Resubmissions
28/09/2026, 15:49
260928-s9gshsx19q828/09/2026, 15:47
260928-s8dpgaxerc828/09/2026, 15:44
260928-s6wr9sytax8Analysis
- user interaction
yes - max time kernel
86s - max time network
85s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
procexp64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target procexp64.exe
- Size 2.3MB
- Sample260928-s8dpgaxerc
- SHA256 917b5d71f732bf5b5423cd212c004b2433a63e9dfe02a2a27ea421252c815690
- MD5 033caf38febdb440154860fb1a27bb3e
- SHA1 1b028ab41da859c2adfc9c6bc8eedf18df86a76e
- SHA512 a90560a30d7aacb53211e7388b84f467ac3b325414532486968e6b2b7b29e924d275438c114314618c1a78a2750c5040a363882a4da6de37cfc876920c0dacef
- SSDEEP 24576:FtnOrYN933Qy7ajl0ZP4g4tmmc1gsOYUWPqVRG4WgFDi7N3n+Fm0XfS:FVOr633HajS9ac1nlUWPug4WCDi75U6
- TLSH T1F8B59F5393EC41E5E07B9734896A4626FEF27C150B3496DF0245FA1E2F33AC24A76722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\R: procexp64.exe File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\Z: procexp64.exe \??\F:\ procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\V: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\S: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\E: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\T: procexp64.exe File opened (read-only) \??\Y: procexp64.exe - Suspicious use of NtCreateThreadExHideFromDebugger 1 TTPs 2 IoCs
pid Process 5152 procexp64.exe 5152 procexp64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname procexp64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain procexp64.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a procexp64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 procexp64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a procexp64.exe - Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5152 procexp64.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 5152 procexp64.exe 6136 Process not Found 5852 Process not Found 4496 Process not Found 6108 Process not Found 5720 Process not Found 5264 Process not Found 3900 Process not Found 872 Process not Found 4512 Process not Found 5992 Process not Found 3980 Process not Found 332 Process not Found 5020 Process not Found 5632 Process not Found 4124 Process not Found 3460 Process not Found 3296 Process not Found 3624 Process not Found 4520 Process not Found 4148 Process not Found 3780 Process not Found 2188 Process not Found 4472 Process not Found 5912 Process not Found 2436 Process not Found 1508 Process not Found 3312 Process not Found 5268 Process not Found 532 Process not Found 1180 Process not Found 2944 Process not Found 1752 Process not Found 5620 Process not Found 1472 Process not Found 5888 Process not Found 5692 Process not Found 1096 Process not Found 5640 Process not Found 2988 Process not Found 5392 Process not Found 5316 Process not Found 3556 Process not Found 2788 Process not Found 3832 Process not Found 4612 Process not Found 5452 Process not Found 1092 Process not Found 1820 Process not Found 1064 Process not Found 456 Process not Found 3668 Process not Found 4236 Process not Found 1628 Process not Found 3936 Process not Found 3788 Process not Found 2344 Process not Found 2496 Process not Found 916 Process not Found 5052 Process not Found 2428 Process not Found 2308 Process not Found 3160 Process not Found 4376 Process not Found - Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
pid Process 5152 procexp64.exe 5152 procexp64.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 5152 procexp64.exe Token: SeBackupPrivilege 5152 procexp64.exe Token: SeSecurityPrivilege 5152 procexp64.exe Token: SeLoadDriverPrivilege 5152 procexp64.exe Token: SeShutdownPrivilege 5152 procexp64.exe Token: SeCreatePagefilePrivilege 5152 procexp64.exe Token: SeShutdownPrivilege 5152 procexp64.exe Token: SeCreatePagefilePrivilege 5152 procexp64.exe Token: SeDebugPrivilege 5152 procexp64.exe Token: SeImpersonatePrivilege 5152 procexp64.exe Token: SeSecurityPrivilege 5152 procexp64.exe Token: SeDebugPrivilege 5152 procexp64.exe Token: SeBackupPrivilege 5152 procexp64.exe Token: SeRestorePrivilege 5152 procexp64.exe Token: SeDebugPrivilege 5152 procexp64.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe 5152 procexp64.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5152 procexp64.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp64.exe"C:\Users\Admin\AppData\Local\Temp\procexp64.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Suspicious use of NtCreateThreadExHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5152
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3840
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2064
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:548
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1012
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3344
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1432
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Process Injection
1Defense Evasion
Debugger Evasion
1Modify Registry
2Process Injection
1Subvert Trust Controls
1Install Root Certificate
1