ba9eb671cfacb6d9ea8614b1e0f78804b3b14e36d1b963b30bbb798ccf9ed849

Analysis

max time kernel
900s
max time network
862s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TheAltening.V2.App.exe
Size 23.6MB
Sample260704-m8bl8aaw4j
SHA256 ba9eb671cfacb6d9ea8614b1e0f78804b3b14e36d1b963b30bbb798ccf9ed849
MD5 99b30fa5642d701865e6bde974c750b7
SHA1 417a420e218c99aba51b3d79ef33d0c3b2a38743
SHA512 13c5b8e8e1776e8fd9fd6d0e4308ba99f8ecdcec8b2b3e0a08aa6a6c87710109b814e3fb69da849a485e34cc1047eb333224ecbed00067cf2342b7eebb9e42af
SSDEEP 393216:2EsQUCA4ljLkr4QlAlBPPpBSg0xAmO3HobEAlao6fJN1P6SuuQ6FuapJIqLuN4p2:/zDQxoobEAlsk
TLSH
T105479C05A3F802A9E5AFC278C5668237DBB1BC561721D7CF0554E6992F33BD05E3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5460	TheAltening.V2.Updater.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TheAltening.V2.App.exe\",1"	TheAltening.V2.App.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\shell	TheAltening.V2.App.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\shell\open	TheAltening.V2.App.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening	TheAltening.V2.App.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\shell\open\command	TheAltening.V2.App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TheAltening.V2.App.exe\" \"%1\""	TheAltening.V2.App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\ = "URL:altening Protocol"	TheAltening.V2.App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\URL Protocol	TheAltening.V2.App.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\altening\DefaultIcon	TheAltening.V2.App.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3456	TheAltening.V2.App.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	TheAltening.V2.App.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 5852	3456	TheAltening.V2.App.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TheAltening.V2.App.exe
"C:\Users\Admin\AppData\Local\Temp\TheAltening.V2.App.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /F /SC DAILY /MO 3 /TN "TheAltening V2 App Update Check" /TR ""C:\Users\Admin\AppData\Local\TheAltening\Updater\TheAltening.V2.Updater.exe" --scheduled-check "C:\Users\Admin\AppData\Local\TheAltening\AutoUpdate\scheduled-check.json""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5852

C:\Users\Admin\AppData\Local\TheAltening\Updater\TheAltening.V2.Updater.exe
C:\Users\Admin\AppData\Local\TheAltening\Updater\TheAltening.V2.Updater.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5564

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TheAltening.V2.Updater.exe

Path C:\Users\Admin\AppData\Local\TheAltening\Updater\TheAltening.V2.Updater.exe
Size 6.0MB
SHA256 8f274879e81e15f795a97b0ce81e2e7e64d21ba97f78e38d50d1ae82f77cb19b
MD5 dfaa11eb379bd9e91eb13460c8a542cb
SHA1 665e2aa5eed6a4bcbc9c55471db45f0126a3b5a7
SHA512 7fa889ed4dada5b831b4a3328ab924181cef6a41feb43cc3fc5745b6677c092a78e41671c5f108ac5c95df2571c7ddf57a9416966967c21f74b6e5a1cd2213bf
SSDEEP 49152:CBMI2mWwPINF9ba57vnd+Xj6ZbxQVwaYi3sZE6YkpFff97b7l9/wW7iFxcAX3j/l:JfmeBwxb7lWnFzP8Cqd7NAHGOuU
TLSH
T17D569D05A3E801A5E42BEA74CA65D333DAB07C925735C24F0969F6461F73E918B3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download