84304f7d4b0cd0ebcbe8318695a260151b48991a6659c3366fdd5da290c0ab91

Analysis

user interaction
yes
max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
claude.exe
Size 237.6MB
Sample261003-krss3avcjf
SHA256 84304f7d4b0cd0ebcbe8318695a260151b48991a6659c3366fdd5da290c0ab91
MD5 d79ea4043903968209aed0f4bc2049b9
SHA1 2041f5acb1da00631afbcdadb33be111436b99be
SHA512 26c33772c425f32ad3c2596401f981f90c1bab0630fea6b20848083c805a3cd09af6225de48e7c6d557246d661412556e4b353f636ad67ed63b79c1b8b08fe57
SSDEEP 6291456:dLiLzHeZ3i/cot5YtPUkcV00Ktyl48mcTFPa2r9bTRLBJIrxaFRE+1qVRbyor0ci:VIkk
TLSH
T1CBC89C43F7C0A515CC5585709916E6B13B32F8801B3A6697729CEB3C2F28ED05BBE729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
10	raw.githubusercontent.com

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	claude.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4780	reg.exe
4860	reg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4860	3688	claude.exe	88
PID 3688 wrote to memory of 4780	3688	claude.exe	89
PID 3688 wrote to memory of 1692	3688	claude.exe	93

C:\Users\Admin\AppData\Local\Temp\claude.exe
"C:\Users\Admin\AppData\Local\Temp\claude.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:4860
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:4780
- C:\Windows\System32\where.exe
  C:\Windows\System32\where.exe git
  2⤵
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.claude.json

Path C:\Users\Admin\.claude.json
Size 167B
SHA256 ec51d1d6879cbbaf3dc0d360dbcda6aa31cee6fc18668d015270604f08c39330
MD5 9773a7d814d6c182d3f58e1186ae89fd
SHA1 1b61c18836f9d9652a6d0ff46febcc46334246eb
SHA512 afadef5719342c12bae9a545c08204375eee77a3259561cf8ee92cd4c26153b99746fd136e27a80088f2ab2b669aefc6575d69b10f5205e35a96668d78d6add4
TLSH
T1DFC08C290D84164B99C803D23E2D86B48FF90FBF922E22D8434B57044278E222D0E729
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 242B
SHA256 03a3a45fc676cb0a76060565d892a85d62a464a0df983c282ad373f953b1fdb2
MD5 1859dfecbb8df325eb8582dbd4f2d438
SHA1 09cdb86c487267c450d34a9a2f3abdd199b972d0
SHA512 6840697cb2f0bcc40b9a1dce68fd8a44b4ab5b80c4a93616a3801f4b50633bbc1e8cd58e8b91c8c344f8ab80c6faad383f7cd0d79ea997dd55cc82ebcb8b41a3
TLSH
T18ED0A7550645952746E943877F1E81754AF44EBF531E25A8428B4714012CFA33E1F2AC
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 464B
SHA256 ffb59e5d847ed42da057a3a1d644bb7793709d61f12432d22e10b7132d4c0f70
MD5 36cdc35485fa640f038e4d8df47a5a57
SHA1 824e7382a7008fa3d27bb07c5702027738aaceb7
SHA512 bb278822019d09bf0a6012a51205cb7d7acbfc15a656e48bcbe7f77888d9992033b16c259a5c63def1959c18cc91bcb93a1e4e3a30057dd3af0807ba53605ca7
TLSH
T146F0279A1A4484679AE502037F6D44628EF85EBE420B74A8038F5B04122DF63396B774
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 317B
SHA256 2867e6896410478a476188eedf26ee544913a31ced833ab41b8f0407d0b13f15
MD5 e38de652397959d8ac537699470b07aa
SHA1 b89f42d13b641b6cd0ab09145d0ea04fee9fb716
SHA512 8d7464466a9892dabd102bd8f5b5f345964aab4343370ec9646b4ab64cbbc578fb8b78940ab1a5a8254d6ba8b98de486af0995dd1b5781b100f00b18181126d6
TLSH
T1B1E072561A44907B4AE80343BF2E40A14EF88EBE021A30AC028F0B04012CF533E2B7A8
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 423B
SHA256 0d78222ee3ca87fa0d6a8224062894be7a737c6d5441f3475e5a401a24b81bc8
MD5 015f9fea97dfd2c435501594a56a2524
SHA1 28855835e72f83ef2eff4f4d020108876e640569
SHA512 d8fa592eeeca0d19e6f609477f92393c41608b154b3ba62d7ddef81680f9bfb3a72f3f037af5d4229af1ff2a1456bfb8073068fbb398e14e90d53502bdc8b926
TLSH
T10DE0AB951B0484679AE903037F1D40A18EF84E7E420B64AC02CF5F04122CF23391B3B4
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 203B
SHA256 46e4f227159af96f58ea1ffc023604bd4f0f2764670cfd272d043314e7329286
MD5 d6c3cd4a102281e547e1dcce6bc7aff2
SHA1 e874b88c7f1eaa95cff3cd8f74e0efbd16d90c5a
SHA512 f50aed61127f4dc3ee299b4314c8afd72c9c392a54a77afad3f0283dad7e57ca1384c75b3cdf37d78746282f914d4ec2dd5f2cb868b88de6f73540926b2b3f77
TLSH
T18ED022190A4041178AD403833F1E81748BF80FBF421E2198838B43140128E532D0E32C
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 269B
SHA256 fa716be357cbdf0e43888409efa5ef6519f09e3182c9088dc3ccffdf6cbe024b
MD5 f8e57b3b9fc5e77d59c5ce5936902f4c
SHA1 d0dd6cb5f3e3eef6a5ca9fd28a3f483482aed46e
SHA512 28619a819dfdc9e3a24a12e238dbebcf502e25dc9be932fab5c258da433578171203e53705e788eceef3c0b7e901647170269b6e0decbef2039bb98f7b8487dd
TLSH
T1BBD02E59060581674AE903877F1E80B04AF58EBF021A20A8038B4714002CFA33A1B2A8
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 343B
SHA256 fda886f4712ddad394c557b65bd5cdced7deefd75a4e34579a87a9767a17fab8
MD5 a05926381b77f0cec10982e16c62c80f
SHA1 138a84dc88a45a931f6d888b7003c8b1db3907e6
SHA512 1c746ba44877c59d70ded88ef96fff1a939e9ff27c084cd246f23ff6ac26a6c58ce06ec024cc946d9258c09917e43418fc248748d78541af0e18de7c2cf635d9
TLSH
T147E02655195490779AE903437F1E40618EF48EBE421930AC028F4B08111CF633A6B7B8
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 84B
SHA256 60b386ad2dd97fca45b2291f2624c31739b806551a80507335aa0450e4e9c52b
MD5 62b5d8486c373b9e78ffa669cc08a100
SHA1 ffb2b011d39bc52de5f1c2bcf501bef2509639c5
SHA512 af0caf27ee28ec9e33c44baa6b35cd7780054595de1cf6bb518bae8849b3b525f418ad62c83c6668d5717f93a8f56e5d7be59d0fbe333629801ddf7c1b6ad2c3
TLSH
T1E6A012400010118788C403513C1C42708FA00E974117010C114A87080064AB5290E628
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\.claude\settings.json
Size 22B
SHA256 27dafb2742d0da69a49cc8d206fc9cc429feff09cc3738addcf590d9c4358f97
MD5 e68695bc4736cceb381db1b5cb327d2d
SHA1 fd9adc3a618f3a3ff4e3d52432f342c680a7b3c1
SHA512 f4d9f6a23eca5c487b6e85875ff5d3ed313356cb2e0aeee1f9fbc38a8464423c3d91421ebafb9a7a4e3f50cf9990e2c5a7a76f35281ff5030e4d66667f3d637a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads