71d3667fba1d461ddec86b1a4184ef07701670d3de2f973a06de91e0c96bb62e

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 272KB
Sample260419-web6bsfv5p
SHA256 71d3667fba1d461ddec86b1a4184ef07701670d3de2f973a06de91e0c96bb62e
MD5 3684991c4a1b2a90e435999a83079836
SHA1 8bc94ea443799f5f153e0927db0c9396387d6ff3
SHA512 11e6a9d143ef46cd3467d9b1330b34dc97c427b4a3345a871facf38db215b6fb489db002db30c6cf0f50e68b6bb374260663170df317f490215dc072fbb7ae5a
SSDEEP 6144:ztNPy2xc0WqdJVVdaywL9kUZczdA5XvoWI+UTRoyly9:zO0WSdXwuycze9X
TLSH
T1E5541B0BE79349E8C617D03C82ABA772F931B8144334BA5A2754DF323F65E648B6D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	test.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	test.exe

Executes dropped EXE 1 IoCs

pid	Process
4816	wupdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\wupdate.exe"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\wupdate.exe"	wupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5096	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5096	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2172	schtasks.exe
5400	schtasks.exe
4092	schtasks.exe
4984	schtasks.exe
5916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4500	test.exe
4500	test.exe
4816	wupdate.exe
4816	wupdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4500	test.exe
4816	wupdate.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2172	4500	test.exe	101
PID 4500 wrote to memory of 3536	4500	test.exe	102
PID 3536 wrote to memory of 1776	3536	wscript.exe	108
PID 1776 wrote to memory of 5096	1776	cmd.exe	110
PID 4500 wrote to memory of 5400	4500	test.exe	112
PID 4816 wrote to memory of 4092	4816	wupdate.exe	113
PID 4500 wrote to memory of 4984	4500	test.exe	114
PID 4816 wrote to memory of 5916	4816	wupdate.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2172
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\u.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 4
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5096
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5400
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4984

C:\Users\Admin\AppData\Roaming\wupdate.exe
C:\Users\Admin\AppData\Roaming\wupdate.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4092
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5916

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 fb0a7b41a9e5f41b4fddd0f14dce637e161a151b9dd2ef13741054367e612427
MD5 a8a35a330af0c87ddfa4dfb180f06309
SHA1 59e6a43e7fb6c25fac4d2e2bb1068eabcfa88eae
SHA512 8687c2ea6587ff6379498974bf29747b7e6f48f3a326a5695633ca6f49cb0a9e8facc2b363ec285f61a308a6b5f0f2bd19d51cf22e6d1c47a6db86c77faa68b6
TLSH
T134C04C1577225735F11409BE15966A510AB596428A92835D1B70311C591AA819CE0E05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 9b3485e734f64446c2bb04e1dc93cfafaf112394b01dceb6946f62daac987b94
MD5 0c360796d835427c59f8144e835df325
SHA1 9787c0775a699d98f357aa8d4c1e7bbd586794c5
SHA512 e21b1829b5d980415dcf248451766c85039fc5c3dfd72af4c22615968dd81b1052838a816f8127704336b7f50a2fbc101cb953e6862aa868c7750d7ccf490144
TLSH
T17CC09B147365471DF10D117D79D5170557B54145F5D7C34C5774113489146500871D0D
MD5 SHA1 SHA512 TLSH

Submit Download

u.bat

Path C:\Users\Admin\AppData\Local\Temp\u.bat
Size 199B
SHA256 d6cd625f134cc77c3d8ab78a6fa07f3af3adb22618749aee0dbccd5009357529
MD5 5d1af4800ccaaeefc6a579ed7a910bb2
SHA1 abeb52a42b6a7e55ab486e72f7442234a3e56f69
SHA512 01d32d349f2ac36bb1045d837fd35f9fc0b60222790ce464e27af4fcb3aabc335729bb87dc7bafe63decfa04ab87d8e290f99ceda8918d427b33e770aa37fa8d
TLSH
T1DAD01243A6C7CF1E050C50A746F7524CC079485D2F457F5187A6C4AC295B41EF5E7BCA
MD5 SHA1 SHA512 TLSH

Submit Download

u.vbs

Path C:\Users\Admin\AppData\Local\Temp\u.vbs
Size 101B
SHA256 fb275a543198b82ec2e0fba1fcc00b90a09af82a2b071e8c33ac1e3db2fdf7a0
MD5 0e545a205980861c4f066b1c3f757d81
SHA1 43b9b447d91295b25e1211906d58fa3aefae4ede
SHA512 87f51476dd7fda9d07be437187e888a70ccb76df490ca55c5b37a80b2ff07a29d19c9af4312afc8d89640d996ccbaa88c4f3a8dd7b8b03528e1a843077fefd8e
TLSH
T1F6B01202EC89CF2A002540FB06705C0CCDE04E69250467B04F18C02C2155F5CD6D3201
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate_launcher.vbs

Path C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs
Size 104B
SHA256 3fc2d18ad092061815fb7207aaff734a2ee7028bedd30ebe367ccb0d86133569
MD5 14297b79ae3aa65b9485c985bf1904bd
SHA1 ff93332b5c2d376a7691a15e24c35ca32b5557d4
SHA512 44a1e1da37e61b4f5555071c49edebe6e4e48a883ff5ebef7e53c771416442490f388ed7af073c596b1f9c327d6ae784944cfe129337b0d6c4a1ce12b50eb935
TLSH
T161B01202A588CF5D512140EB07305C4CCDE04BE2250465B08F04806C2144B58D9CF006
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.bmp

Path C:\Users\Admin\AppData\Roaming\wupdate.bmp
Size 5.9MB
SHA256 e9f30468a548ffce30443926cc8d51b62d2b9c4b57f9948c2bae06393ca46175
MD5 c2e1898d142835f650393e8ab24dd46f
SHA1 cf3164d182cada7896e5f53b6b6f2a0aa583a173
SHA512 a0d95b8b098e952a6e50345d0b236a5d312fc0df84245c41f650495313cbae3cdd03bf2bfc899e5ddfc4ec54f83de59f78c62bd3caad6ed5066a7f2d39880e45
SSDEEP 12288:zpGOxxL2HOxAT1La3NDrYjCeIjjMGX/SNoqI:zpGOxxLLxAhL2SGXa6qI
TLSH
T15756F123B5EA7A54EA3A39B582F4071DA314ECD8B748078F852978F0F0B23456D776B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupdate.exe

Path C:\Users\Admin\AppData\Roaming\wupdate.exe
Size 272KB
SHA256 71d3667fba1d461ddec86b1a4184ef07701670d3de2f973a06de91e0c96bb62e
MD5 3684991c4a1b2a90e435999a83079836
SHA1 8bc94ea443799f5f153e0927db0c9396387d6ff3
SHA512 11e6a9d143ef46cd3467d9b1330b34dc97c427b4a3345a871facf38db215b6fb489db002db30c6cf0f50e68b6bb374260663170df317f490215dc072fbb7ae5a
SSDEEP 6144:ztNPy2xc0WqdJVVdaywL9kUZczdA5XvoWI+UTRoyly9:zO0WSdXwuycze9X
TLSH
T1E5541B0BE79349E8C617D03C82ABA772F931B8144334BA5A2754DF323F65E648B6D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 c2c4469b4e7e3896cba80670285193743661bd384ac488107bb54d7e01d128d9
MD5 2e9c0695eddc0ea926b86913944d0454
SHA1 116382a3835fd8c5d73ff5acfa2cd62167a8e1f3
SHA512 49b802998831bbbcd7c3c274ab40acbb66189ad40be52e323b25069b5767f100ebd72facae92ceaa54622effad26fef776b391e143bd8dd0cac3c2a7a5759e57
TLSH
T19B3198301429EA1057A67AD422A8604B77671607443B2EEDE5BBD0BCBB50D8EE2CB374
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 bd2e86dcb8fd7ac07e3ac98e93735f63e1c88288361f942678c3bdb761418f4d
MD5 82b14d6c41f89b875f5b7b5c0df94159
SHA1 0dba82fee8aad970faba20ae0af1f47cdff1f663
SHA512 8fe5352acfdae2b5a4acb702488fb37277f3c729b9f94c6a5d2138787a7a9f7ed8cb422f29b79d686772a9f1e0a781217ccc31d4b5d7b449d166d571b140fdcd
TLSH
T1BB31CD301415E9105BA77AD422A9604B7B271507443B2EEDF1BBC07CB750D8EE2CB374
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 ebfb1fdba15e30790b4738b79e6ca1fdd7ead6614ebf753d281b8e96f08e308a
MD5 5ce255b13de8242f5952b010c218ed88
SHA1 43e0e37165a176fe5ea2c626ab5819dc6cf02280
SHA512 17540447384112de51b46d0731abd5695918105dcf07da311c5407ea8d64446626e33f9a6d55a979998b9b8e75f08dd72784a40a096b24942d56b8d0c8540b60
TLSH
T17631CC312416E9004BA37AC432E9605B7B27250744376EEDA5BBC07CB750D8EE2CB335
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 dd03b035e14c13b5452aaf141361596f925e972e16729c258d233f54fc7d0b23
MD5 e1ad3216cca19bbc7dec5233118ba5bb
SHA1 a1d3221a3f3433b660c501826ee816152458a92b
SHA512 3731cdb5792ce1e2ac3968e000ecb08e43e77882588df3f32b9a6741378cf43668d3d3f948856206ba8ad19ecbf21479588f5bd0592aec78d5ad21ecd1972faf
TLSH
T19A41CC322416E9004BA77AC422F6605BBB27250748376EEDA5BBC07CB650C4EE2CB334
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 861c0bc5b3c4d0c1c8367ac6bb5e05f44fd20030619e6bc00417e679d8287d0c
MD5 844364d1a087ecd14a5b5c937b9aff7c
SHA1 7d4b5b3ddf56cc2b2c600730ec887e012bbaa6de
SHA512 1291c8fe3e9ca00757e54701e6c9c8769cec18001541a4ae448852bb923c31ff9460d7d91ffd9512aa2b40a17ad85d34863a8c361af0f97b5655b6f047b26bef
TLSH
T1EF41DD321045E9004BA779C162B6A05FBB2B2507493B6EEDA1BBC07CB650C4DE1CB334
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3252-42-0x000001D035310000-0x000001D0353B9000-memory.dmp

Download

memory/3536-37-0x00000275FC710000-0x00000275FC7B9000-memory.dmp

Download

memory/3536-38-0x00000275FC7C0000-0x00000275FC7CC000-memory.dmp

Download

memory/4500-1-0x00007FF7970B0000-0x00007FF7970FD000-memory.dmp

Download

memory/4500-2-0x00000291649B0000-0x0000029164A59000-memory.dmp

Download

memory/4500-74-0x00007FF7970B0000-0x00007FF7970FD000-memory.dmp

Download

memory/4500-3-0x0000029164B10000-0x0000029164B1C000-memory.dmp

Download

memory/4816-44-0x000001F1085A0000-0x000001F108649000-memory.dmp

Download

memory/4816-43-0x00007FF7D9BF0000-0x00007FF7D9C3D000-memory.dmp

Download

memory/4816-45-0x000001F108680000-0x000001F10868C000-memory.dmp

Download

memory/4816-77-0x00007FF7D9BF0000-0x00007FF7D9C3D000-memory.dmp

Download