Overview

overview

7

Static

static

3

WindowsUpd...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 10:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsUpdateInstaller.exe
  • Size 32.6MB
  • Sample260731-mxvwqa1cqe
  • SHA256 9a5fea4a8575ba70a0e7ecc79d2084c132f4d2b7bef6d9ca446de8ca2c4d813c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasionexecutionpersistence

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateInstaller.exe"
      2⤵
      • Loads dropped DLL
      • Drops desktop.ini file(s)
      • Writes to the Master Boot Record (MBR)
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM explorer.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6084
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM explorer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM cmd.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM powershell.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2396
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM chrome.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5472
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM firefox.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3396
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msedge.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3688
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM notepad.exe 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5684
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM notepad.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_image.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\SDL2_image.dll
        • Size 122KB
        • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_mixer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\SDL2_mixer.dll
        • Size 285KB
        • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_ttf.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\SDL2_ttf.dll
        • Size 1.5MB
        • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_asyncio.pyd
        • Size 63KB
        • SHA256 d1fb700f280e7793e9b0dca33310ef9cd08e9e0ec4f7416854dffaf6f658a394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_bz2.pyd
        • Size 82KB
        • SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_cffi_backend.cp311-win_amd64.pyd
        • Size 175KB
        • SHA256 9dcbe427f86795a5dfc19d74e9b5f3d0994ff0221b1a111877ed11eccd42e026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_ctypes.pyd
        • Size 120KB
        • SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_decimal.pyd
        • Size 247KB
        • SHA256 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_hashlib.pyd
        • Size 63KB
        • SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_lzma.pyd
        • Size 155KB
        • SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_multiprocessing.pyd
        • Size 33KB
        • SHA256 1d6f1e7e9f55918967a37cbd744886c2b7ee193c5fb8f948132ba40b17119a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_overlapped.pyd
        • Size 49KB
        • SHA256 cb68e10748e2efd86f7495d647a2774cea9f97ad5c6fe179f90dc1c467b9280f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_queue.pyd
        • Size 31KB
        • SHA256 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_socket.pyd
        • Size 77KB
        • SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\_ssl.pyd
        • Size 172KB
        • SHA256 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
        • Size 216KB
        • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\base_library.zip
        • Size 1.4MB
        • SHA256 0107e3b1cdbb13f1f4be4ad784a08aa8bafc9010857bf67824c2de2bf2d9d452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        freetype.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\freetype.dll
        • Size 639KB
        • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libjpeg-9.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libjpeg-9.dll
        • Size 238KB
        • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libmodplug-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libmodplug-1.dll
        • Size 259KB
        • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libogg-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libogg-0.dll
        • Size 25KB
        • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopus-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libopus-0.dll
        • Size 359KB
        • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopusfile-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libopusfile-0.dll
        • Size 45KB
        • SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng16-16.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libpng16-16.dll
        • Size 206KB
        • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libssl-3.dll
        • Size 771KB
        • SHA256 b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libtiff-5.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libtiff-5.dll
        • Size 422KB
        • SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libwebp-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\libwebp-7.dll
        • Size 437KB
        • SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        portmidi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\portmidi.dll
        • Size 41KB
        • SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\pyexpat.pyd
        • Size 194KB
        • SHA256 91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\pygame\base.cp311-win_amd64.pyd
        • Size 30KB
        • SHA256 179b6803eaa24c8ad84cd85912147ec8ce423a136d529f564d2579aa405297f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\pygame\constants.cp311-win_amd64.pyd
        • Size 49KB
        • SHA256 60dfd088ad8e333e8f13bfcf1409cbbdaa1ebdad9f0faf060d9c2860f801b2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\python3.DLL
        • Size 65KB
        • SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\python311.dll
        • Size 5.5MB
        • SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\pywin32_system32\pythoncom311.dll
        • Size 665KB
        • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\pywin32_system32\pywintypes311.dll
        • Size 132KB
        • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\select.pyd
        • Size 29KB
        • SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\unicodedata.pyd
        • Size 1.1MB
        • SHA256 b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\win32\win32api.pyd
        • Size 135KB
        • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34722\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4368-230-0x00007FFAC3F20000-0x00007FFAC418C000-memory.dmp
        Download

        memory/4368-231-0x00007FFAC3F20000-0x00007FFAC418C000-memory.dmp
        Download

        memory/4368-360-0x00007FFAC3F20000-0x00007FFAC418C000-memory.dmp
        Download

        memory/4368-361-0x00007FFAC3F20000-0x00007FFAC418C000-memory.dmp
        Download

        memory/4368-362-0x00007FFAC3F20000-0x00007FFAC418C000-memory.dmp
        Download