Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe
- Size 1.4MB
- Sample260804-k2mpssweka
- SHA256 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4
- MD5 be56f81aac89f1f901a9af59013d61f9
- SHA1 4a637d4ed32f753d0c4b024b3f60e34d5310d280
- SHA512 da608fd0c0b183be55ab1d833565a9401b312eca2d567bd269f46b86d72036fcc552525017194ff0469c3a64c4b221c6fe560bbd42638259a0950e8300439178
- SSDEEP 12288:6DvmwGwFFYEhJhcPQAr2pFFPclVl+owFFYEhJhcPQAr2pFf3fKf:6DvowFmuShGPcdwFmuShi3fKf
- TLSH T17C65B45E3E8A72D9DC2FB03FCB11B5629633686802D15A4BE1957D1D0B4A084FFB9393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Process not Found - Executes dropped EXE 3 IoCs
pid Process 5788 MicrosoftEdgeUpdate.exe 864 system64.exe 6092 Process not Found - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\AthmeService = "C:\\Users\\Admin\\AppData\\Local\\Athme\\system64.exe" 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "C:\\Users\\Admin\\AppData\\Local\\MPET\\MicrosoftEdgeUpdate.exe" 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5788 MicrosoftEdgeUpdate.exe 5788 MicrosoftEdgeUpdate.exe 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found 6092 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6092 Process not Found - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found Token: SeShutdownPrivilege 6092 Process not Found Token: SeCreatePagefilePrivilege 6092 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2592 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2592 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe"C:\Users\Admin\AppData\Local\Temp\3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2592
-
C:\Users\Admin\AppData\Local\MPET\MicrosoftEdgeUpdate.exeC:\Users\Admin\AppData\Local\MPET\MicrosoftEdgeUpdate.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5788
-
C:\Users\Admin\AppData\Local\Athme\system64.exeC:\Users\Admin\AppData\Local\Athme\system64.exe1⤵
- Executes dropped EXE
PID:864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Athme\system64.exe
- Size 407KB
- SHA256 9c5e96ef643cfb61e060b933190857c528bbdaa2c2e2b3080579838f26250322
- MD5 a842bce4c4cab73815b186327c79542c
- SHA1 cf1e12bbf012fcced17260cbca94eca447d6aa2d
- SHA512 7839d5b09646892e286ad85490afc4b04833e269083d6f61fab510efbfa1d8508dcbfea5befe451ad8cdfe46130b56f429a597834dad7a95c9d5b3a86fc5e5ba
- SSDEEP 6144:WPclVd/+BWwFFH4ELNJAYlSJlw7GNui0g+A6UtV2dymRFNqoJx6Qfc:WPclVl+owFFYEhJhcPQAr2pFf
- TLSH T1D7945946939DA0E8E93696378E52CD05D761F4B51B6189EF02D3B2372EA36C0DC35A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MPET\MicrosoftEdgeUpdate.exe
- Size 298KB
- SHA256 a0c01b3d35472470adc7e05de76ba7695d9c1d2be4d3223ca865afad4f45f400
- MD5 f82cba57d7c483eda842497c60e05e8c
- SHA1 f4aaeeb84147d000dd4ecc70093851b086a2fe25
- SHA512 b5664a76d9340261e4d036dae5270edb649520d96d3a6794b31c1faee86af291ffce2742e066774d95bba2c3b09a7da76780fbf96bd101a40233cbcdcfb62c4e
- SSDEEP 6144:uWwFFH4ELNJAYlSJlw7GNui0g+A6UtV2dymRFNqoJ:lwFFYEhJhcPQAr2pF
- TLSH T13A546A96535DA0E8ED3692378E52CD00D765E4F92BA289DF42C372372AB76C0DC21973
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wl_240727484.dll
- Size 193KB
- SHA256 2bf8fc31b0da5db15de3d529bbcb03a53bafc56bfb2dd8287a6fdee5463356af
- MD5 053d3cac7bceee330dd16a8896fabe0a
- SHA1 642397c74c37f52710a250f33ff2e5ae0528d1fb
- SHA512 2c806036ae75a8112d5aeb64126589f805d785ea7c95adeeb85474f0c431ca6e8e0a5fc12b7f24d573a706ead8ccd5b9cd8ed1b70a3770ad2576d398e0554607
- SSDEEP 3072:xP4wvRCl3ycc3rBPa7k5N7lFe3cf9o/uGg3WXP33zOt:xwwv+aPukxFiNJz
- TLSH T167146B08B3A400AAEC67427889630F66E676740107615ADF83E04775AF6FFF8963F719
- MD5 SHA1 SHA512 SSDEEP TLSH