2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab.exe
Size 3.1MB
Sample260831-a58rbssfqf
SHA256 2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab
MD5 23ed3c85947705b76a5bc6dfaaff0b41
SHA1 3526ba1e856cf7c229ac3149ba05eeacf74fa7d6
SHA512 8d2c60eeda41c728c37a8e7cc3f46bae683dfffc7dcc03302b42fb30efb9e4f969f3103b0c0ab7b5207b918a22149a55f1b15d582fb7f3df5173df5fe76b1fe7
SSDEEP 49152:uYxnboMd6s63cABpYcS4ytd07MYjMGWqrUVrlFhK9j9o4Q4IU6izr4:BovsA0v4vAdkUH+Y
TLSH
T1FBE55C02BA9B94ECC15AC475C34A4A736E2174CB1726B9FF42D496383F6ABE05B3C705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1824	WaaSMedicSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateMedic = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsUpdate\\WaaSMedicSvc.exe"	2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4924	2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab.exe

C:\Users\Admin\AppData\Local\Temp\2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab.exe
"C:\Users\Admin\AppData\Local\Temp\2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:4924

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\WaaSMedicSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\WaaSMedicSvc.exe
1⤵
- Executes dropped EXE
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

waasmedic.log

Path C:\Users\Admin\AppData\Local\Temp\waasmedic.log
Size 170B
SHA256 9c647b56063525149af411750563d6c0a4d642e73738b024a7d838d4b9e6175e
MD5 af712ff911f132fb919755ac2bd6acec
SHA1 ffcb11d696e27564c7fdd84ae5754d0ee4d7de3c
SHA512 cc9c00272c3df76ff740be90b755a825877975aaf5565d61b6853a03c76c91fc68eceb022ad6e4c71d146a3ec31ff72e90fdad7479c332faad3798e514da741a
TLSH
T135C04C3DCDD590083F37812DC4BD1D55D01881834EE07DD3E550222F12EC4C65D47719
MD5 SHA1 SHA512 TLSH

Submit Download

waasmedic.log

Path C:\Users\Admin\AppData\Local\Temp\waasmedic.log
Size 130B
SHA256 08e26604e3593b37b390dcbfc319bcd615b34a0529958c8910dc433384451e69
MD5 c57d1ba54bab39272f59bcc2b7be6f0f
SHA1 ab27aba465fd6e93b92544b85cf0a40cb03dd977
SHA512 bfa32a35f6a9530df57226e1524086167d61c53e87add70b8dc4f55219cd1226c9097b2009928393f2578da60c46eac703641e79f51f90036d96b74fdd0eae77
TLSH
T12BC09228C8C480083B33C22DC4BC0C25C00880830EC07DE3E250122F22EC8C9AC47B25
MD5 SHA1 SHA512 TLSH

Submit Download

WaaSMedicSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate\WaaSMedicSvc.exe
Size 3.1MB
SHA256 2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab
MD5 23ed3c85947705b76a5bc6dfaaff0b41
SHA1 3526ba1e856cf7c229ac3149ba05eeacf74fa7d6
SHA512 8d2c60eeda41c728c37a8e7cc3f46bae683dfffc7dcc03302b42fb30efb9e4f969f3103b0c0ab7b5207b918a22149a55f1b15d582fb7f3df5173df5fe76b1fe7
SSDEEP 49152:uYxnboMd6s63cABpYcS4ytd07MYjMGWqrUVrlFhK9j9o4Q4IU6izr4:BovsA0v4vAdkUH+Y
TLSH
T1FBE55C02BA9B94ECC15AC475C34A4A736E2174CB1726B9FF42D496383F6ABE05B3C705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads