3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
Size 6.8MB
Sample261002-e83rpsvz9m
SHA256 3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c
MD5 0ece90b6149c4c60a881c23ca7b4dac7
SHA1 a963e56fc2aee3bacf475bc2e3f33ee9b3c43b97
SHA512 0997e808059812ed937d90940e48e5fd9fff7346e0dc78cc5f2075db566906b13e2dee0a17043f9b9554a43758fe5ed8c2d4bf94c8079087eabd778befb54e69
SSDEEP 49152:lj5httrugT8oWmKUCgC4JBI/5IU6iIxX:DhajfUTJk++2
TLSH
T15C76E5D25593C681F213C8605451BFE20536B47BE9F888B6B3BA1B48DF7EF61160AE4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5592	Update.exe
4108	Update.exe
4080	Update.exe
6068	Update.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2244	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
2244	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
5592	Update.exe
5592	Update.exe
4108	Update.exe
4108	Update.exe
4080	Update.exe
4080	Update.exe
6068	Update.exe
6068	Update.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4080	2244	3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe
"C:\Users\Admin\AppData\Local\Temp\3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
  j48fHGRD54f5fy6f
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4080

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe" j48fHGRD54f5fy6f
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5592

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe" j48fHGRD54f5fy6f
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update.exe
Size 1.7MB
SHA256 b3b703b2073e2b999288d1440dd5185cdb7e53bb2f53655ae43fb76fe1e4ab28
MD5 27c43cf8d661221925b1f2d83dc509c2
SHA1 83c720a50219558c0d6fde070951eedf1f1cf915
SHA512 74fa7c928e7973d4b9e71dc080d728f2cbb184a295d72c422ea72c0916ba6c098570b78c795c127b22bc20f3dec7cb640c88e9b2eda47cde03ff8020a0239f2e
SSDEEP 24576:+pLlAuyJSxqngRLhtQ6cVLJtQn652gO8KrNRRsFM3VIH06iy5xk5:cLWuyIqngRLhK6cVl4y+ZqYIU6i0
TLSH
T11D857C11BA865E99C459C4B883874FB25A31B4DB0F26E7AF02D591323E6E7F11F2C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download