a0a618c5d0c70c9a482288f0c7325164c2d2e900fee6af330efb866f9faa8f66

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
runtimetask.exe
Size 6.6MB
Sample260822-e133havxgs
SHA256 a0a618c5d0c70c9a482288f0c7325164c2d2e900fee6af330efb866f9faa8f66
MD5 1398c84425d97ca85207218df835b393
SHA1 cd7ea52f1115b450d52ae89fde355d6a3d514081
SHA512 7240203f276a836eefd081b602f1c1ba8b01f79b7029ae6aef14ea2675f7bd4e48d4fb5152a4fd8c438c07b5c56bcae9db83ded72322c10bd9484cdfaa4184cb
SSDEEP 49152:WGk++Z6oiRgA9N4SRWX9BHiG+CTqJ9TxA5j2RpW39Lc4FADOhsbKQK1K6QBumvBK:WGlaLfPISSCs4CumvBh8huT3E
TLSH
T1AF664947ECA525E9C0ADE23089729512BFB17C484B2127D72BA0F6243F77BD06DBA744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion execution persistence

Malware Config

Signatures

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2000	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
252	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5096	552	runtimetask.exe	90
PID 552 wrote to memory of 252	552	runtimetask.exe	92
PID 5296 wrote to memory of 2000	5296	runtimetask.exe	96
PID 5296 wrote to memory of 2076	5296	runtimetask.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\runtimetask.exe
"C:\Users\Admin\AppData\Local\Temp\runtimetask.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn ProxiesPeer
  2⤵
  PID:5096
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ProxiesPeer /tr \"C:\Users\Admin\AppData\Local\Temp\runtimetask.exe\" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:252

C:\Users\Admin\AppData\Local\Temp\runtimetask.exe
"C:\Users\Admin\AppData\Local\Temp\runtimetask.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtimetask.exe /FI "PID ne 5296"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn ProxiesPeer
  2⤵
  PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

machine-id

Path C:\ProgramData\proxies-peer\machine-id
Size 12B
SHA256 18544c69c06d02ce651f3fb9f45da0159de6791e151895f5cc37514173758163
MD5 824855c7b463edeee0a6fc456dde9c16
SHA1 57aba050798ae69fafb7695c73936b983df2197a
SHA512 94ac42e40166fa9ea056ee3f6793c63c41160116c77980391cec13d3289419aea31ba8342141430d437ce0bdce6d2cdb108f09c1ae1e549119159a1aa58cfa9f
MD5 SHA1 SHA512

Submit Download

peer.log

Path C:\ProgramData\proxies-peer\peer.log
Size 161B
SHA256 0bd7d275586cb814610f2f46d48a9e711c82ad41fb9e46ab4075560ff3a59277
MD5 fa7323e1ff64dea2132940ec4e1bf014
SHA1 1d61a4d752eb3816f44c5ae8f9cfbf44079b42dc
SHA512 9345c3c2cafe2fcc550103671ca300dca82ba7cc4dbedfdee999fe573f00f08776d07dbe1b586e4f47eee22eed5fd567753d7286591412108575aa748cb697ad
TLSH
T166C0807554F8F0020C965C0A7570359D5111741105DA4884560D74861659E5526FBC0E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads