7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svc.exe
Size 14.4MB
Sample260727-arn5rstckc
SHA256 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
MD5 98b912dfd29aa642575542164e449dc5
SHA1 7a228610a539de18de12ad8fcc7547cc7f8d2bd8
SHA512 3b10ea1f9608c7121231f88efbc059f31efa1406ca316d1ebaf4561944a2cc2f19c51eb8d9bf85a67b5004a4e829757d177cb3043660c2abb8d3c0d45ffb759f
SSDEEP 196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o
TLSH
T1F4E6AD02F3F842A9E5BFC278C5625517DBB2784A1720DBDF159485A92F33BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2548	msvc.exe
3340	msvc.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3328	sc.exe
3348	sc.exe
520	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msvc.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4456	wmic.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2216	powershell.exe
2216	powershell.exe
1792	wmic.exe
1792	wmic.exe
1792	wmic.exe
1792	wmic.exe
2724	wmic.exe
2724	wmic.exe
2724	wmic.exe
2724	wmic.exe
4456	wmic.exe
4456	wmic.exe
4456	wmic.exe
4456	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	svc.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeIncreaseQuotaPrivilege	2216	powershell.exe
Token: SeSecurityPrivilege	2216	powershell.exe
Token: SeTakeOwnershipPrivilege	2216	powershell.exe
Token: SeLoadDriverPrivilege	2216	powershell.exe
Token: SeSystemProfilePrivilege	2216	powershell.exe
Token: SeSystemtimePrivilege	2216	powershell.exe
Token: SeProfSingleProcessPrivilege	2216	powershell.exe
Token: SeIncBasePriorityPrivilege	2216	powershell.exe
Token: SeCreatePagefilePrivilege	2216	powershell.exe
Token: SeBackupPrivilege	2216	powershell.exe
Token: SeRestorePrivilege	2216	powershell.exe
Token: SeShutdownPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeSystemEnvironmentPrivilege	2216	powershell.exe
Token: SeRemoteShutdownPrivilege	2216	powershell.exe
Token: SeUndockPrivilege	2216	powershell.exe
Token: SeManageVolumePrivilege	2216	powershell.exe
Token: 33	2216	powershell.exe
Token: 34	2216	powershell.exe
Token: 35	2216	powershell.exe
Token: 36	2216	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1792	wmic.exe
Token: SeIncreaseQuotaPrivilege	1792	wmic.exe
Token: SeSecurityPrivilege	1792	wmic.exe
Token: SeTakeOwnershipPrivilege	1792	wmic.exe
Token: SeLoadDriverPrivilege	1792	wmic.exe
Token: SeSystemtimePrivilege	1792	wmic.exe
Token: SeBackupPrivilege	1792	wmic.exe
Token: SeRestorePrivilege	1792	wmic.exe
Token: SeShutdownPrivilege	1792	wmic.exe
Token: SeSystemEnvironmentPrivilege	1792	wmic.exe
Token: SeUndockPrivilege	1792	wmic.exe
Token: SeManageVolumePrivilege	1792	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	1792	wmic.exe
Token: SeIncreaseQuotaPrivilege	1792	wmic.exe
Token: SeSecurityPrivilege	1792	wmic.exe
Token: SeTakeOwnershipPrivilege	1792	wmic.exe
Token: SeLoadDriverPrivilege	1792	wmic.exe
Token: SeSystemtimePrivilege	1792	wmic.exe
Token: SeBackupPrivilege	1792	wmic.exe
Token: SeRestorePrivilege	1792	wmic.exe
Token: SeShutdownPrivilege	1792	wmic.exe
Token: SeSystemEnvironmentPrivilege	1792	wmic.exe
Token: SeUndockPrivilege	1792	wmic.exe
Token: SeManageVolumePrivilege	1792	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	2724	wmic.exe
Token: SeIncreaseQuotaPrivilege	2724	wmic.exe
Token: SeSecurityPrivilege	2724	wmic.exe
Token: SeTakeOwnershipPrivilege	2724	wmic.exe
Token: SeLoadDriverPrivilege	2724	wmic.exe
Token: SeSystemtimePrivilege	2724	wmic.exe
Token: SeBackupPrivilege	2724	wmic.exe
Token: SeRestorePrivilege	2724	wmic.exe
Token: SeShutdownPrivilege	2724	wmic.exe
Token: SeSystemEnvironmentPrivilege	2724	wmic.exe
Token: SeUndockPrivilege	2724	wmic.exe
Token: SeManageVolumePrivilege	2724	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	2724	wmic.exe
Token: SeIncreaseQuotaPrivilege	2724	wmic.exe
Token: SeSecurityPrivilege	2724	wmic.exe
Token: SeTakeOwnershipPrivilege	2724	wmic.exe
Token: SeLoadDriverPrivilege	2724	wmic.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3328	4652	svc.exe	89
PID 4652 wrote to memory of 3348	4652	svc.exe	91
PID 4652 wrote to memory of 2216	4652	svc.exe	93
PID 4652 wrote to memory of 520	4652	svc.exe	98
PID 3340 wrote to memory of 1792	3340	msvc.exe	101
PID 3340 wrote to memory of 2724	3340	msvc.exe	104
PID 3340 wrote to memory of 4456	3340	msvc.exe	106

