3cd20c06aaaaf66c70c46cb9255200010d62e89f3e6d777724b78bbb5a7c3fe6

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:16

Target
WindowsUpdate.exe
Size 127KB
Sample260707-pfhaeaew9k
SHA256 3cd20c06aaaaf66c70c46cb9255200010d62e89f3e6d777724b78bbb5a7c3fe6
MD5 c40096aaf4c4ec25cea66e3541bb9b63
SHA1 28f0d45347472a21f0a8d55c01485f41af2e1478
SHA512 96363e2449d5443718be5bae1cdf408a534f3722be4e0d088311ed78f4d5c67f0fdb48dac821f64dfa699904d13f48c7e4b502904d7e9696ecf922105ac744aa
SSDEEP 3072:klmEbvwtlzomuQnxk1CHkWYhC+MHNUGk6WG/3:Qelzo+k1CHkWYhC+MtUG5WG/
TLSH
T1ABD307C6E2D0A1F4C05ADAB56A8F5E73452A7C87B035706E5B50DFF32FA07609D0A389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Adds Run key to start application 2 TTPs 3 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsUpdate.exe"	WindowsUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsUpdate.exe"	WindowsUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsUpdate.exe"	WindowsUpdate.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4212	1936	WindowsUpdate.exe	87
PID 5848 wrote to memory of 1128	5848	WindowsUpdate.exe	93
PID 1168 wrote to memory of 5600	1168	WindowsUpdate.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /sc onlogon /rl limited /tn "\Microsoft\Windows\WindowsUpdate\UpdateAndPatch" /tr "\"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4212

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /sc onlogon /rl limited /tn "\Microsoft\Windows\WindowsUpdate\UpdateAndPatch" /tr "\"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1128

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /sc onlogon /rl limited /tn "\Microsoft\Windows\WindowsUpdate\UpdateAndPatch" /tr "\"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe\""
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5600