01ba424a2b0f8be9b4a31a1b365eded53426f8cda91ef381c1aa1f198a187f2a

Analysis

user interaction
yes
max time kernel
900s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 8.2MB
Sample260828-kr464awake
SHA256 01ba424a2b0f8be9b4a31a1b365eded53426f8cda91ef381c1aa1f198a187f2a
MD5 9ab89cd64a6a444fedb5aaa3a98336c5
SHA1 f601f802a530339538ce7d08f9fe9cd7856fda7d
SHA512 1b25c74ca687e11736164d3ac584f4cfdb7fe9de81d9ab64eee9c3613947d35857da265e2dcf9a232577a5062482d816b6fc166d9c0941d9c584cc6fc39f1b17
SSDEEP 49152:7Z2LuqkQufps65n6cVUzyGJmwhegZuUzzX/MEIkLidkaVLl6FWTOnsGacxNNVUF/:FAHN/Xd3fqXEMN2yc5UiMnV
TLSH
T123864A12BB6A49ACC59BC0B4825647625A3174CB0B34BAFF44C486393F7AAF11F7C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4536	svchost.exe
4708	RuntimeBroker.exe
2804	svchost.exe
4100	svchost.exe
3064	RuntimeBroker.exe
1972	svchost.exe
3544	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EMIService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\High\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EMIService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\High\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EMIService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\High\\svchost.exe"	svchost.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3036	cmd.exe
4468	cmd.exe
2712	cmd.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2632	systeminfo.exe
4640	systeminfo.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4200	schtasks.exe
2112	schtasks.exe
1856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4536	svchost.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe
4708	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4536	3468	Setup.exe	87
PID 3468 wrote to memory of 4708	3468	Setup.exe	88
PID 4536 wrote to memory of 4468	4536	svchost.exe	89
PID 4468 wrote to memory of 4200	4468	cmd.exe	91
PID 4536 wrote to memory of 1960	4536	svchost.exe	93
PID 1960 wrote to memory of 3464	1960	cmd.exe	94
PID 1960 wrote to memory of 2632	1960	cmd.exe	103
PID 1960 wrote to memory of 4640	1960	cmd.exe	106
PID 4708 wrote to memory of 4100	4708	RuntimeBroker.exe	110
PID 4708 wrote to memory of 3064	4708	RuntimeBroker.exe	111
PID 4100 wrote to memory of 2712	4100	svchost.exe	112
PID 2712 wrote to memory of 2112	2712	cmd.exe	113
PID 4100 wrote to memory of 2336	4100	svchost.exe	114
PID 3064 wrote to memory of 1972	3064	RuntimeBroker.exe	117
PID 3064 wrote to memory of 3544	3064	RuntimeBroker.exe	118
PID 1972 wrote to memory of 3036	1972	svchost.exe	119
PID 3036 wrote to memory of 1856	3036	cmd.exe	120
PID 1972 wrote to memory of 4428	1972	svchost.exe	121

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\cmd.exe
    "cmd" /C "schtasks /create /tn \"EMIUpdater\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe\" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"EMIUpdater\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe\" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4200
- - C:\Windows\system32\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\winver.exe
      winver
      4⤵
      PID:3464
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2632
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4640
- C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\RuntimeBroker.exe" --watchdog 4536
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\cmd.exe
      "cmd" /C "schtasks /create /tn \"EMIUpdater\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe\" /sc onlogon /rl highest /f"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"EMIUpdater\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe\" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2112
  - - C:\Windows\system32\cmd.exe
      "cmd.exe"
      4⤵
      PID:2336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\RuntimeBroker.exe" --watchdog 4100
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C "schtasks /create /tn \"EMIUpdater\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe\" /sc onlogon /rl highest /f"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3036
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"EMIUpdater\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe\" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1856
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:4428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\RuntimeBroker.exe" --watchdog 1972
      4⤵
      Executes dropped EXE
      PID:3544

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe"
1⤵
- Executes dropped EXE
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\High\svchost.exe
Size 8.2MB
SHA256 01ba424a2b0f8be9b4a31a1b365eded53426f8cda91ef381c1aa1f198a187f2a
MD5 9ab89cd64a6a444fedb5aaa3a98336c5
SHA1 f601f802a530339538ce7d08f9fe9cd7856fda7d
SHA512 1b25c74ca687e11736164d3ac584f4cfdb7fe9de81d9ab64eee9c3613947d35857da265e2dcf9a232577a5062482d816b6fc166d9c0941d9c584cc6fc39f1b17
SSDEEP 49152:7Z2LuqkQufps65n6cVUzyGJmwhegZuUzzX/MEIkLidkaVLl6FWTOnsGacxNNVUF/:FAHN/Xd3fqXEMN2yc5UiMnV
TLSH
T123864A12BB6A49ACC59BC0B4825647625A3174CB0B34BAFF44C486393F7AAF11F7C758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download