1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb

Analysis

max time kernel
178s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
Size 624KB
Sample260822-gql3cawsa1
SHA256 1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb
MD5 ae562ddc495a05b75fe617e4feec91bf
SHA1 bf444dcd65b2b22146896f79128bf85a3e16bdb0
SHA512 947f7ba2a5d722b821a43121f77c51ffa753d73d236b1b378b92f3373c421acbda3342b233ec1b5b8329ca154b4809603f89b1000abf891d7c01cf1f0b0ae4db
SSDEEP 12288:yVrlYPmBiF9LVWqe2rOQhe0Oxm5t5TNTv3aog6pwIB:5PmQF9y2rPe0Oo5t5pTvK5nIB
TLSH
T173D40106BBBA65FCE26789B5C9650A62F7373A1503509F2F1360C671BF136A07D28B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe"	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe"	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe"	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe"	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1188	schtasks.exe
5468	schtasks.exe
2128	schtasks.exe
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2128	2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe	90
PID 2364 wrote to memory of 2424	2364	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe	92
PID 4132 wrote to memory of 1188	4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe	96
PID 4132 wrote to memory of 5468	4132	1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
"C:\Users\Admin\AppData\Local\Temp\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe"
1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59D72E.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2128
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59D75C.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2424

C:\Users\Admin\AppData\Local\Temp\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
C:\Users\Admin\AppData\Local\Temp\1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb.exe
1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59FAA1.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1188
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E59FAE0.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~st0E59D72E.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E59D72E.xml
Size 1KB
SHA256 91fb10f676fd05f901b72ac9ff7bd4a4da90cdfd9f9ed448f67eb7a13d9366f9
MD5 ee900abf7191648e0b2c6e917082a4df
SHA1 c64f202638acdbbe60adf4379fcc16ba7a40b5e1
SHA512 324b0c2de367ef32b5af28187dd6fc45f909092c08c5e35dc604dd88a24383766ee58129e13be42e4dc64060127ac6479133ea6dab2824dc7b74fad4dc9170e3
TLSH
T12E21B043ABFD120EF1F3AF5CAABA6452A9B6FC605D24D42D00B0090D0931D31C9B1B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E59D75C.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E59D75C.xml
Size 1KB
SHA256 708e8e264291113eeb430e2932849b654b971f58eca0738ddc382a3852934af8
MD5 c224db5b8b338232d730c82694cc3703
SHA1 0ff888c482690da969dc325f7c85f0609f97d2a7
SHA512 ce193a354a5ace65bd9c337af77b8bf5bc4dc91c5d27f7dc147cab7234421f9be9d86665eb9cc6a9e0edce21847fd69ac431b402076e7f80ee45e2d1ff692241
TLSH
T1CF319F47ABFD161AF1F3AB9CAEBA645298B6FC956D20D86D00B0094C0531D7199B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E59FAE0.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E59FAE0.xml
Size 1KB
SHA256 cfd035f4cde8a44b8f45582a55ec19aad1d0383906f6aeffb2fa0a3851b3e186
MD5 f9fa0864b6b95faf5b3c1fe83e7cd6c4
SHA1 74b9e2c452961c23804e4bfde922098f55210a7f
SHA512 d000f302c3853471f059f1549e89b451d1c92b6f83703e10ddf4eaf8bc78ac2536d9ff87b5a52bdda2e4ffc728fb48b3ee60f97e266bf190ae8c985f83b1d4a9
TLSH
T1DA319F47ABFD161AF1F3AB9CAEBA645298B6FC956D20D86D00B0094C0531D3199B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2364-20-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-18-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-19-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-5-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-21-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-22-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-23-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/2364-24-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/4132-26-0x0000000460000000-0x0000000460400000-memory.dmp

Download

memory/4132-27-0x0000000460000000-0x0000000460400000-memory.dmp

Download