24f96c39160bfcc4e33d146990a64956caa52fdadee05402aa03402f133e3ebe

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shttp3.exe
Size 181KB
Sample260628-pellfag18n
SHA256 24f96c39160bfcc4e33d146990a64956caa52fdadee05402aa03402f133e3ebe
MD5 a2c7a773ec88aa6e8647b86399942689
SHA1 b0ac8fa7700cdb9b9a38ab0bc22f081668088342
SHA512 4e2557641043f0adb87a3f624f8770e615433921ee7aaf9e326dd2084fa546d54590caf381bc47572fc4b46fd29ed01453ddab7c25433fb9a3c5aa7f1e13a5b9
SSDEEP 3072:Om9odnKn3ND1sC9VXgaDrgyHYLucyaY4sb/YZ+dgg7NuUG1lcyHxdwMJbKmCbLHL:OmaFKdDr9Z/gVLHgAZqZcHwMd+r
TLSH
T12C0423269695FC40C0E40BB0ADEB6A5106F20FA533DB0A7A63B597FC3C1EB45FC5A911
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6140	http.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\http.exe = "c:\\shttps\\http.exe"	shttp3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shttp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6140	http.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6140	http.exe

C:\Users\Admin\AppData\Local\Temp\shttp3.exe
"C:\Users\Admin\AppData\Local\Temp\shttp3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5816

\??\c:\shttps\http.exe
c:\shttps\http.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

http.exe

Path C:\shttps\http.exe
Size 129KB
SHA256 b8a2ceab038d757e80fe1bef917e30de74ab0d9aaf93b1045304e9b185af9c50
MD5 4e171d50ba572c6a28b4e5e3ca7235d1
SHA1 c1ebe92d2d4b0cf5b7fc7ea57852ddf16c2e0911
SHA512 bfe22d8eee89be0de9e8a3586658a0c185d14a67afab868cd930e640c07f0793bffeaf0a4683508dba053dfd4deb516c08fd209aaca62e536388050217c94361
SSDEEP 3072:vmwWeRGLW1DZJajckXGtgLY3vRSRIpqKwF/UaFhh360owCJbL:vmneZFJnh3/MRA6udwC
TLSH
T18ED312661AD1FC40C0D819F1AEAF7D3051F60E5822AB55EE71B18BF83C2DA86FD2D412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http.cfg

Path \??\c:\shttps\http.cfg
Size 37B
SHA256 25a7693031bcc2bb860f765fb5e43a83451ed82e4cdae70e9dd2b7feaac00849
MD5 2472582290b4b2efa9ab56c99faabcc5
SHA1 7cf42d8fa364d6c6238edf7cbaf144eb7dc2ea80
SHA512 98c5a5801d4e3544bfcc39ca45dbb8bf3ed1c5a84a649aa152cc08d8f23f0318e117da233b3fec0a44b5909dfd51f5cac7977988a345f86fb9a77d40f73a237a
MD5 SHA1 SHA512

Submit Download

memory/5816-0-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5816-13-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5816-23-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/6140-10-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/6140-15-0x0000000000400000-0x0000000000468000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads