Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 06:38
Behavioral task
behavioral1
Sample
e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe
- Size 1.6MB
- Sample261102-hd8agsfx61
- SHA256 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00
- MD5 684318b293091c9d813209c3ba099baa
- SHA1 048fd81a8a00d6266969153914088ae35c7475c5
- SHA512 a4aef08ffa9a166bc2debd6357a02ae5901bf04dc583d2f40c86ccb2ede322fb33313634ccc09ce9c5e52d5febd2da31336adac96770ac02f340735b3ee7527c
- SSDEEP 24576:Q1pTG05RwbLR1bTHr36daE/ol4uuJ5MeJ5MH3H:QXG1ZNLXW04uq5M65MX
- TLSH T1C3759D16B7E0D171C17A023C0C66872D6B7AECAA17624BD777843B1E5E32BC05E37A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
description pid Process procid_target PID 3416 created 748 3416 explorer.exe 5 - Drops file in Drivers directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\vijCGCX5ynSE.sys EhStorAuthn.exe File opened for modification C:\Windows\system32\drivers\1eq3q6C3dMx.qow EhStorAuthn.exe File opened for modification C:\Windows\system32\drivers\i9qTtxiiVoBHTh.sys EhStorAuthn.exe File opened for modification C:\Windows\system32\drivers\1f8wYFPhdrPYwq.bzu EhStorAuthn.exe File created C:\Windows\System32\drivers\bTwe7TD.sys EhStorAuthn.exe - Executes dropped EXE 1 IoCs
pid Process 1348 EhStorAuthn.exe - Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 114.114.114.114 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe -
resource yara_rule behavioral2/memory/2352-0-0x0000000000770000-0x0000000000870000-memory.dmp vmprotect behavioral2/memory/2352-1-0x0000000000770000-0x0000000000870000-memory.dmp vmprotect behavioral2/memory/2352-8-0x0000000000770000-0x0000000000870000-memory.dmp vmprotect behavioral2/memory/3416-10-0x00000000050C0000-0x0000000005355000-memory.dmp vmprotect behavioral2/memory/3416-12-0x00000000050C0000-0x0000000005355000-memory.dmp vmprotect behavioral2/memory/3416-14-0x00000000050C0000-0x0000000005355000-memory.dmp vmprotect behavioral2/memory/3416-44-0x00000000050C0000-0x0000000005355000-memory.dmp vmprotect behavioral2/memory/1348-73-0x0000020331830000-0x0000020331B2F000-memory.dmp vmprotect behavioral2/memory/1348-74-0x0000020331830000-0x0000020331B2F000-memory.dmp vmprotect behavioral2/memory/2352-102-0x0000000000770000-0x0000000000870000-memory.dmp vmprotect behavioral2/memory/1348-103-0x0000020331830000-0x0000020331B2F000-memory.dmp vmprotect behavioral2/files/0x000f00000001c524-116.dat vmprotect behavioral2/files/0x001000000001c562-213.dat vmprotect - Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAC88.cat EhStorAuthn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCE99.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCF26.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CD06D.cat EhStorAuthn.exe File created C:\Windows\system32\ \Windows\System32\LdZSFf8G.sys EhStorAuthn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAA57.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAA87.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCFE0.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CD010.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CD09D.cat EhStorAuthn.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\5ijWKqwF.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAC5B.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCE0C.cat EhStorAuthn.exe File opened for modification C:\Windows\system32\40QZoc2XTlwH.kkt EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCFB0.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CD03D.cat EhStorAuthn.exe File opened for modification C:\Windows\system32\hetILEnLXxC9M.sys EhStorAuthn.exe File opened for modification C:\Windows\system32\IW8281sWMT1a.wiw EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAB41.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAB71.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAC2B.cat EhStorAuthn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 EhStorAuthn.exe File opened for modification C:\Windows\system32\lN343uArUKC.sys EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCF53.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CABCE.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCD7F.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCF83.cat EhStorAuthn.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCDAF.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAB9E.cat EhStorAuthn.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CABFE.cat EhStorAuthn.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\oG55kpR6Xor.vqg EhStorAuthn.exe File opened for modification C:\Program Files (x86)\ANRKoQ5gJY7wW.vmc EhStorAuthn.exe File opened for modification C:\Program Files\Windows NT\manifest.json EhStorAuthn.exe File opened for modification C:\Program Files\Windows NT\47bff233.html EhStorAuthn.exe File opened for modification C:\Program Files\Windows NT\5619890a.js EhStorAuthn.exe File opened for modification C:\Program Files\Windows NT\lib\64731fe1.js EhStorAuthn.exe File opened for modification C:\Program Files\z50YLGJGvdmOP.sys EhStorAuthn.exe File opened for modification C:\Program Files\lo2edO4c2wB4.yvp EhStorAuthn.exe File opened for modification C:\Program Files\MBstYkXzP5.sys EhStorAuthn.exe File opened for modification C:\Program Files (x86)\dtgjUqdeAkFMMv.sys EhStorAuthn.exe File opened for modification C:\Program Files\Windows NT\39665b5c.js EhStorAuthn.exe File opened for modification C:\Program Files (x86)\09YWECmPvq5Ign.sys EhStorAuthn.exe File opened for modification C:\Program Files (x86)\S2F9Mff5W2GdS.vwf EhStorAuthn.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\WsNi22DO1.sys EhStorAuthn.exe File opened for modification C:\Windows\xT19IHbLTFn6m.sys EhStorAuthn.exe File opened for modification C:\Windows\cN0fwBCDdF77.xvq EhStorAuthn.exe File opened for modification C:\Windows\Lzriq29BVNuFg.sys EhStorAuthn.exe File opened for modification C:\Windows\CTmhXJdpKiBE.adx EhStorAuthn.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5980 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname EhStorAuthn.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain EhStorAuthn.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 EhStorAuthn.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName EhStorAuthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 EhStorAuthn.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4780 timeout.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" EhStorAuthn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ EhStorAuthn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" EhStorAuthn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" EhStorAuthn.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix EhStorAuthn.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" EhStorAuthn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" EhStorAuthn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" EhStorAuthn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing EhStorAuthn.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe 1348 EhStorAuthn.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3416 explorer.exe - Suspicious behavior: LoadsDriver 35 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe Token: SeTcbPrivilege 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe Token: SeDebugPrivilege 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe Token: SeDebugPrivilege 3416 explorer.exe Token: SeDebugPrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeDebugPrivilege 1348 EhStorAuthn.exe Token: SeDebugPrivilege 1348 EhStorAuthn.exe Token: SeDebugPrivilege 1348 EhStorAuthn.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeDebugPrivilege 1348 EhStorAuthn.exe Token: SeBackupPrivilege 1348 EhStorAuthn.exe Token: SeDebugPrivilege 1348 EhStorAuthn.exe Token: SeDebugPrivilege 3004 Eap3Host.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeIncBasePriorityPrivilege 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe Token: SeCreatePagefilePrivilege 3416 explorer.exe Token: SeShutdownPrivilege 3416 explorer.exe - Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
pid Process 3416 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3416 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 82 PID 2352 wrote to memory of 3416 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 82 PID 2352 wrote to memory of 3416 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 82 PID 3416 wrote to memory of 1348 3416 explorer.exe 90 PID 3416 wrote to memory of 1348 3416 explorer.exe 90 PID 3416 wrote to memory of 1348 3416 explorer.exe 90 PID 3416 wrote to memory of 1348 3416 explorer.exe 90 PID 3416 wrote to memory of 5932 3416 explorer.exe PID 3416 wrote to memory of 1440 3416 explorer.exe PID 3416 wrote to memory of 2816 3416 explorer.exe PID 1348 wrote to memory of 3004 1348 EhStorAuthn.exe 95 PID 1348 wrote to memory of 3004 1348 EhStorAuthn.exe 95 PID 1348 wrote to memory of 3004 1348 EhStorAuthn.exe 95 PID 2352 wrote to memory of 5980 2352 e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe 97 PID 5980 wrote to memory of 4780 5980 cmd.exe 99 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82 PID 3416 wrote to memory of 4784 3416 explorer.exe PID 3416 wrote to memory of 2900 3416 explorer.exe PID 3416 wrote to memory of 6008 3416 explorer.exe PID 3416 wrote to memory of 2892 3416 explorer.exe PID 3416 wrote to memory of 2660 3416 explorer.exe PID 3416 wrote to memory of 720 3416 explorer.exe PID 3416 wrote to memory of 4160 3416 explorer.exe PID 3416 wrote to memory of 4156 3416 explorer.exe PID 3416 wrote to memory of 4052 3416 explorer.exe PID 3416 wrote to memory of 2828 3416 explorer.exe PID 3416 wrote to memory of 4320 3416 explorer.exe PID 3416 wrote to memory of 3856 3416 explorer.exe PID 3416 wrote to memory of 3012 3416 explorer.exe PID 3416 wrote to memory of 3744 3416 explorer.exe PID 3416 wrote to memory of 5276 3416 explorer.exe PID 3416 wrote to memory of 5312 3416 explorer.exe PID 1348 wrote to memory of 3416 1348 EhStorAuthn.exe 82
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:748
-
C:\ProgramData\EhStorAuthn.exe"C:\ProgramData\EhStorAuthn.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\Eap3Host.exe"C:\Windows\system32\Eap3Host.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1328
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe"C:\Users\Admin\AppData\Local\Temp\e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe"2⤵
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\e89c41d9e711d56e04e7f3e4c2c246305b49bdef1fca54aa4ca71547190e0a00.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4780
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Process Hollowing
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\EhStorAuthn.exe
- Size 148KB
- SHA256 15e47a9ccd644903cf9cf4c38017949107e0c1c20ae15a29db84ee53a87aced8
- MD5 aaebc08791eb70e2878bd42351b7836a
- SHA1 38836d9b2c8d8756aee3a367624dcd3a6d3cdc96
- SHA512 33c39a93543b2b856278201834d184be784502d966280b99f39df63c461860a7317940164ca8dab1f3a8ddfd8f5024b68e6da234d97a297fe8239f1d751eaa41
- SSDEEP 3072:P5Bgk3drb5BfNE3O0FehyeI0cWxPxQZDFcZIZ:PbBNbfNE3O0FeXI0bPxQZDFZ
- TLSH T135E37D5E62E470E5C9AE82B885624B69E4703C210F219AFF16F0F67D6F327D05E39E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\40QZoc2XTlwH.kkt
- Size 175KB
- SHA256 558b00b2f716c216fb5b811f394434053d4fc9f745ec83217b54fc8fdef48c4a
- MD5 bf8a5b63307d981b60b64e75bf467564
- SHA1 08a04fb886c050e2e8575469e368034db9e7eb6a
- SHA512 0844a5152f6649b93a475306f204215814173fd2e352388877b90d3fd97e4211c403c7348319be5c0ff37b542042c134fde8f6f867dcc35a1cf67e9d4b64289d
- SSDEEP 3072:7lQSwez6TnTzcapVhrMMWFrN9AvzajsUyVxCpF7+qCxEz60:BNwGMnPxnzW1zAuodq7+1Oj
- TLSH T1580412A3419EE1F7E004D1B12CD3A5D420BDBC17D0916920E9EC7B1A35FD3A85B0B7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CAB41.cat
- Size 5KB
- SHA256 591f18bca3cb1b0791a73d30fd841c4523e62e54a542573220713dd9c1386976
- MD5 9507c3907c2086065dc74df6b544d06f
- SHA1 97ff6eee59e537746d97d6953e676a073e138c68
- SHA512 13d3f9ea226c330bc5fbfff63877e6f8cde9dc66f1f50efa5d7d3099b498958b51e507671156dadad253d6fbfa12407e9594b8d9106230cba0049fdea8bce3d7
- SSDEEP 96:bK6mIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOjn:boIrXL0UIRIzw3jtlAur9ZCspE+TMQrA
- TLSH T16EB1E5E709082856EC865F91D1C6D22F8D74779A2EC864E65472D2952FC3BF0BB0D80F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CCE99.cat
- Size 5KB
- SHA256 8c47f7370aa39ee4d693a7abc8cfc2a765f029e618327ff60e46bb7f5bd2ea6c
- MD5 ac6e64842262de20397ae8fc356e47c3
- SHA1 e2863d03ee175230438230ca994f22396b811b10
- SHA512 bd5afb3ce4e9f41e32e00239f6ddc789756d3046a1a8a9fecc536ee4303b82696636df2fdf7da2ca8abec956f33c05a165fba9181a6b72de9072c036af1ec88d
- SSDEEP 96:3TomIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOK3:DzIrXL0UIRIzw3jtlAur9ZCspE+TMQrf
- TLSH T1ADB1E6E709082456ED895F90D1C2D62F9D7477E62DC8A5A680B2D2A52FC3BF0BB0D40F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\IW8281sWMT1a.wiw
- Size 192KB
- SHA256 7daeb0a4ec30e0860e771a71d7d554ddc51b47da04b73b370b47dd426bbe437f
- MD5 69ac5d40b23ed52bc64b559383e4f8a3
- SHA1 74081cb19d8889bf5e33562bb2a26e4ed048c24a
- SHA512 dab47a160edac1e127035ec971a7ccfb16766ee9a96618ecd00ad74e4182c3df56680067bb5cc258c20ef9eaa80794fa7d1f58f480a9c5c4165eeed988f8c35f
- SSDEEP 6144:9eiKU+0gkAHL/HnSk5iEBmhtpRKJGUoF1OvN7lnOuz9C:BKU+0gkw/HSkdstz4GFF1O17lOk9
- TLSH T1EB1412CFA2E462EFD01A00F983D7A4E566B6B4A7C7D0D5917CC832346E469D34D1B9B0
- MD5 SHA1 SHA512 SSDEEP TLSH