General
- Target 24092026_0045_23092026_20260923.img.zip
- Size 469KB
- Sample260924-a4c82aaa34
- SHA256 716e86d2b15f65aeea75d028129d5c1d407d64828a1ab717a048f46aa234ef38
- MD5 b0b3387f6823f6b0ab6eac098060061f
- SHA1 b54f0042a3d35e7a05ea9b6f8adc2adeccdf8093
- SHA512 092648bb48f791319a311f2cd39d3b7e19bd0a94b10b999186771c14d6025b4a0fb98cf17c94a7c149dd35850a51c603ee1e02d9cef67c086ef46035c3da4f5a
- SSDEEP 12288:02RkpLB5S2M38hAZUXhFxBLvSeGeMO/NrHzB2K5cfV2lu:02RkJBRMM6C3v7GevH1P5A
- TLSH T1BBA423B8D250ABE1D44FFAFB441515196600C0613CA6A8B35ED404DF0D6FF9BB0EAE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
20260923.exe
Resource
win10v2004-20260911-en
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
ttdrecord.dll
Resource
win10v2004-20260911-en
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
ttdrecord.dll
Resource
win11ltsc2024-20260911-en
2 signatures
300 seconds
Malware Config
Targets
-
- Target 20260923.exe
- Size 70KB
- SHA256 5a84da32e9eb7e227a1ed095f3dd1a66569ad803fdbe60abac45c929cdd20ca4
- MD5 f0c8fecf1150a61cc6fc5b658380489a
- SHA1 0e5f2ba77ce78e1336474da1f18022a66b39ff8f
- SHA512 d2f0b1e8fd8e450d0c4e1b73baf3a46095f4b6945d2f010de5e9e73dd478cf1b6dc36eaa207d229cfbaa27617641ee856d4ec8e9272fe575081c439f417f5ce6
- SSDEEP 1536:MvSDABjM2yEU8FMHgRHKizRsk9noGmESQ5qczJe8s4TIe8MEP0TzO:zsFM2yBZHqxzR1VSQ5qkTjEcT6
- TLSH T192637E53B7804532C65236701D3EE6EAA63F96B24F5055C3576883BD2F313E18A392AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
- Target ttdrecord.dll
- Size 544KB
- SHA256 a153f7f115871392379e939090763baa3dac45d9c16347439856d363c65e4b14
- MD5 d7d051b334be11eccc1531dfe04b1600
- SHA1 6941a59d173a8d0c46c68895b3789373dadbd48a
- SHA512 cc2421f99671b76ca08a7e4c0cad2988319acaf810bf0950fbe5e5deda71cb128b433795ee51144ce49484d53c7abb7be3ab12356420aacbaa59a5cbc065e124
- SSDEEP 12288:sRWDY1ZN6XuqUXDFxBLBSgSeMOrNtHzBPdAVb8c+2:srZN6XuhBvSepH1PA4x2
- TLSH T1EAC4E1D07490C0B3D9BE35354529DA7646BEB9330B64C9EBA7C44CBF4F302C1A9359AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1