28cd60c5b5567c97eb6e0ef7bf5731b5c5ef4ffd750fd7ae79151968cafc09b2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 17:13

Target
WmiPrvSE.exe
Size 1.5MB
Sample261018-vrpfraz14n
SHA256 28cd60c5b5567c97eb6e0ef7bf5731b5c5ef4ffd750fd7ae79151968cafc09b2
MD5 b1a369c6e1ea20a3d93490138fcac1c4
SHA1 11e62114f9092f62cfa2f38a0fceb99643a55879
SHA512 b2ddbe24e92ff308135067e965a16f2ddd766cb4189975b7011906046ec762fab60fc005ffaf6cae04dd48ff0c4528b2cfa46bcae3adc4b60a96c3b725d648f5
SSDEEP 12288:Cf2MYKYczY+9AT3ILroNvDN3sslhKJjp+TIt3:Cf5C+9ACrohN3sIYp+c1
TLSH
T119756110ABFFD195F2F69E3669F121962DBB3FC2BA35929A464111110A73DC0CDB4B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Suspicious behavior: EnumeratesProcesses 6 IoCs

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
"C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504

C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
"C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2588

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact