71d3667fba1d461ddec86b1a4184ef07701670d3de2f973a06de91e0c96bb62e

Analysis

user interaction
yes
max time kernel
149s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 272KB
Sample260419-web6bsfv5p
SHA256 71d3667fba1d461ddec86b1a4184ef07701670d3de2f973a06de91e0c96bb62e
MD5 3684991c4a1b2a90e435999a83079836
SHA1 8bc94ea443799f5f153e0927db0c9396387d6ff3
SHA512 11e6a9d143ef46cd3467d9b1330b34dc97c427b4a3345a871facf38db215b6fb489db002db30c6cf0f50e68b6bb374260663170df317f490215dc072fbb7ae5a
SSDEEP 6144:ztNPy2xc0WqdJVVdaywL9kUZczdA5XvoWI+UTRoyly9:zO0WSdXwuycze9X
TLSH
T1E5541B0BE79349E8C617D03C82ABA772F931B8144334BA5A2754DF323F65E648B6D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	test.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk	test.exe

Executes dropped EXE 1 IoCs

pid	Process
4412	wupdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\wupdate.exe"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\wupdate.exe"	wupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3396	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3396	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5204	schtasks.exe
3012	schtasks.exe
3984	schtasks.exe
556	schtasks.exe
4884	schtasks.exe
2504	schtasks.exe
1156	schtasks.exe
5588	schtasks.exe
3272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
8	test.exe
8	test.exe
4412	wupdate.exe
4412	wupdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
8	test.exe
4412	wupdate.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5204	8	test.exe	79
PID 8 wrote to memory of 3400	8	test.exe	80
PID 3400 wrote to memory of 5792	3400	wscript.exe	81
PID 5792 wrote to memory of 3396	5792	cmd.exe	83
PID 8 wrote to memory of 3012	8	test.exe	88
PID 4412 wrote to memory of 5588	4412	wupdate.exe	89
PID 8 wrote to memory of 3984	8	test.exe	90
PID 4412 wrote to memory of 556	4412	wupdate.exe	91
PID 8 wrote to memory of 4884	8	test.exe	92
PID 4412 wrote to memory of 2504	4412	wupdate.exe	93
PID 8 wrote to memory of 3272	8	test.exe	94
PID 4412 wrote to memory of 1156	4412	wupdate.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5204
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\u.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 4
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3396
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3012
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3984
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4884
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3272

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4864

C:\Users\Admin\AppData\Roaming\wupdate.exe
C:\Users\Admin\AppData\Roaming\wupdate.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5588
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:556
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2504
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "wscript.exe \"C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs\"" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 ac47c83023ec81d85b4953689acfbf8b3ea356f1978fc1bc1f43f2af8ca0d772
MD5 8fe27a525e740d25ffa63cc89af5386a
SHA1 c2e20fc242c515d3431fd27581b435343ee33399
SHA512 f2dc6212124817e3ffb35f43a9f31e5e0e54e92555a18bb3d9cddac786e06123410929c6d4ca77fc14b2096351f54fe3e93b864eca4681dcb65af5636e3bbfdd
TLSH
T1D8C04C1177255735F11009BE15965A510AF596428A92834C1B74311D651698588E1D05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 133c0f7a894d218bf58179de09323d725b098c5d13876e0b3239d7a0d8e4c3e9
MD5 6a508ab3a3548ef2205a5a65776c2b9c
SHA1 ce82e942dbbf91fcd917c60ffb03f92458081c9c
SHA512 c6b1cec45b6e1ff8d1b738ae75fe6cbafe98a0867db12363bb39b10737f46f934f4be0ff3a67c8cc261e3832d044d35bc08a20e72f0ba5ac0de7875b6519c93e
TLSH
T14AC09B1473654755F14D117D79D5571417F54105F5DEC3445778113989156440CB2D05
MD5 SHA1 SHA512 TLSH

Submit Download

u.bat

Path C:\Users\Admin\AppData\Local\Temp\u.bat
Size 199B
SHA256 d6cd625f134cc77c3d8ab78a6fa07f3af3adb22618749aee0dbccd5009357529
MD5 5d1af4800ccaaeefc6a579ed7a910bb2
SHA1 abeb52a42b6a7e55ab486e72f7442234a3e56f69
SHA512 01d32d349f2ac36bb1045d837fd35f9fc0b60222790ce464e27af4fcb3aabc335729bb87dc7bafe63decfa04ab87d8e290f99ceda8918d427b33e770aa37fa8d
TLSH
T1DAD01243A6C7CF1E050C50A746F7524CC079485D2F457F5187A6C4AC295B41EF5E7BCA
MD5 SHA1 SHA512 TLSH

Submit Download

u.vbs

Path C:\Users\Admin\AppData\Local\Temp\u.vbs
Size 101B
SHA256 fb275a543198b82ec2e0fba1fcc00b90a09af82a2b071e8c33ac1e3db2fdf7a0
MD5 0e545a205980861c4f066b1c3f757d81
SHA1 43b9b447d91295b25e1211906d58fa3aefae4ede
SHA512 87f51476dd7fda9d07be437187e888a70ccb76df490ca55c5b37a80b2ff07a29d19c9af4312afc8d89640d996ccbaa88c4f3a8dd7b8b03528e1a843077fefd8e
TLSH
T1F6B01202EC89CF2A002540FB06705C0CCDE04E69250467B04F18C02C2155F5CD6D3201
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate_launcher.vbs

