Overview

overview

5

Static

static

3

36dc871557...cb.exe

windows10-2004-x64

5

36dc871557...cb.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/05/2026, 13:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    36dc8715576059cf92cb599745ea7607cc1ba859a685f1737d931d2bd28a51cb.exe
  • Size 795KB
  • Sample260531-q6e4eaby6p
  • SHA256 36dc8715576059cf92cb599745ea7607cc1ba859a685f1737d931d2bd28a51cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36dc8715576059cf92cb599745ea7607cc1ba859a685f1737d931d2bd28a51cb.exe
    "C:\Users\Admin\AppData\Local\Temp\36dc8715576059cf92cb599745ea7607cc1ba859a685f1737d931d2bd28a51cb.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2240
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2088

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Schedule Maintenance Work
        • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
        • Size 2KB
        • SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Schedule Maintenance Work
        • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
        • Size 2KB
        • SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Schedule Wake To Work
        • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
        • Size 2KB
        • SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Schedule Wake To Work
        • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
        • Size 2KB
        • SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Schedule Work
        • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
        • Size 2KB
        • SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Schedule Work
        • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
        • Size 2KB
        • SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SA.DAT
        • Path C:\Windows\Tasks\SA.DAT
        • Size 6B
        • SHA256 12dc5ccd7fecafe070976a1916e9672e3d53085633c86957aee305ccc584184c
        • MD5 SHA1 SHA512
        Submit Download