Overview

overview

7

Static

static

7

360epp1346...ws.exe

windows10-2004-x64

4

360epp1346...ws.exe

windows11-21h2-x64

4

$PLUGINSDI...ol.dll

windows10-2004-x64

3

$PLUGINSDI...ol.dll

windows11-21h2-x64

3

$PLUGINSDIR/LogEx.dll

windows10-2004-x64

3

$PLUGINSDIR/LogEx.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

7

$PLUGINSDI...ll.dll

windows11-21h2-x64

7

$PLUGINSDI...in.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows11-21h2-x64

3

$R0.dll

windows10-2004-x64

3

$R0.dll

windows11-21h2-x64

3

$TEMP/KB93...pd.exe

windows10-2004-x64

6

$TEMP/KB93...pd.exe

windows11-21h2-x64

6

Utils/$R0.exe

windows10-2004-x64

3

Utils/$R0.exe

windows11-21h2-x64

3

WscReg.exe

windows10-2004-x64

3

WscReg.exe

windows11-21h2-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/05/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMP/KB931125-rootsupd.exe
  • Size 448KB
  • Sample260525-pf2daaax91
  • SHA256 2bff74b83dc66fc74df2f527071c1ca80a992ba2b887f6043b09564d1b814213
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 12 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 64 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\KB931125-rootsupd.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\KB931125-rootsupd.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:4384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:5064
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
      2⤵
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      PID:3248
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3456

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ADVPACK.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
        • Size 129KB
        • SHA256 7735dfb067c97033031d45593c320d1229f3acba896c1a4e815a2d1bfd786b11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        authroots.sst
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst
        • Size 45KB
        • SHA256 c2253ee4956864d38a6d85eb64470538950d3d25a6cdc9557b29482066e0cc46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        delroots.sst
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst
        • Size 21KB
        • SHA256 89e2b2b4daf76b8758c1313b91028e7a58340978df7442d4003849c4d6210c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        roots.sst
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst
        • Size 7KB
        • SHA256 f66076a44618b4c21abedd1c792c79f7b3b11bc953a77d182aa3c821ff2d4a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rootsupd.inf
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf
        • Size 1KB
        • SHA256 94fe83c96d71ca4e80b7426af32c7e02b784d6492b7b16405114b04f4ffc5464
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        updroots.exe
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        • Size 5KB
        • SHA256 2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updroots.sst
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst
        • Size 431KB
        • SHA256 a082b21d51a250eb8ee28825f4c7bd274a6078c0908d9af5c8e5c393715346b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download