a5d522de449b57ffd96cda428751f4525819be7c69931a9bc335301fa84d25dc

Analysis

user interaction
yes
max time kernel
209s
max time network
207s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
microsft_protected_protected.exe
Size 27.4MB
Sample261113-wsbrqaev41
SHA256 a5d522de449b57ffd96cda428751f4525819be7c69931a9bc335301fa84d25dc
MD5 de37edb8121ea7abef59aa310f387526
SHA1 f7930e92bd3a7f02fcc4381914394602b462fac9
SHA512 a7b8ec43922ffc1c786c70dabea4dad5a8b3b96a7c7bb6c4815fa4dd5f3245f51af4597e52caff0de829c45ed1546ca0220031707de589edee1d8d1906e2f6c4
SSDEEP 786432:V70lnHIDAvsjTa9ASPtBhGlfqspGiybmGx4YuXH1SWevHZ0IOMtGvZ3On/3buxR2:KJvv
TLSH
T18B575B4030A877E3C2E52271699756C756E9E3F1713242024BB7E8EECA605B37E5E27C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4620	microsft_protected_protected.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe
4620	microsft_protected_protected.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	microsft_protected_protected.exe

C:\Users\Admin\AppData\Local\Temp\microsft_protected_protected.exe
"C:\Users\Admin\AppData\Local\Temp\microsft_protected_protected.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5312

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5408

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4620-0-0x00000000006C0000-0x0000000002220000-memory.dmp

Download

memory/4620-1-0x0000000021B20000-0x0000000021B30000-memory.dmp

Download

memory/4620-2-0x0000000021B20000-0x0000000021B30000-memory.dmp

Download