7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svc.exe
Size 14.4MB
Sample260730-g9cb9aej71
SHA256 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
MD5 98b912dfd29aa642575542164e449dc5
SHA1 7a228610a539de18de12ad8fcc7547cc7f8d2bd8
SHA512 3b10ea1f9608c7121231f88efbc059f31efa1406ca316d1ebaf4561944a2cc2f19c51eb8d9bf85a67b5004a4e829757d177cb3043660c2abb8d3c0d45ffb759f
SSDEEP 196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o
TLSH
T1F4E6AD02F3F842A9E5BFC278C5625517DBB2784A1720DBDF159485A92F33BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
248	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1672	msvc.exe
6016	msvc.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
14	api.ipify.org

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2460	sc.exe
5488	sc.exe
3048	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msvc.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5072	wmic.exe
4388	wmic.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msvc.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
248	powershell.exe
248	powershell.exe
628	wmic.exe
628	wmic.exe
628	wmic.exe
628	wmic.exe
4116	wmic.exe
4116	wmic.exe
4116	wmic.exe
4116	wmic.exe
5072	wmic.exe
5072	wmic.exe
5072	wmic.exe
5072	wmic.exe
2436	wmic.exe
2436	wmic.exe
2436	wmic.exe
2436	wmic.exe
4168	wmic.exe
4168	wmic.exe
4168	wmic.exe
4168	wmic.exe
4388	wmic.exe
4388	wmic.exe
4388	wmic.exe
4388	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	svc.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeIncreaseQuotaPrivilege	248	powershell.exe
Token: SeSecurityPrivilege	248	powershell.exe
Token: SeTakeOwnershipPrivilege	248	powershell.exe
Token: SeLoadDriverPrivilege	248	powershell.exe
Token: SeSystemProfilePrivilege	248	powershell.exe
Token: SeSystemtimePrivilege	248	powershell.exe
Token: SeProfSingleProcessPrivilege	248	powershell.exe
Token: SeIncBasePriorityPrivilege	248	powershell.exe
Token: SeCreatePagefilePrivilege	248	powershell.exe
Token: SeBackupPrivilege	248	powershell.exe
Token: SeRestorePrivilege	248	powershell.exe
Token: SeShutdownPrivilege	248	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeSystemEnvironmentPrivilege	248	powershell.exe
Token: SeRemoteShutdownPrivilege	248	powershell.exe
Token: SeUndockPrivilege	248	powershell.exe
Token: SeManageVolumePrivilege	248	powershell.exe
Token: 33	248	powershell.exe
Token: 34	248	powershell.exe
Token: 35	248	powershell.exe
Token: 36	248	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	628	wmic.exe
Token: SeIncreaseQuotaPrivilege	628	wmic.exe
Token: SeSecurityPrivilege	628	wmic.exe
Token: SeTakeOwnershipPrivilege	628	wmic.exe
Token: SeLoadDriverPrivilege	628	wmic.exe
Token: SeSystemtimePrivilege	628	wmic.exe
Token: SeBackupPrivilege	628	wmic.exe
Token: SeRestorePrivilege	628	wmic.exe
Token: SeShutdownPrivilege	628	wmic.exe
Token: SeSystemEnvironmentPrivilege	628	wmic.exe
Token: SeUndockPrivilege	628	wmic.exe
Token: SeManageVolumePrivilege	628	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	628	wmic.exe
Token: SeIncreaseQuotaPrivilege	628	wmic.exe
Token: SeSecurityPrivilege	628	wmic.exe
Token: SeTakeOwnershipPrivilege	628	wmic.exe
Token: SeLoadDriverPrivilege	628	wmic.exe
Token: SeSystemtimePrivilege	628	wmic.exe
Token: SeBackupPrivilege	628	wmic.exe
Token: SeRestorePrivilege	628	wmic.exe
Token: SeShutdownPrivilege	628	wmic.exe
Token: SeSystemEnvironmentPrivilege	628	wmic.exe
Token: SeUndockPrivilege	628	wmic.exe
Token: SeManageVolumePrivilege	628	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	4116	wmic.exe
Token: SeIncreaseQuotaPrivilege	4116	wmic.exe
Token: SeSecurityPrivilege	4116	wmic.exe
Token: SeTakeOwnershipPrivilege	4116	wmic.exe
Token: SeLoadDriverPrivilege	4116	wmic.exe
Token: SeSystemtimePrivilege	4116	wmic.exe
Token: SeBackupPrivilege	4116	wmic.exe
Token: SeRestorePrivilege	4116	wmic.exe
Token: SeShutdownPrivilege	4116	wmic.exe
Token: SeSystemEnvironmentPrivilege	4116	wmic.exe
Token: SeUndockPrivilege	4116	wmic.exe
Token: SeManageVolumePrivilege	4116	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	4116	wmic.exe
Token: SeIncreaseQuotaPrivilege	4116	wmic.exe
Token: SeSecurityPrivilege	4116	wmic.exe
Token: SeTakeOwnershipPrivilege	4116	wmic.exe
Token: SeLoadDriverPrivilege	4116	wmic.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3048	4524	svc.exe	89
PID 4524 wrote to memory of 2460	4524	svc.exe	91
PID 4524 wrote to memory of 248	4524	svc.exe	93
PID 4524 wrote to memory of 5488	4524	svc.exe	97
PID 1672 wrote to memory of 628	1672	msvc.exe	101
PID 1672 wrote to memory of 4116	1672	msvc.exe	104
PID 1672 wrote to memory of 5072	1672	msvc.exe	106
PID 1672 wrote to memory of 2436	1672	msvc.exe	109
PID 1672 wrote to memory of 4168	1672	msvc.exe	111
PID 1672 wrote to memory of 4388	1672	msvc.exe	113

C:\Users\Admin\AppData\Local\Temp\svc.exe
"C:\Users\Admin\AppData\Local\Temp\svc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"
  2⤵
  - Launches sc.exe
  PID:3048
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description WinUpdateHelper "Manages Windows Update helper components"
  2⤵
  - Launches sc.exe
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start WinUpdateHelper
  2⤵
  - Launches sc.exe
  PID:5488

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
- Executes dropped EXE
PID:6016

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get TotalVisibleMemorySize /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get FreePhysicalMemory /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get TotalVisibleMemorySize /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get FreePhysicalMemory /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msvc.exe

Path C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
Size 14.4MB
SHA256 7caa71d7b5abbe23a7ad4e0638bca339d940e788d7ff98d8c3bf6490d4a7c31a
MD5 98b912dfd29aa642575542164e449dc5
SHA1 7a228610a539de18de12ad8fcc7547cc7f8d2bd8
SHA512 3b10ea1f9608c7121231f88efbc059f31efa1406ca316d1ebaf4561944a2cc2f19c51eb8d9bf85a67b5004a4e829757d177cb3043660c2abb8d3c0d45ffb759f
SSDEEP 196608:cdvIyQs3CY9eO8OwcPFGUej4IegnBtg39dd+LyQ:cdrz7whr8IJBtg3o
TLSH
T1F4E6AD02F3F842A9E5BFC278C5625517DBB2784A1720DBDF159485A92F33BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc.log

Path C:\ProgramData\Microsoft\Windows Update Helper\svc.log
Size 159B
SHA256 edc85e3dbf85e9db99c3c14affccbcb06593549a06a0dfa8cfcf87c963769e8f
MD5 3be5e3fd36092494322542c77e2245db
SHA1 38df14179f2bcc454c9b17b2a36bcffba3dc240c
SHA512 83773ba35d3f697e1fdfaca9185bf6ec34006a594882dd7ee471ade7f1ae4aae213d9c5f8e63869b8af0c2955a3e42197e68da64649b5fdcde32b619fc62073f
TLSH
T19BC04C11056D3BB7C2CC00968C420ECB5BD6722A6600DC1D27B460592FC5C5FD8FE810
MD5 SHA1 SHA512 TLSH

Submit Download

svc.log

Path C:\ProgramData\Microsoft\Windows Update Helper\svc.log
Size 284B
SHA256 c7dd5bed2c56770b69b745b59f2daaa33fc68f535dde31494cbbd5df3dce6a9e
MD5 03eb3fb9e2337cdf87eb2a4c1597428e
SHA1 739401b4c81f0d2a636db9742647f03e9eb8376e
SHA512 950ce1c15f5279b2522c2df4d1bd53e5f09d5bd73e710945cf44f552cdfba0109bb8d7a7c0c33b0438491ed74ef30316ad02bd2da8e663dc67d81b8293e95b94
TLSH
T1F1D05E1102AE37FB82DC01A18E520EDB9BE7723B2514EC5D23B820082BC9C4FD8EF850
MD5 SHA1 SHA512 TLSH

Submit Download

svc.log

Path C:\ProgramData\Microsoft\Windows Update Helper\svc.log
Size 337B
SHA256 007158ddcc8eaff11aec5d088b5635befa6ce211450a43283f1cb97c442d386b
MD5 643ad5aab26da0b8f4051f62887545ca
SHA1 27a4d3c18f2b9258b29bead0ad919ec9437b5ee4
SHA512 16b1f6dcbe317f418faf8bcbf3f3f96a9a6ed1052be6f9efbe8a02643a30289afcfaa6e2595401093106c44ebac5ba0294036176207abe91eb3498b9002381d6
TLSH
T1D6E08C1102AE37BB82CC01A19E420ECBD6E7723B2904DC6E27A420082BCCC0FD8EF850
MD5 SHA1 SHA512 TLSH