8eb6170fa73ee93a8ea393101eee234b8d6af5aeae3fc735adce933dac241b76

Analysis

max time kernel
598s
max time network
409s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AvEmUpdate.exe
Size 5.5MB
Sample260420-apxdcset4p
SHA256 8eb6170fa73ee93a8ea393101eee234b8d6af5aeae3fc735adce933dac241b76
MD5 0617819d2b47c6b8e885d408dfe87d21
SHA1 d1d439d9b2075f8e9020845ec36745fa89f61b80
SHA512 23a1d4538fecb24f408d79162655bae0dd7707742ddcd68a835aa29e89f08a7eb1004d5fa6a0b1fbc5610930a813f0de6bcb3ce816624275492157b646e06161
SSDEEP 49152:K2dnHZl4y/U4zbCyhhqU+h58XCYJfmyk3Wd8etGdgJELVfIKrxPim98WVTgH0JH1:vUCCyhhjL7xuzcNnndq
TLSH
T1E9467C1E7A6D00E9C1BFE1788A97950AEFB13895033997DB66E08E150F53AF05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AvEmUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\AvEmUpdate.exe"
1⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AvEmUpdate.log

Path C:\ProgramData\Norton\Persistent Data\Suite\Logs\AvEmUpdate.log
Size 3KB
SHA256 e3765c6b86edfd63f5ea9e0ae497ab21d6a25a77a1ee89094beb0db1af88c401
MD5 f4b0a6f053471e5a0cd340f2240c6a99
SHA1 b1833c2cd081da991b0fbfe680ccc184a758e0b7
SHA512 6f87fc26d3c2dddf720637406ae938966f96b1c997dcbd85005efa83cfa26388bf8d333b1dad54a824bf7642ddbe2740b713376893fc7b4582bf1077d095088a
TLSH
T12071B25C5BF40AAFF6AAE3168AF6802B9D353CA45534DD0E02D6570F05B1A15BC0AF2F
MD5 SHA1 SHA512 TLSH

Submit Download

AvEmUpdate.log

Path C:\ProgramData\Norton\Persistent Data\Suite\Logs\AvEmUpdate.log
Size 4KB
SHA256 a2a4681bea680ebe24e163b8223c5b1d9f85043c251439cce66a5980830a8ff9
MD5 fb5a669ef836b50d4b08f20748ffa9c3
SHA1 90fd4056d96ca1ac2ea66abac6b3c48e1ded6399
SHA512 002be430f6f3735881f1f46ecf5056a1236a54808c72559f1cf4db86617c35c62b3559227d33a840d1b802d54ef771307d6f81688a1fbccda3e71d801db644ba
SSDEEP 96:r1ke4gpxk6IM5IMqnPqnhIAIF5EHJ5tU5HJ/Bs:xkeFpxf9ixEHtgxBs
TLSH
T19391C41C5BF50AAFF6AAE3168AF64027AD353DA45134DD0E02D6574F06B1A04BC0AF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AvEmUpdate.log

Path C:\ProgramData\Norton\Persistent Data\Suite\Logs\AvEmUpdate.log
Size 1KB
SHA256 6960e2d45f38c04339b726b213cea08c39bd0b6571abddf99de8ff6b404e1240
MD5 a399f780f182920077e19f90a8ff5464
SHA1 357e07ff47b08768d4f2829608817f4a6b1c2fe4
SHA512 1ad13df8857e1838bcac874e208f28d29bb11ac5ce522fcfb674ab42e6af6d10ca560c5826714d25fceb05e973b08ba97fea14ddae82a8f246faa60392a12dce
TLSH
T15A31E36C5FF409AFF2AAE3128AFB50336D397DA55530DD4E02D5930F05A0A04B81AF1B
MD5 SHA1 SHA512 TLSH

Submit Download

e64bdda7-2694-4c23-acb1-882f400bd3cd.ini

Path C:\Users\Admin\AppData\Local\Temp\e64bdda7-2694-4c23-acb1-882f400bd3cd.ini
Size 172B
SHA256 f525a6a433b4e0e8ba021a26888e0bcd97aeda2aaedd45b7e365037a80960f7a
MD5 d521ecc30280d482042819c7933f50f1
SHA1 478826f65fc39df24f0e25474fbfd13f986cb9cd
SHA512 55a30821603245fa59a8283927ffa18456939922b03ade7535c954eca8271024aa14d8c990fb7be945ce31de6c7a660ebc8821f8543b99af1435f5c6c4ad5463
TLSH
T10BC080B9094F454DB34D3C14959D85C74D74051CCB1CCC632D16F75D56097FF12E8565
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads