Analysis
- user interaction
yes - max time kernel
151s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 14:04
General
- Target Prestige.exe
- Size 34.7MB
- Sample260925-rdp9caxfre
- SHA256 16b1013a3b536bae7689679f345d6822db8baa34ce0cb3b419bdb80d9ffc1a46
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 24 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prestige.exe"C:\Users\Admin\AppData\Local\Temp\Prestige.exe"1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Inter.ttf
Tmp5133.tmp
Tmp51F1.tmp
memory/2148-74-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-75-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-76-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-78-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-77-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-79-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-70-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/2148-68-0x00000289A33B0000-0x00000289A33B1000-memory.dmp
memory/5052-54-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-60-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-34-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-47-0x000001C5FE3E0000-0x000001C5FE3F2000-memory.dmp
memory/5052-48-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-49-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-53-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-0-0x00007FF8C6B7F000-0x00007FF8C6B80000-memory.dmp
memory/5052-55-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-56-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-57-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-58-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-59-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-23-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-61-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-62-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-63-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-64-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-67-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-22-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-20-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-19-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-18-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-17-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-16-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp
memory/5052-2-0x000001C5FBD20000-0x000001C5FDFD6000-memory.dmp
memory/5052-1-0x00007FF8C69F0000-0x00007FF8C7394000-memory.dmp