e41ff6c5fa373f9c458ba7b49da437c7aebc54b48073c1bb67dbe945dc9e2b80

Analysis

user interaction
yes
max time kernel
69s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
star.exe
Size 6.8MB
Sample260910-h65p3azdnf
SHA256 e41ff6c5fa373f9c458ba7b49da437c7aebc54b48073c1bb67dbe945dc9e2b80
MD5 b79980583d0c6d97606599017fdbb109
SHA1 285b72409ef1f346a26b5097e6dfe7452032dd80
SHA512 13f557e6c0b96bd2357808cc4b915886d15adf779bd01d49514d05f245e5c737fd9aa8e0835e25f99143ccb1efcac4836467338765c525f2e4bcada6b38fbadc
SSDEEP 196608:u+PRg4P31WEdRHzQm/lqpN+TxLOH9eQa/4miz:ujEdRTRShde
TLSH
T1CE76239E614C3758C81AC5B89433AC4972BA531D8BE999AF71CBFFC037DB910D602B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1164-6-0x00007FF6AC090000-0x00007FF6ACEA2000-memory.dmp	vmprotect
behavioral1/memory/1164-116-0x00007FF6AC090000-0x00007FF6ACEA2000-memory.dmp	vmprotect

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	star.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe
1164	star.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	star.exe
Token: SeDebugPrivilege	1164	star.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1164	star.exe
1164	star.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1164	star.exe
1164	star.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1164	star.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2812	1164	star.exe	86
PID 2812 wrote to memory of 2076	2812	msedgewebview2.exe	87
PID 2812 wrote to memory of 4204	2812	msedgewebview2.exe	89
PID 2812 wrote to memory of 4204	2812	msedgewebview2.exe	89
PID 2812 wrote to memory of 4204	2812	msedgewebview2.exe	89
PID 2812 wrote to memory of 5060	2812	msedgewebview2.exe	90
PID 2812 wrote to memory of 1812	2812	msedgewebview2.exe	91
PID 2812 wrote to memory of 1812	2812	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\star.exe
"C:\Users\Admin\AppData\Local\Temp\star.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=star.exe --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1164.3832.16317748117476431078
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdc83db078,0x7ffdc83db084,0x7ffdc83db090
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --webview-exe-name=star.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,4233331871105075444,7471549022892667927,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --webview-exe-name=star.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,4233331871105075444,7471549022892667927,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --webview-exe-name=star.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,4233331871105075444,7471549022892667927,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
    3⤵
    PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 21eebf345ba1a782709e9a15a850fc46e7baa51e528765a105470966c1a5346d
MD5 fe38328393a0fdc5c9dcee49f0244b25
SHA1 294535244caf997c342565eb2aa413f60f22eb70
SHA512 39b38e5ba90082a78197a11a43bf1b3c79c1f14650d8b97dd61961e732d046ae147762ffcb56e7f6094b481d59e6455c4ba2858d25c0be69694f0879fa7a33ee
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State
Size 2KB
SHA256 8a530323ace251a531d4e29778736b8bf2c9cf1edf0cbf1240f0366e6789da8c
MD5 606f1a771986476dbfe63ae3d272b77a
SHA1 31d1d029fb389a27ad64080c3a7d2125ab83d0af
SHA512 2ce4cb09c89052001f282081d5e0069929d1da7c504ae9c657b6c6a0c65dc8cf0eee37b9930fc553c1e5183e89454682a6de7c94a6828fb057086baed616ca7b
TLSH
T1DB51A733B844BB374AE387497A462F13AE356176AAA22F54D5ED0B0C01DF65C2356C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 e599b4a85a54e8a4aef7b59e8d743bac461c915a9adab9664c36a8577acea0a3
MD5 c09f32529109f8e1b2710ba717ee0c61
SHA1 8eee7e8b9f7ee56a2e7b0e35ed14abe83f6ba8fb
SHA512 c63b358c0592b6a36942ed0885114837ba538e8c8379ae499fbf03435187dcaf1d47bb2695bb356d00dd8601e81e07f977ef51755837cfec03fdc7535706904c
TLSH
T1B5718526A964BA374EE3DA49B9862B06BA616137E5D13F98D9EC0F0C01DF78C1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 dce90b8cf221d0284db422951d452ed91fb2779d0a0883a94109ec77e87fbc45
MD5 3591f163b99aef84304918f6ecd720d7
SHA1 1b61b7958e242fc5f9b176d9a686d056f9b6c6c4
SHA512 b5a4583e5d322452ad80018895e44ae5b5962c8f59ad1437aa59531a4486209e2d952c787a2e127ad4d579b7a8f491261bf0e0efdfda528abacee1c52f473c7c
TLSH
T138719622A864FA374EE3DA49B9822B06BA616137E5D13F58D9EC0F0C01DF38C1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585e86.TMP

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State~RFe585e86.TMP
Size 1KB
SHA256 59e5ea13ef08e83e60af197566b97960468cd750112e73183caf22fad2ef5a04
MD5 076a3cf539677a3b4a6e184445d5d6d6
SHA1 411463b836ef764944dd7e80cce7e9f4790d51ca
SHA512 e0d88e5c7addc0e3dd1a0c1f14f257f587cf4b3e9c0bf6f467328ea2e1cb331961978bf6825ebb76760b42a70cb748ca1980f92bcb09bccaa0b1caf468e7cb07
TLSH
T10D216532E4847B336ED3968AB7126B473E106137A2514E0CE0ED461D16DF98C967BC33
MD5 SHA1 SHA512 TLSH

Submit Download

da1594ff-4b2e-40bf-b660-89bc16933f43.tmp

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\da1594ff-4b2e-40bf-b660-89bc16933f43.tmp
Size 1KB
SHA256 4c8157a8c7acd0c557ce7dce74736e2e800f724af87819b4a3b218609069cd6f
MD5 24568ad93e4ce820712b7ce42f0a715d
SHA1 ff7f640c1f5db9e7fd1d37b45e8bec254ad9f872
SHA512 9dc81321e97a3ae52e2788d0fa498fd25eb45fb092f505adc30c5acbc94636932a84dfdf78286c66e13d134052bd2d43b55ed0b3dafd5f0f1f809c68c2b98700
TLSH
T1E0318732E4907B336ED3938A77126A476E203137E2914E08E0ED4B1C16EF58C966AD23
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1164-116-0x00007FF6AC090000-0x00007FF6ACEA2000-memory.dmp

Download

memory/1164-13-0x00007FF6AC44E000-0x00007FF6AC7CF000-memory.dmp

Download

memory/1164-0-0x00007FF6AC44E000-0x00007FF6AC7CF000-memory.dmp

Download

memory/1164-6-0x00007FF6AC090000-0x00007FF6ACEA2000-memory.dmp

Download

memory/1164-1-0x00007FFDE49B0000-0x00007FFDE49B2000-memory.dmp

Download

memory/1812-76-0x00007FFDE3850000-0x00007FFDE3851000-memory.dmp

Download

memory/1812-75-0x00007FFDE2A70000-0x00007FFDE2A71000-memory.dmp

Download

memory/4204-115-0x0000027F39930000-0x0000027F399DD000-memory.dmp

Download

memory/4204-33-0x00007FFDE2A70000-0x00007FFDE2A71000-memory.dmp

Download