Path C:\Users\Admin\AppData\Local\Temp\wupdate_launcher.vbs
Size 104B
SHA256 3fc2d18ad092061815fb7207aaff734a2ee7028bedd30ebe367ccb0d86133569
MD5 14297b79ae3aa65b9485c985bf1904bd
SHA1 ff93332b5c2d376a7691a15e24c35ca32b5557d4
SHA512 44a1e1da37e61b4f5555071c49edebe6e4e48a883ff5ebef7e53c771416442490f388ed7af073c596b1f9c327d6ae784944cfe129337b0d6c4a1ce12b50eb935
TLSH
T161B01202A588CF5D512140EB07305C4CCDE04BE2250465B08F04806C2144B58D9CF006
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.bmp

Path C:\Users\Admin\AppData\Roaming\wupdate.bmp
Size 5.9MB
SHA256 42f64ba03fb9d734ad525207060a1c67a611a5d1a0b626958141355d7492c07f
MD5 d224434144967905aa5d47e5c641c332
SHA1 50f7e25cb5bc36d94f5231346dea96591a682b9d
SHA512 f96177807fa55e6d97768336ff7ed98d139ac031a5d5f1610354f37c695872d4535ed56a2febac7a6b48bd1fc7eb1993cb71aaf445dcee39f47e90e77d009cf2
SSDEEP 12288:hOW5u04v2reN+gg+h/5YDm4fKqcjjIRCDxvqXc/jB5:oW5u045N+gg1iuROxvqXc/jB5
TLSH
T1B3565523F5997C65E9EB3574B2FCC718A210ED88B747434E4429F9F0F2B23452AA7660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupdate.exe

Path C:\Users\Admin\AppData\Roaming\wupdate.exe
Size 272KB
SHA256 71d3667fba1d461ddec86b1a4184ef07701670d3de2f973a06de91e0c96bb62e
MD5 3684991c4a1b2a90e435999a83079836
SHA1 8bc94ea443799f5f153e0927db0c9396387d6ff3
SHA512 11e6a9d143ef46cd3467d9b1330b34dc97c427b4a3345a871facf38db215b6fb489db002db30c6cf0f50e68b6bb374260663170df317f490215dc072fbb7ae5a
SSDEEP 6144:ztNPy2xc0WqdJVVdaywL9kUZczdA5XvoWI+UTRoyly9:zO0WSdXwuycze9X
TLSH
T1E5541B0BE79349E8C617D03C82ABA772F931B8144334BA5A2754DF323F65E648B6D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 93b0dafe16f80ffe20d66ce070bcf19176d2bf34f8cd1a4354aea06ab5a490a5
MD5 d87bbbaf50c0d34e17de98c15505b5b6
SHA1 384aaf52199eaa460875b12b62779c5b2fb58f46
SHA512 499fcff8907414a69551d6a6ba09465e028d78e4cedd2fd40e58a2fbb151145e2b7c77f09b7fdcb824723b42937fe6f0d0a6dc2fbd910d122edf5e3741512237
TLSH
T129316B30285AE5405B577BD421B560177B1B5807487A9DED66BBC07C7250DCEE2EB338
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 784b7f952007281eb1ae81e54a7237b987e5b3a58b2b3295edbe8d7f811a9568
MD5 0ff4a7c348434bcd59c26e0cfb09ef07
SHA1 bffa318f39a7978e1958f40de7097f61cc803b15
SHA512 a54c21c61269dbeba88641e9ccb22383d18787cdbc101b0670c64328ec9d51ba2d91380bd084e701051e93ed0825a448323e9c47ab93e8636dd4b077e1fe278e
TLSH
T18F418C30285AE5406F577BD431B560177B1B5807497A9DEDA6BBC07C7250C8EE2EB338
MD5 SHA1 SHA512 TLSH

Submit Download

wupdate.log

Path C:\Users\Admin\AppData\Roaming\wupdate.log
Size 1KB
SHA256 d0ee6a1813544c74cbc24f35b890c9ad23f3d5fcc5f4f91167ba63e03f9f1a25
MD5 cfc2bfa5ffae0c8c73fe5bbaa1c2eb4c
SHA1 dfcf73e77cce9a52a121200657ab213c7931161d
SHA512 b151042490fa19fb326608269d4431befb60488a754085505e0bbca1c607b080e51864f5df190634826ebb8d5e9cfa16690a3d1dcffa60be33c1916a31a35140
TLSH
T11E419D30249AE5406F577BD131B5A0177B1B580B497A9DEDA6B7C07C7250C8EE2EB338
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-50-0x00007FF67AB70000-0x00007FF67ABBD000-memory.dmp

Download

memory/8-51-0x0000011156320000-0x000001115632C000-memory.dmp

Download

memory/3400-27-0x0000025FACA90000-0x0000025FACA9C000-memory.dmp

Download

memory/3400-26-0x0000025FAC780000-0x0000025FAC91A000-memory.dmp

Download

memory/4412-52-0x00007FF6606A0000-0x00007FF6606ED000-memory.dmp

Download

memory/4412-53-0x0000029715E90000-0x0000029715E9C000-memory.dmp

Download

memory/4864-49-0x000001D0855C0000-0x000001D08575A000-memory.dmp

Download