dd652.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\PruvaLauncher-a1ee3d64aaae2a8f.exe"C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\PruvaLauncher-a1ee3d64aaae2a8f.exe" --supervise --config C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\launcher.json2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\versions\a1ee3d64aaae2a8f\PruvaAgent-0.1.6.exe"C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\versions\a1ee3d64aaae2a8f\PruvaAgent-0.1.6.exe" "--state" "C:\Users\Admin\AppData\Local\PruvaDotNet\data\63c5640a82204659\state.json" "--managed-config" "C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\launcher.json" "--health-file" "C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\health.json" "--health-nonce" "a72c836d988064c20c8dfde899f4e19555928dda28ac1569" "--tasks"3⤵
- Adds Run key to start application
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\PruvaLauncher-a1ee3d64aaae2a8f.exe"C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\PruvaLauncher-a1ee3d64aaae2a8f.exe" --supervise --config "C:\Users\Admin\AppData\Local\PruvaDotNet\installations\63c5640a82204659\launcher.json"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
state.json
launcher.json