60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe
Size 418KB
Sample260509-e6qdlaax3x
SHA256 60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120
MD5 7953214882568b121e992d0db31fd6b5
SHA1 5618c4ff97145d22e698b568e7d14d600c771e44
SHA512 330ed9deeacd5c45264fd2e8a2dc3c1b887d6b9f2c30196f58e1c92a3bf5c806dbf90bc24ff125eb6022c40d2f2c7e44895396acf13beaf887cea36aa402710d
SSDEEP 6144:SRTi00GgDSUzneySUBWT0xHxG/YJ1me2k6StBHUWq+9yNWAKvKIGl9AvXZq2qOqC:SRTiqUzneStfqXmxfF9Z
TLSH
T111943B8776E85CE7EA15833D05D7D332223EF99083129B172A20E7360E17ED17F8665A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

execution persistence

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1208	schtasks.exe
2516	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 1208	712	60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe	80
PID 4948 wrote to memory of 2516	4948	60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe
"C:\Users\Admin\AppData\Local\Temp\60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "AdminAutoStartExe" /tr "\"C:\Users\Admin\AppData\Local\Temp\60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1208

C:\Users\Admin\AppData\Local\Temp\60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe
"C:\Users\Admin\AppData\Local\Temp\60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "AdminAutoStartExe" /tr "\"C:\Users\Admin\AppData\Local\Temp\60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120.exe\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-0-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/712-1-0x0000000000B70000-0x0000000000D0A000-memory.dmp

Download

memory/4948-2-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4948-3-0x0000000000CE0000-0x0000000000E7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads