General
- Target WindowsUpdateCore.exe
- Size 2.7MB
- Sample260619-xdafsaay5j
- SHA256 5db0c881c91bf50083b6155b6eba50678ab2538a3c4fc7869b258871ad74e3e5
- MD5 33e24173ad0ba5e9b83fe04c92ebc551
- SHA1 87ee6726a50c8afa8363790e88aa36ce2f613b19
- SHA512 10a00606a74a65c0ff6f669e3f74c0e700d316187651c705a3cfbd4e931d9564dba993f5d9171fdf8e60907347ae405d07b8e9b9ae8c093b8ef17f4131929284
- SSDEEP 49152:CFqcdGZVXH98DFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7XQ:rZtXJhcXQD1GZjAkjixiA
- TLSH T1A9D58C1673F801A9D5AF8378C4225607DBF1B0062725EBDF499099A92F33BE15E76332
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WindowsUpdateCore.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsUpdateCore.exe
Resource
win11ltsc2024-20260618-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target WindowsUpdateCore.exe
- Size 2.7MB
- SHA256 5db0c881c91bf50083b6155b6eba50678ab2538a3c4fc7869b258871ad74e3e5
- MD5 33e24173ad0ba5e9b83fe04c92ebc551
- SHA1 87ee6726a50c8afa8363790e88aa36ce2f613b19
- SHA512 10a00606a74a65c0ff6f669e3f74c0e700d316187651c705a3cfbd4e931d9564dba993f5d9171fdf8e60907347ae405d07b8e9b9ae8c093b8ef17f4131929284
- SSDEEP 49152:CFqcdGZVXH98DFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7XQ:rZtXJhcXQD1GZjAkjixiA
- TLSH T1A9D58C1673F801A9D5AF8378C4225607DBF1B0062725EBDF499099A92F33BE15E76332
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies Windows Defender Real-time Protection settings
-
Clears Windows event logs
-
Disables service(s)
-
Stops running service(s)
-
Modifies powershell logging option