e41ff6c5fa373f9c458ba7b49da437c7aebc54b48073c1bb67dbe945dc9e2b80

Analysis

user interaction
yes
max time kernel
70s
max time network
71s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
star.exe
Size 6.8MB
Sample260910-h65p3azdnf
SHA256 e41ff6c5fa373f9c458ba7b49da437c7aebc54b48073c1bb67dbe945dc9e2b80
MD5 b79980583d0c6d97606599017fdbb109
SHA1 285b72409ef1f346a26b5097e6dfe7452032dd80
SHA512 13f557e6c0b96bd2357808cc4b915886d15adf779bd01d49514d05f245e5c737fd9aa8e0835e25f99143ccb1efcac4836467338765c525f2e4bcada6b38fbadc
SSDEEP 196608:u+PRg4P31WEdRHzQm/lqpN+TxLOH9eQa/4miz:ujEdRTRShde
TLSH
T1CE76239E614C3758C81AC5B89433AC4972BA531D8BE999AF71CBFFC037DB910D602B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1324-2-0x00007FF734CD0000-0x00007FF735AE2000-memory.dmp	vmprotect
behavioral2/memory/1324-6-0x00007FF734CD0000-0x00007FF735AE2000-memory.dmp	vmprotect
behavioral2/memory/1324-41-0x00007FF734CD0000-0x00007FF735AE2000-memory.dmp	vmprotect

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	star.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe
1324	star.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	star.exe
Token: SeDebugPrivilege	1324	star.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1324	star.exe
1324	star.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1324	star.exe
1324	star.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1324	star.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5316	1324	star.exe	90
PID 5316 wrote to memory of 4484	5316	msedgewebview2.exe	91
PID 5316 wrote to memory of 3240	5316	msedgewebview2.exe	94
PID 5316 wrote to memory of 3240	5316	msedgewebview2.exe	94
PID 5316 wrote to memory of 3240	5316	msedgewebview2.exe	94
PID 5316 wrote to memory of 3240	5316	msedgewebview2.exe	94
PID 5316 wrote to memory of 4860	5316	msedgewebview2.exe	95
PID 5316 wrote to memory of 2324	5316	msedgewebview2.exe	96
PID 5316 wrote to memory of 2324	5316	msedgewebview2.exe	96
PID 5316 wrote to memory of 2324	5316	msedgewebview2.exe	96

C:\Users\Admin\AppData\Local\Temp\star.exe
"C:\Users\Admin\AppData\Local\Temp\star.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=star.exe --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1324.3460.11412166121028701998 /pfhostedapp:f529d5811af18ba1a346afd261a0c334a3b07d72
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView /prefetch:4 /pfhostedapp:f529d5811af18ba1a346afd261a0c334a3b07d72 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9cf355fd8,0x7ff9cf355fe4,0x7ff9cf355ff0
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --webview-exe-name=star.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,4720669028619593579,15589980291765020752,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:f529d5811af18ba1a346afd261a0c334a3b07d72
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --webview-exe-name=star.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1756,i,4720669028619593579,15589980291765020752,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:f529d5811af18ba1a346afd261a0c334a3b07d72
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView" --webview-exe-name=star.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2448 --field-trial-handle=1756,i,4720669028619593579,15589980291765020752,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:f529d5811af18ba1a346afd261a0c334a3b07d72
    3⤵
    PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1885dd98a33315d935e88cdc4d2c3ec71cf92d807be0c857ea27b27450a7d73b
MD5 54d2756512bc7fe6a359e2e853b90c31
SHA1 71e12eb7f04b34639d711c81403317a75737f929
SHA512 3c7daa13883e6cdf3a186947baa0e4fd68afb0f25cb7fc103a0b6b3235e2efc7580599944c206117ff4cb4d14e380891d7b1320621d489c7879c57da7fd068ec
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d79ad0741a54e161033ed8c093fcb6f6ef907750fa2fa42aa49cd8d36b6b5fef
MD5 9ccf191c6625ed61ec0f4f376fa0ed6f
SHA1 0756ea96e181535bf3ef90100a197b86bef575d7
SHA512 301d9d987ce5c43aaa141d0d71c12703d98389f92da21e422375d5db9e093601ac1d7db894598aab7d98218f01ba8054f9aeeb81635518af5660b08ed00812e6
TLSH
T113D0122733110238C0102833102271090404CA0B43454100942CC51D6B044A01917891
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State
Size 2KB
SHA256 e9c6076f0020fb9153a2a5e84ad05fd5a356b52852a8d2bc1fa0119b2d4c1488
MD5 77f787dde1a55d0a52e87775320dc084
SHA1 065169d5234502ac5242be7304c5d99937ae9b48
SHA512 ac6b07f5916e73e450bef15d10b161e06c33920d6ecb4c34c1ab85a2003e97f0a21926a4eacdc21807f6317905b05e9a239793d48eba8b985424f87868ac6928
TLSH
T1B051447368256B37D9E3C7487A467F238E35A1A2AF625F50A6DC1B0D009B95C1342C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 e74ccf31298ae60739da46d3ae7e23a37703cfd98d9175b483a144b86582d8a6
MD5 865b26b9964280fcf9f553df1c92424b
SHA1 ddefce6ce764e7d586df2f32db2c7890fa9b565a
SHA512 679663609db35ba6b48949164646aafb24e3adcb4efdb823ef0053601788c1abfc48b69c65ce5af4c298bb3349dd04984417b2559ca3222c8cc5364c0dba0e58
TLSH
T1AD6184376975BA378DE3C608B9823B13AA649123EA957F94D5EC0F0D01D768C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 9e34ed56aba410e983094358a6654cf780e0777b4cebba740fde6d340f4ef58a
MD5 b7cfbf0e133ce68cc0c284f2d8903351
SHA1 ecace229bf2ecdb9621ca4248f50c70c71a080e1
SHA512 9e2be1cb78b34075ba731d21d299afa8157959ce5feaafcda585e85cf367389deb7e03366146b80a6dc40fdf75554b7f3603d51cf0496b8c0f83049d33a5167d
TLSH
T1356185376975AA378DE3C708B9863B17AB659123EA953FA4D6EC0F0D01D768C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5904d8.TMP

Path C:\Users\Admin\AppData\Local\StarUI\WebView2Data\EBWebView\Local State~RFe5904d8.TMP
Size 1KB
SHA256 38a51c77087fd13cae23b6d8f4d5188f92997f90684ee7bd0f0ed94dabd2c883
MD5 c6994f2d374508f1a4967796e94c54e8
SHA1 7ab3e9dd3edf75bb0352864658b97847f27bdefb
SHA512 3a1f77c52c0666f952c36b6890d18c8de8bc9ea524a36f8d3d67e305833cd18530e2603d398e38e55eaa6c701333936d741ca7e6e757e7bd29f971f11d4e3c56
TLSH
T1922162B3D4652B33ECD2934D3212FA971E30A1679B618F4471CD4B0D01AA58C961BD36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1324-6-0x00007FF734CD0000-0x00007FF735AE2000-memory.dmp

Download

memory/1324-33-0x00007FF73508E000-0x00007FF73540F000-memory.dmp

Download

memory/1324-2-0x00007FF734CD0000-0x00007FF735AE2000-memory.dmp

Download

memory/1324-0-0x00007FF73508E000-0x00007FF73540F000-memory.dmp

Download

memory/1324-1-0x00007FF9F2170000-0x00007FF9F2172000-memory.dmp

Download

memory/1324-41-0x00007FF734CD0000-0x00007FF735AE2000-memory.dmp

Download

memory/3240-80-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download