8eb6170fa73ee93a8ea393101eee234b8d6af5aeae3fc735adce933dac241b76

Analysis

max time kernel
598s
max time network
554s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AvEmUpdate.exe
Size 5.5MB
Sample260420-apxdcset4p
SHA256 8eb6170fa73ee93a8ea393101eee234b8d6af5aeae3fc735adce933dac241b76
MD5 0617819d2b47c6b8e885d408dfe87d21
SHA1 d1d439d9b2075f8e9020845ec36745fa89f61b80
SHA512 23a1d4538fecb24f408d79162655bae0dd7707742ddcd68a835aa29e89f08a7eb1004d5fa6a0b1fbc5610930a813f0de6bcb3ce816624275492157b646e06161
SSDEEP 49152:K2dnHZl4y/U4zbCyhhqU+h58XCYJfmyk3Wd8etGdgJELVfIKrxPim98WVTgH0JH1:vUCCyhhjL7xuzcNnndq
TLSH
T1E9467C1E7A6D00E9C1BFE1788A97950AEFB13895033997DB66E08E150F53AF05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	AvEmUpdate.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AvEmUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\AvEmUpdate.exe"
1⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AvEmUpdate.log

Path C:\ProgramData\Norton\Persistent Data\Suite\Logs\AvEmUpdate.log
Size 5KB
SHA256 72bc688e51959a59dcc54d3b49cd2035ef5c0eb5b2790460d2d98b8616825964
MD5 ca5ccb02faa59f248d50a1293353caf9
SHA1 028c7d798e8bcfabf3a14b2e0c6c8489826218c8
SHA512 f5467148a4cae89cfda1bd12d6a6aa0b9a6a6e5376972c0c57c662521a06865c9a6057c1ac723f5ac160ffb0a581ff08f646919b280da1b4b7187f0fddf0afdc
SSDEEP 96:r9LUIgRiPNa6KcDIMKbIMK0nPK0n/IOIb56HJ5DU7HJgPd6AgABLBg59N:ZLU1RiPLALe6HDCS0n2C59N
TLSH
T195C1712D1BF449A7E6E7E30689F65027ED393CE65531DD4E02E0538B06B1E14B84AF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AvEmUpdate.log

Path C:\ProgramData\Norton\Persistent Data\Suite\Logs\AvEmUpdate.log
Size 1KB
SHA256 5ba00807e915c1aae35cff710bf78ed459cd5a5e0c90bdce82a3c2bd7ac12dbe
MD5 61a9ebf32a43a9df42ad160cc561e989
SHA1 7dcff0e6a0a5f7ebc538bd2cdabe5c302e4d09d7
SHA512 bcc3bd8cac20b3548ff614788e5cf8d3e099c660bbcd9451bb9eabc8e739761faeeb59339fa8beed83e69ff89df69df832865cb21bd0684237bbe00e5fdd3a84
TLSH
T10D31B22D1EF449ABE2E7E30685E3506BAD397DE75132DD4D02E4A34F05A1A14B80AF1B
MD5 SHA1 SHA512 TLSH

Submit Download

e7002b6c-743c-46f7-bc1c-ed6cb8e160d2.ini

Path C:\Users\Admin\AppData\Local\Temp\e7002b6c-743c-46f7-bc1c-ed6cb8e160d2.ini
Size 172B
SHA256 f525a6a433b4e0e8ba021a26888e0bcd97aeda2aaedd45b7e365037a80960f7a
MD5 d521ecc30280d482042819c7933f50f1
SHA1 478826f65fc39df24f0e25474fbfd13f986cb9cd
SHA512 55a30821603245fa59a8283927ffa18456939922b03ade7535c954eca8271024aa14d8c990fb7be945ce31de6c7a660ebc8821f8543b99af1435f5c6c4ad5463
TLSH
T10BC080B9094F454DB34D3C14959D85C74D74051CCB1CCC632D16F75D56097FF12E8565
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-63-0x000001EE12060000-0x000001EE1218A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads