b7a1182e9b78336e3d3d0b94b81fa45a63e28dea5236f8e328da3302ca53af09

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7a1182e9b78336e3d3d0b94b81fa45a63e28dea5236f8e328da3302ca53af09.exe
Size 171KB
Sample260710-csn79sds6x
SHA256 b7a1182e9b78336e3d3d0b94b81fa45a63e28dea5236f8e328da3302ca53af09
MD5 8b7b54f03c0cd5265869ec4fbc184cac
SHA1 7724e97e39780c246e771a58b4a5245d31faf1e3
SHA512 d499229d16cf02d9921998033bceec90563678be73620fc2498226ed0bf12c02fe1748287207066e4e974248f34adbb6c6add5b05c32eb2c86888e0aed9952ea
SSDEEP 3072:vkXg64DNLxOEBrP/vyzGUL5gz7lBIW+oQcmRQ5icINgKlbwhrDKpvPRGd30+:H64J08br04u0QcmRQYdbDpXR+
TLSH
T127040299CA0700C6C96397B5F6EF5D1A9C78FB6263348F4C2F8E42316D717686AB1324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
904	Update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3432	notepad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5696	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4744	2248	b7a1182e9b78336e3d3d0b94b81fa45a63e28dea5236f8e328da3302ca53af09.exe	86
PID 5696 wrote to memory of 904	5696	explorer.exe	88
PID 904 wrote to memory of 1812	904	Update.exe	89
PID 904 wrote to memory of 3432	904	Update.exe	90

C:\Users\Admin\AppData\Local\Temp\b7a1182e9b78336e3d3d0b94b81fa45a63e28dea5236f8e328da3302ca53af09.exe
"C:\Users\Admin\AppData\Local\Temp\b7a1182e9b78336e3d3d0b94b81fa45a63e28dea5236f8e328da3302ca53af09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Download\3D59917B\Update.exe"
  2⤵
  PID:4744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Download\3D59917B\Update.exe
  "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Download\3D59917B\Update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\notepad.exe
    notepad.exe
    3⤵
    PID:1812
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\sf_note_7eabc0.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Download\3D59917B\Update.exe
Size 97KB
SHA256 3a953765ca049ba6e979fd9f4c73d3cadc0c0c294f2a136785c54c583cb83bb6
MD5 2da0b334d7b18cad39e5dec282eabe51
SHA1 13558aba68d0a99d5de58b21e912f209b29444ac
SHA512 fbbf275850d4b07d45762c7c141d4382d051ee962841435fe8e9c43a2c3f56b26abbefe1894908c3c68f9989d10d77c39875898bb2640c2465945d7904e2fff5
SSDEEP 384:5QaZ34HwlIwfNmSpMRIjw8cc5tnz9gqnk/5+X6EUYxLUFsR/CAxMAxy/y+OOsLeE:6aZbTkk5jQenz9gqg66EvOQatPVDGS
TLSH
T129A3195BAE5348DDC5B2EE74B8F596BA8A237CE054205B7C725C83203F137680B7C992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sf_note_7eabc0.txt

Path C:\Users\Admin\AppData\Local\Temp\sf_note_7eabc0.txt
Size 198B
SHA256 0f847f81f399f37acb10308d635198d1af98ca7b442c1c3b57b1369a06ca62de
MD5 8d65909867a3a4dd953bb2ca3d601ea2
SHA1 2f71c76d839e55279d8a2d83d45046006df5bc0d
SHA512 eeed6b76e190590d37e43751063c0545ffca455b42fb6cc7ff210631fd2d16c3375ea78802f04679d3465d6d0af6ee21a4f1d53a03e138ac4bb9700d666bd29d
TLSH
T120D0234779D7800B87A73D80246B07D4540E884553491470066D531D27143390004F24
MD5 SHA1 SHA512 TLSH

Submit Download

memory/904-3-0x000001BC9BEB0000-0x000001BC9BEB3000-memory.dmp

Download

memory/904-6-0x0000000001810000-0x000000000182A000-memory.dmp

Download

memory/2248-4-0x00007FF640E00000-0x00007FF640E30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads