1f50528655f27c8fba2babb6ab839dfb7e5fd0f8dd391e16850ddd291662851e

Analysis

max time kernel
150s
max time network
27s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 64.5MB
Sample260808-kbm8msbr9w
SHA256 1f50528655f27c8fba2babb6ab839dfb7e5fd0f8dd391e16850ddd291662851e
MD5 546e178f2e323570751b7ccdaa806268
SHA1 a5996cc1aa81785233f07effcc5dcc72ac196c4c
SHA512 320e44c260508b247450b1c25f6e2650dda8c70c38ed26f09c29ececcc0c84c43845a1dd087a652e36c5ccd1d6c07135c39ff3a50af261108c7fb4acedbdae68
SSDEEP 393216:z115arwgQhA5GnUORD49O4lZfoYrb1Hxglb/vE5L5OtsFtHNTac9d44scJPJ0ugC:w0JUOl49x71HCUV5OtsFdtaCs4D
TLSH
T1B3E7AF15B3D80A06E63FC27DC6638112E7F1B4931352D6CF0558EA992F53BC1AB3B266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2400	EmbedHealth.Bootstrap.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3204	schtasks.exe
2148	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5524	file.exe
Token: SeDebugPrivilege	2400	EmbedHealth.Bootstrap.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 2148	5524	file.exe	89
PID 2400 wrote to memory of 3204	2400	EmbedHealth.Bootstrap.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2148

C:\Users\Admin\AppData\Local\EmbedHealth\bootstrap\EmbedHealth.Bootstrap.exe
C:\Users\Admin\AppData\Local\EmbedHealth\bootstrap\EmbedHealth.Bootstrap.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 700B
SHA256 0736019620d6270433ad9619900e402db7618b0543810723ab9abefad83a4487
MD5 1799d19b1309ffe13a0cbb18f136cecc
SHA1 283b4960fa9a137f6b4f7203234259dd2cbafe83
SHA512 8ce481da837a81c7c9dbd73f920fe55749be311c2eade889e9f360004efc49b6cd0b7ef064834302e96024e1a1cf59002d30937ec02cd10689bee52aedf20b14
TLSH
T14C0147245344C9B28D40C60D7D5BF118ABB4183DA7CA7D06E387FA58279980FBA9BA16
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 636d8f844fb252ebc5dcc9dc33beb095b63f22be863d5de9b68c7727a5c9fcdf
MD5 2cdb9c097d8ff10b490af412d31fdd29
SHA1 28834c75155f8f368b362c0a702f24fbdb1caf41
SHA512 ef9c77a80a60582376af6a92d71f4117f3ef55183ab8ddb9944632ca85c3897f5c638ef61f1010ba4f9a6450b2d08bae74551a2cc6d3e14c71c7533ebeace6c4
TLSH
T11E11EF21A344C9E18D00C54DBC57F228A6B0143DEBC73C05E387FA5C2A5980FBE6FA15
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 8f5c8f4eafa22e5cd83738f8e692928607bb40b8cda7e760d57d8709089fc70c
MD5 c7d457ad5e735459dc012e044d5558ae
SHA1 dd1a78ed18bb0dba05cfb04fb3cdf30598dc6c2b
SHA512 2d6ceb969771d1f3ca117c61e0830573dd75649a9476d5f1bcaea8b3b5fff256525d34c58e2ed8b2d96d726e9de4619b04f6753b7f06d51b8f750b32a7631192
TLSH
T1BF219E159344C9E28D00C44EB847F228A6B0143DEAD72C05E347F65C2A5981FFE7FE15
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 474716dfc72464e955c9c696e005ce9ac1f57ab42fac124a192f7b2c192263ad
MD5 3798b0b844ec062f25d0aec52404616c
SHA1 24b01628ed58a7ae4c8fdc1d7eda2f63e8824705
SHA512 b15b80c26fced69c6ab874490250d648f07491d1f658a84ccb85cf547f635e8214c92b84a49449cd3e7419144135288d646a589138389c8f94d0525823f646b2
TLSH
T14021F416A304C9E58E41C04DB847F214A6B4043EEED77915E397F61C2E5882EFB7BE1A
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 a5578959761821b2a7f9258dda9a011be5d459b96d55825a41b64f97657eefc7
MD5 458cfd613e995b25bcd1895bbb9adfdf
SHA1 6adc9bde93fb3c81512cedf1f15420dd069c28db
SHA512 57544ab6b159db672ebe6fe7e2da6215becb18be203e5203f4097e6b3758cd3b6c6ba54d8a6616c217870c55d621caf1b0527fec65ff7615916bf99af39948db
TLSH
T1B131C0166304C9A59E42804DB457F214A2B4053E9ED36615E397F20C2DA882DF7BBE1F
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 ee69eaa595a6bdced60b5f89dacbfdc1c99586f8d447fb166c97d9e1ba774b2e
MD5 81f178d124ae679526dc4d64602e7bc8
SHA1 9ac7d2c9fc02bc58aa726584ddd3085552900b0d
SHA512 2dad3054b540170f23a8e0aee1f4be7dfd3ce0f80a4481819d731277f998fd2a0d776be2589ad33e533499fe94772ae26056a0074e9fb5bc5cc87b3bac125064
TLSH
T1B631F016A304C9A58E42805D7457F214A2B4063F9AD36611E397F20C3EA882DF7BBF1F
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 287B
SHA256 16962ec467e4c115e1671ea52dee06e2f828275368a5603bd2f8f494256d7709
MD5 3a55678a1faf275d7d450e0a3a4e5963
SHA1 423392bf3fbd79a8098c7130107c61871e27be2c
SHA512 9a46292f89990fdf344ee76fbf164c415b32d3a4534d25eb7a31497f6316a1de7ff10df3f286f34022ccb4dd54ecc3825126c46575252d88c70af27c8b89eaf1
TLSH
T16DD02B385394C5E14D00C54D6E27B118EFB01C3A23D6BD07E3C3EE052A6981EAB9FA06
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 a78a83a3366a2744a2d5696b853422eeeba144d6bb51697769e66af37b0479a8
MD5 2bbce9cb69f8e9db96ea40a1aadd160e
SHA1 70a3882fc20e492a2e08a6045c5a907c9c29df1b
SHA512 871972803089e901014fde25c2542a16c875eb88344cab4ce641fb80a8302b8db1048d7a50c86cd38e132c0268ad9ad03bc68cc6ef3d3ee24c575c1c962fe182
TLSH
T18831F216A304C9958E42809D7457F218A2B4063F9AD76611E397F21C3E9882DF7BBF1F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery-task.xml

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml
Size 2KB
SHA256 82614f8c19205dca7ed1c71693a26c4f38fd4a60b309238386e2bec03124aeab
MD5 aa948297cfc8f6e09e3048a1e5e289c9
SHA1 97e7d04f78c55853bce9ed282b2de667895e4f4a
SHA512 747634c277189c825bfd50530239f4a2e6bd19e7f8eefe6c84fc7d16f70e88eebc15d8643e6c2c9dbcbae098c71cf4ca08283d8e52686f329b8124ac1c4b92c1
TLSH
T12B413A43A7FE5209F1F76F9CAA7654514EBBBD581D39D86C01AC060D0BB3922C9A0B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads