bf8c5ad334c9b4a8dfb7eab8e33e4869e275ababc2f042efa74fe4514ba9eb26

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13.exe
Size 820KB
Sample260830-3qpdcsbl6w
SHA256 bf8c5ad334c9b4a8dfb7eab8e33e4869e275ababc2f042efa74fe4514ba9eb26
MD5 f3b1bff7013b59d643e9deeb474fa8b6
SHA1 8cf9eed03fca846c31543474c84df32c82399cbf
SHA512 86e58589ee4a69ae18ea88fbfe2cda074341cefc4b08eb0591e76e826c89e6ef7df98e387402f069640aba3fa60c1ae32e4df7aa4426d6028dcb7078b360a9bc
SSDEEP 12288:IMeeAHMaIrG1W+1BK1KRa7XAwc/LdyiJjGGx7gYVXR3sdULOjHxX:leRHMaR110xQwcByyR7ggepX
TLSH
T16B057D07B69195BCD15AC07883569673FB33B88B0630B9BF13E09B303E56EA5AB1C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe\""	reg.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 30 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	msh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe	msh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	msh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	msh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe --stager"	msh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe --stager"	msh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe --stager"	msh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe --stager"	msh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	msh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe --stager"	msh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13.exe --stager"	13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe	13.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
5176	msh.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System32\calc.exe:msagent.exe	13.exe
File created	C:\Windows\System32\notepad.exe:msagent.exe	msh.exe
File created	C:\Windows\System32\calc.exe:msagent.exe	msh.exe
File created	C:\Windows\System32\notepad.exe:msagent.exe	13.exe
File created	C:\Windows\System32\calc.exe:msagent.exe	13.exe
File created	C:\Windows\System32\notepad.exe:msagent.exe	13.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4248	cmd.exe
3136	cmd.exe
2932	cmd.exe
3976	cmd.exe
3984	cmd.exe
1232	cmd.exe
916	cmd.exe
1080	cmd.exe
3028	cmd.exe
5636	cmd.exe
4104	cmd.exe
1016	cmd.exe
1892	cmd.exe
4312	cmd.exe
2856	cmd.exe
3424	cmd.exe
4480	cmd.exe
2972	cmd.exe
1556	cmd.exe
4508	cmd.exe
5852	cmd.exe
3212	cmd.exe
1960	cmd.exe
4008	cmd.exe
3288	cmd.exe
4940	cmd.exe
2668	cmd.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4868	ipconfig.exe
5756	ipconfig.exe
4772	ipconfig.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe\" --stager"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\ = "MicrosoftEdgeUpdate.COM"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\ = "MicrosoftEdgeUpdate.COM"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID\ = "MicrosoftEdgeUpdate.COM"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID\ = "MicrosoftEdgeUpdate.COM"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe\" --stager"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID\ = "MicrosoftEdgeUpdate.COM"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\ = "MicrosoftEdgeUpdate.COM"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msh.exe\" --stager"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1824	schtasks.exe
972	schtasks.exe
2184	schtasks.exe
1676	schtasks.exe
5312	schtasks.exe
1840	schtasks.exe
4828	schtasks.exe
1124	schtasks.exe
4760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4320	13.exe
4320	13.exe
5912	13.exe
5912	13.exe
5176	msh.exe
5176	msh.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3212	4320	13.exe	89
PID 3212 wrote to memory of 5756	3212	cmd.exe	91
PID 4320 wrote to memory of 2856	4320	13.exe	92
PID 2856 wrote to memory of 1824	2856	cmd.exe	94
PID 4320 wrote to memory of 4104	4320	13.exe	95
PID 4104 wrote to memory of 1448	4104	cmd.exe	97
PID 4320 wrote to memory of 1960	4320	13.exe	98
PID 1960 wrote to memory of 4316	1960	cmd.exe	100
PID 4320 wrote to memory of 1016	4320	13.exe	101
PID 1016 wrote to memory of 4956	1016	cmd.exe	103
PID 4320 wrote to memory of 2932	4320	13.exe	104
PID 2932 wrote to memory of 5796	2932	cmd.exe	106
PID 4320 wrote to memory of 3424	4320	13.exe	107
PID 3424 wrote to memory of 4708	3424	cmd.exe	109
PID 4320 wrote to memory of 4008	4320	13.exe	110
PID 4008 wrote to memory of 4828	4008	cmd.exe	112
PID 4320 wrote to memory of 3976	4320	13.exe	113
PID 3976 wrote to memory of 1124	3976	cmd.exe	115
PID 5912 wrote to memory of 4480	5912	13.exe	119
PID 4480 wrote to memory of 4772	4480	cmd.exe	122
PID 5176 wrote to memory of 3288	5176	msh.exe	123
PID 3288 wrote to memory of 4868	3288	cmd.exe	125
PID 5912 wrote to memory of 2972	5912	13.exe	126
PID 5176 wrote to memory of 4940	5176	msh.exe	127
PID 2972 wrote to memory of 2184	2972	cmd.exe	130
PID 4940 wrote to memory of 972	4940	cmd.exe	131
PID 5912 wrote to memory of 3984	5912	13.exe	132
PID 5176 wrote to memory of 2668	5176	msh.exe	133
PID 2668 wrote to memory of 3380	2668	cmd.exe	137
PID 3984 wrote to memory of 1156	3984	cmd.exe	136
PID 5912 wrote to memory of 4248	5912	13.exe	138
PID 5176 wrote to memory of 1892	5176	msh.exe	139
PID 4248 wrote to memory of 2836	4248	cmd.exe	142
PID 1892 wrote to memory of 1424	1892	cmd.exe	143
PID 5912 wrote to memory of 1232	5912	13.exe	144
PID 5176 wrote to memory of 1556	5176	msh.exe	145
PID 1556 wrote to memory of 2124	1556	cmd.exe	148
PID 1232 wrote to memory of 1384	1232	cmd.exe	149
PID 5176 wrote to memory of 3136	5176	msh.exe	150
PID 5912 wrote to memory of 916	5912	13.exe	152
PID 3136 wrote to memory of 5712	3136	cmd.exe	154
PID 5176 wrote to memory of 4508	5176	msh.exe	155
PID 916 wrote to memory of 4848	916	cmd.exe	156
PID 5912 wrote to memory of 5852	5912	13.exe	158
PID 4508 wrote to memory of 5644	4508	cmd.exe	159
PID 5852 wrote to memory of 5680	5852	cmd.exe	161
PID 5176 wrote to memory of 1080	5176	msh.exe	162
PID 5912 wrote to memory of 3028	5912	13.exe	164
PID 1080 wrote to memory of 1676	1080	cmd.exe	166
PID 3028 wrote to memory of 5312	3028	cmd.exe	167
PID 5176 wrote to memory of 4312	5176	msh.exe	168
PID 5912 wrote to memory of 5636	5912	13.exe	169
PID 4312 wrote to memory of 4760	4312	cmd.exe	172
PID 5636 wrote to memory of 1840	5636	cmd.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\13.exe
"C:\Users\Admin\AppData\Local\Temp\13.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdate" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}" /ve /d "MicrosoftEdgeUpdate.COM" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}" /ve /d "MicrosoftEdgeUpdate.COM" /f
    3⤵
    - Modifies registry class
    PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /f
    3⤵
    - Modifies registry class
    PID:4316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID" /ve /d "MicrosoftEdgeUpdate.COM" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID" /ve /d "MicrosoftEdgeUpdate.COM" /f
    3⤵
    - Modifies registry class
    PID:4956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /d "\"C:\Users\Admin\AppData\Local\Temp\13.exe\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /d "\"C:\Users\Admin\AppData\Local\Temp\13.exe\"" /f
    3⤵
    - Adds policy Run key to start application
    PID:5796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate
    3⤵
    PID:4708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "EdgeUpdateTask" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 30 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "EdgeUpdateTask" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdateSafe" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 60 /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdateSafe" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 60 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1124

C:\Users\Admin\AppData\Local\Temp\13.exe
"C:\Users\Admin\AppData\Local\Temp\13.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdate" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}" /ve /d "MicrosoftEdgeUpdate.COM" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}" /ve /d "MicrosoftEdgeUpdate.COM" /f
    3⤵
    - Modifies registry class
    PID:1156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /f
    3⤵
    - Modifies registry class
    PID:2836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID" /ve /d "MicrosoftEdgeUpdate.COM" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID" /ve /d "MicrosoftEdgeUpdate.COM" /f
    3⤵
    - Modifies registry class
    PID:1384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /d "\"C:\Users\Admin\AppData\Local\Temp\13.exe\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /d "\"C:\Users\Admin\AppData\Local\Temp\13.exe\"" /f
    3⤵
    - Adds policy Run key to start application
    PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate
    3⤵
    PID:5680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "EdgeUpdateTask" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 30 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "EdgeUpdateTask" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdateSafe" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 60 /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdateSafe" /tr "\"C:\Users\Admin\AppData\Local\Temp\13.exe\" --stager" /sc MINUTE /mo 60 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1840

C:\Users\Admin\AppData\Local\Temp\msh.exe
"C:\Users\Admin\AppData\Local\Temp\msh.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ipconfig
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdate" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}" /ve /d "MicrosoftEdgeUpdate.COM" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}" /ve /d "MicrosoftEdgeUpdate.COM" /f
    3⤵
    - Modifies registry class
    PID:3380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}\LocalServer32" /ve /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /f
    3⤵
    - Modifies registry class
    PID:1424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID" /ve /d "MicrosoftEdgeUpdate.COM" /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{{B1C05E45-C9A3-4F29-9C5A-0A8B1E2D3F4G}}\ProgID" /ve /d "MicrosoftEdgeUpdate.COM" /f
    3⤵
    - Modifies registry class
    PID:2124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate /d "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\"" /f
    3⤵
    - Adds policy Run key to start application
    PID:5712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WindowsUpdate
    3⤵
    PID:5644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "EdgeUpdateTask" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "EdgeUpdateTask" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdateSafe" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 60 /f 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdateSafe" /tr "\"C:\Users\Admin\AppData\Local\Temp\msh.exe\" --stager" /sc MINUTE /mo 60 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msh.exe

Path C:\Users\Admin\AppData\Local\Temp\msh.exe
Size 820KB
SHA256 bf8c5ad334c9b4a8dfb7eab8e33e4869e275ababc2f042efa74fe4514ba9eb26
MD5 f3b1bff7013b59d643e9deeb474fa8b6
SHA1 8cf9eed03fca846c31543474c84df32c82399cbf
SHA512 86e58589ee4a69ae18ea88fbfe2cda074341cefc4b08eb0591e76e826c89e6ef7df98e387402f069640aba3fa60c1ae32e4df7aa4426d6028dcb7078b360a9bc
SSDEEP 12288:IMeeAHMaIrG1W+1BK1KRa7XAwc/LdyiJjGGx7gYVXR3sdULOjHxX:leRHMaR110xQwcByyR7ggepX
TLSH
T16B057D07B69195BCD15AC07883569673FB33B88B0630B9BF13E09B303E56EA5AB1C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4320-1-0x0000024923080000-0x0000024923081000-memory.dmp

Download