b7971b42ff2d71e9ca71cb85b42e3105456204a3ca133ddc79b7f37938065464

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 826KB
Sample261002-1713dathma
SHA256 b7971b42ff2d71e9ca71cb85b42e3105456204a3ca133ddc79b7f37938065464
MD5 f4d64e757fb48fd7292e284b34bf563d
SHA1 0c32e6af8d92293da882ad4d10cd89d828a96571
SHA512 ab671ad91b9cc2b0ccf191c88f239d5707a50b890564cd040083550a6027e57041c189e69522a174b7ee4d49b4f3abdd21953d5c87f09beeeb424e17211d5706
SSDEEP 24576:cEKSWolOmzspGGmVqoPjCE8WEQP6AF1FNYo:KSWolSpOVqoPjCuEuh
TLSH
T12C05CF27F99941E4CFBDB07724ADB2009788B712AFA7B07D3A8F34473051C9BA569706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4488	SystemServiceManager.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 3732	3356	file.exe	60
PID 4488 set thread context of 3732	4488	SystemServiceManager.exe	60

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4164	schtasks.exe
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3356	file.exe
3356	file.exe
3356	file.exe
3356	file.exe
4488	SystemServiceManager.exe
4488	SystemServiceManager.exe
4488	SystemServiceManager.exe
4488	SystemServiceManager.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe
Token: SeShutdownPrivilege	3732	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4164	3356	file.exe	86
PID 3356 wrote to memory of 3732	3356	file.exe	60
PID 4488 wrote to memory of 456	4488	SystemServiceManager.exe	93
PID 4488 wrote to memory of 3732	4488	SystemServiceManager.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\SystemServiceManager" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4164

C:\Users\Admin\AppData\Local\Microsoft\SystemServiceManager.exe
C:\Users\Admin\AppData\Local\Microsoft\SystemServiceManager.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\SystemServiceManager" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemServiceManager.exe

Path C:\Users\Admin\AppData\Local\Microsoft\SystemServiceManager.exe
Size 826KB
SHA256 b7971b42ff2d71e9ca71cb85b42e3105456204a3ca133ddc79b7f37938065464
MD5 f4d64e757fb48fd7292e284b34bf563d
SHA1 0c32e6af8d92293da882ad4d10cd89d828a96571
SHA512 ab671ad91b9cc2b0ccf191c88f239d5707a50b890564cd040083550a6027e57041c189e69522a174b7ee4d49b4f3abdd21953d5c87f09beeeb424e17211d5706
SSDEEP 24576:cEKSWolOmzspGGmVqoPjCE8WEQP6AF1FNYo:KSWolSpOVqoPjCuEuh
TLSH
T12C05CF27F99941E4CFBDB07724ADB2009788B712AFA7B07D3A8F34473051C9BA569706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsEdgeUpdate.xml

Path C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml
Size 1KB
SHA256 30252cf01e71354dc9eeb32600a123298a8b5a0e344894a2f078ea2169683cc1
MD5 45dd0a78d0ea6f836bca741efdf7252b
SHA1 136e97f596ea83639129dbe07f1e1cb7e8858857
SHA512 5db2f9dacb59e90b43e0eb93439c3d6ad9187d551c710d23fc4efc7f4a804c4db435e19e576835552aae303cfeafdb219ab5e92548ef1ff3b56af6cf92e9cd73
TLSH
T1EE3157436BFE1219F1F36B5CAABA54215E63BC644C39D46C00AC240CCAF3D62C961BB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3732-3-0x0000022C892A0000-0x0000022C892C9000-memory.dmp

Download

memory/3732-9-0x0000022C89350000-0x0000022C89375000-memory.dmp

Download