C:\Users\Admin\AppData\Local\Temp\svc.exe
"C:\Users\Admin\AppData\Local\Temp\svc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"
  2⤵
  - Launches sc.exe
  PID:3328
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description WinUpdateHelper "Manages Windows Update helper components"
  2⤵
  - Launches sc.exe
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start WinUpdateHelper
  2⤵
  - Launches sc.exe
  PID:520

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
- Executes dropped EXE
PID:2548

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get TotalVisibleMemorySize /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get FreePhysicalMemory /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msvc.exe

Path C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
Size 14.4MB
SHA256 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
MD5 98b912dfd29aa642575542164e449dc5
SHA1 7a228610a539de18de12ad8fcc7547cc7f8d2bd8
SHA512 3b10ea1f9608c7121231f88efbc059f31efa1406ca316d1ebaf4561944a2cc2f19c51eb8d9bf85a67b5004a4e829757d177cb3043660c2abb8d3c0d45ffb759f
SSDEEP 196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o
TLSH
T1F4E6AD02F3F842A9E5BFC278C5625517DBB2784A1720DBDF159485A92F33BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc.log

Path C:\ProgramData\Microsoft\Windows Update Helper\svc.log
Size 159B
SHA256 7001f92c3a2ded71b790936b4a8ed4d994be0d09b6856087e993b8b5c00411c2
MD5 60a6897bd90da9140e83b98518686421
SHA1 6dd054333f797e909058f3a62622b1a148d80351
SHA512 2b8261b9dde1d77a3280d4f178440ac732ddf208545b68397ffd2213632ed0121b8a5e7e1d1084f7de3a230cdfc409d260b92e417cb85a4db4b479a4b09db7cd
TLSH
T134C0021125F83A37C64C00D1A44619C75786B16B0700E85C17A52295A995C5F0CBCA20
MD5 SHA1 SHA512 TLSH

Submit Download

svc.log

Path C:\ProgramData\Microsoft\Windows Update Helper\svc.log
Size 260B
SHA256 84eb558cd2c3dd90434ffa1e8a78c2f082e29bdfb636da669f90bdc47ab37e47
MD5 2114e2ac96b290022f4a6911f5009e83
SHA1 74b81730bd5b690c04d2a9cedeac5279288af505
SHA512 6d34539250dbbb260ee20d5d374f067429bc4e5984ebefc7063bd61513c21b3ee2efd087584e91b693efb1ac8b147a405ca33e6d41507ab8afe0087868ecefef
TLSH
T15AD0671121F83677C64D00D1B44619D7D7C6B0AF0B04EC9927A56284A98CC5F0CFDA20
MD5 SHA1 SHA512 TLSH

Submit Download

svc.log

Path C:\ProgramData\Microsoft\Windows Update Helper\svc.log
Size 506B
SHA256 4cb5fab37a643c82a3a34408980232d80242b8c8b3d9981168dd1e9a9baa78d8
MD5 2c1392eb59c89e261ebde26fec6192ae
SHA1 2d66e82f23c2843d0fe1963ddaa9874badde2c31
SHA512 6881081ff2b3821d928ee09c3d269d60a97f1149ca5ec95d1f7a6698990a8db18df94dfc8d6a901ffcd7c95f5d5f76156884fa2ef74db1b89ee78dc4cfd2c67a
TLSH
T103F0E90122FD323B851C11D1F54619D7E6C6B1BF4308DCA967E122896688D5F1CFDB21
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2216-15-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-7-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-9-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-10-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-11-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-12-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-13-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-14-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-1-0x00007FFFAF95F000-0x00007FFFAF960000-memory.dmp

Download

memory/2216-16-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-17-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-8-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-21-0x00000185E7830000-0x00000185E784E000-memory.dmp

Download

memory/2216-22-0x00000185E78D0000-0x00000185E7982000-memory.dmp

Download

memory/2216-23-0x00000185E7850000-0x00000185E785A000-memory.dmp

Download

memory/2216-26-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-25-0x00000185E7D80000-0x00000185E7E70000-memory.dmp

Download

memory/2216-29-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-6-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-4-0x00000185CF560000-0x00000185CF582000-memory.dmp

Download

memory/2216-36-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download

memory/2216-5-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp

Download