ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a.bin.exe
Size 192KB
Sample260623-lbmsjsbz41
SHA256 ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a
MD5 92c2f3117709621023e7796f5210c86b
SHA1 66c49caf7d0b34e607b491a4b5e832849d88004c
SHA512 96f8eafdf1b409a7ef8edb39d2123ae041ac9538abc0644e3546e098d79352e815040b32af8e61aa3a071b455114dfad0102a26564649903679862ce881a4819
SSDEEP 3072:R1xpHORUita7RdSskHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:R1xhzca7RdEyrWpAKhhvORHJ
TLSH
T11D147B4363E520E9F577C678C9A68606EB71B4621320ABEF07A0865D5F277C1AD3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	SvcHostAnalyzer.exe

Executes dropped EXE 4 IoCs

pid	Process
4916	SvcHostAnalyzer.exe
1904	WinUpdateHelper.exe
4516	winhost.exe
4676	EmbeddedDriverService.sys

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	WinUpdateHelper.exe
1904	WinUpdateHelper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	Explorer.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4916	SvcHostAnalyzer.exe
4916	SvcHostAnalyzer.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4916	SvcHostAnalyzer.exe
Token: SeLoadDriverPrivilege	4916	SvcHostAnalyzer.exe
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3764	RuntimeBroker.exe
Token: SeShutdownPrivilege	3764	RuntimeBroker.exe
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3208	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2104	1904	WinUpdateHelper.exe	51
PID 1904 wrote to memory of 1064	1904	WinUpdateHelper.exe	53
PID 1904 wrote to memory of 3208	1904	WinUpdateHelper.exe	55
PID 1904 wrote to memory of 3764	1904	WinUpdateHelper.exe	60
PID 1904 wrote to memory of 4008	1904	WinUpdateHelper.exe	62
PID 1904 wrote to memory of 4396	1904	WinUpdateHelper.exe	65
PID 1904 wrote to memory of 3720	1904	WinUpdateHelper.exe	79
PID 1904 wrote to memory of 1416	1904	WinUpdateHelper.exe	80
PID 3208 wrote to memory of 996	3208	Explorer.EXE
PID 3208 wrote to memory of 1692	3208	Explorer.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2104

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:1064

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\ce4a166e8758540f6622bb9b2e5339bbd2496b15fb2692ac1d3f8bad3673404a.bin.exe"
  2⤵
  PID:2984

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1416

C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostAnalyzer.exe

Path C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
Size 147KB
SHA256 5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 a641a6184845dfbbb5f0fff2e3a059f2
SHA1 01d66a8288c5c7078c0f8b75aae610a40ac5585a
SHA512 b22568b179f3be8e9149c3960ca151383ad64f50c0a6f519dc2574e81d4f0711dbf972e961f4aec32b0941257e4f085992582bb62fa7de62de956eea5173818d
SSDEEP 3072:nkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:gyrWpAKhhvORHJ
TLSH
T157E35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUpdateHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
Size 38KB
SHA256 88e6f97f29fde06637996fdf76f19bb9f71112a1c01738f1cde11794444976b7
MD5 819893a97034521d8c6daabfafd7ffba
SHA1 0b0b886765730947ab3c637f8263fb52ab29b535
SHA512 34d13e83f16053d6defc4b7d30323f89836494ef7149700f0a5cae633f659b4759a118ad802c91f0952a6727aec85b7296dc409901206033ab684a75690ee9ee
SSDEEP 768:nod8ZxpZO/9I2u0NH9P0D1seiwHEC40JJNSX1BOBSzlYmer1JxS:oeZxpA/qONH9sD1mwHEt0LNo1BOBmYRY
TLSH
T195035B216A9231DBDC33C7B1D1A38227E970F0D5A1249A4F9720CDAC5FEA2D2B56CF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1904-9-0x00007FFF44D70000-0x00007FFF44F65000-memory.dmp

Download

memory/2104-13-0x00000247ADDA0000-0x00000247ADDA3000-memory.dmp

Download

memory/3208-31-0x0000000002790000-0x0000000002797000-memory.dmp

Download

memory/3208-40-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/3208-41-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/4516-46-0x00007FFF44D70000-0x00007FFF44F65000-memory.dmp

Download