Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 17:07
General
- Target 520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe
- Size 67KB
- Sample260919-vner5stdrc
- SHA256 520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe"C:\Users\Admin\AppData\Local\Temp\520d29abffd79fabde3a0dee11be15d2779a18a71f8fd5200b64d134b5a8907d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\WindowsUpdate\Scheduled Start"2⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\WindowsUpdate\Scheduled Start"2⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"2⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task"2⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn "\Microsoft\Windows\UpdateOrchestrator\UUS Failover Task"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1120-1-0x0000000000910000-0x0000000000926000-memory.dmp
memory/1120-0-0x00007FFF1072F000-0x00007FFF10730000-memory.dmp
memory/1120-2-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-3-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-4-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-5-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-6-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-7-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-8-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-9-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-24-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-26-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp
memory/1120-27-0x00007FFF105A0000-0x00007FFF10F44000-memory.dmp