f3016f7e967ace800d9aa1c66535dbd698f51182628fa7c415e2f1c4699e4ab3

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
upd.exe
Size 198KB
Sample261002-eqb62atdmg
SHA256 f3016f7e967ace800d9aa1c66535dbd698f51182628fa7c415e2f1c4699e4ab3
MD5 05c79741f371b3db9412f3d4652747ae
SHA1 1596171868a2d9fb34c818c6eedaa20dec4ac4b1
SHA512 646aca87ce9e9335a7c22405538edf846264a020d452a21ed9436ad8f51020dca5f5ed55515be3e89dfa3bd324667058009b77352abec8eb44fa50e90edb5492
SSDEEP 3072:tKT3EcOkjUT3SJrKCqIFzkhEfIkQC1LfEtyHo6hEq0XKCmJjquVF3tO:tKT3EcOMGCx6hAI4l8mBquVZg
TLSH
T1CB148E19B7AA10FBE1779938C9514906FA737C524760AADF43900BB68F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upd.exe"	upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upd.exe"	upd.exe

C:\Users\Admin\AppData\Local\Temp\upd.exe
"C:\Users\Admin\AppData\Local\Temp\upd.exe"
1⤵
- Adds Run key to start application
PID:708

C:\Users\Admin\AppData\Local\Temp\upd.exe
C:\Users\Admin\AppData\Local\Temp\upd.exe
1⤵
- Adds Run key to start application
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads