84304f7d4b0cd0ebcbe8318695a260151b48991a6659c3366fdd5da290c0ab91

Analysis

max time kernel
152s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
claude.exe
Size 237.6MB
Sample261003-krss3avcjf
SHA256 84304f7d4b0cd0ebcbe8318695a260151b48991a6659c3366fdd5da290c0ab91
MD5 d79ea4043903968209aed0f4bc2049b9
SHA1 2041f5acb1da00631afbcdadb33be111436b99be
SHA512 26c33772c425f32ad3c2596401f981f90c1bab0630fea6b20848083c805a3cd09af6225de48e7c6d557246d661412556e4b353f636ad67ed63b79c1b8b08fe57
SSDEEP 6291456:dLiLzHeZ3i/cot5YtPUkcV00Ktyl48mcTFPa2r9bTRLBJIrxaFRE+1qVRbyor0ci:VIkk
TLSH
T1CBC89C43F7C0A515CC5585709916E6B13B32F8801B3A6697729CEB3C2F28ED05BBE729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	claude.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5992	reg.exe
2312	reg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5992	4876	claude.exe	90
PID 4876 wrote to memory of 2312	4876	claude.exe	91
PID 4876 wrote to memory of 1280	4876	claude.exe	94

C:\Users\Admin\AppData\Local\Temp\claude.exe
"C:\Users\Admin\AppData\Local\Temp\claude.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:5992
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:2312
- C:\Windows\System32\where.exe
  C:\Windows\System32\where.exe git
  2⤵
  PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.claude.json

Path C:\Users\Admin\.claude.json
Size 167B
SHA256 0c5b180d0a9cafc5612a134f115f860e6928fe811f0f0fd4efe58dd09156ff61
MD5 3ff1571f050144212746bdea0137269f
SHA1 dd38c531e65bb7023ee142719fdba3a19193406f
SHA512 81d0b6f3da7f647c80726d9340624ad63de57de482f1e69b26243b3c2ade371dc8dfef777d26db5a250ca1ee181ee2f2ed7bb383e178b4c526c122a33ad4a7a5
TLSH
T163C01212216860AB69C023E46C2C8120CBA42F63826226CE234A97184A65A66A61A678
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 464B
SHA256 7ed54f9a58a0944295212c09e7b710149691f8c5f112e011277f9b67bbf3f74f
MD5 3fcf732f547c231e3f83c13be2940b6b
SHA1 7964795f83be3cd2a0a098fe0d9ab7d94c2091b2
SHA512 e85ab23278454f583cd0e81f7310b5883605b368b6f36ee3390b07f5c94b48a80390389716d07b452fdd7fd23bfa00ba81668cbe9c2016036f0be2e31f5b1b4b
TLSH
T1CAF0DC623218A0B71AE01367BE6C50128EF88F7B0206309E134F9B08021CB67323F379
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 84B
SHA256 ae37582584bae543e0fa1ea8f12d350d26cdf57d655e4f1dd378c4c17f0c18e0
MD5 043c244f5e8eb9d384cdea1a75cad08d
SHA1 2466d518c32065d6b60fe298eb05b265cf019ee4
SHA512 ad7818c285f416d6f4e99c65c43e10dc1631fc638cbf4696d221fdc8cd251d36a9917e937f5d1506cf7c45de82602b2fbf82706eabd54710fb5ff80efb08b6e5
TLSH
T181A012010010214798C003603D5C8130CFA00F930106050C160A87080064AB5551E5B8
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 423B
SHA256 ab3e49cc6416c5e68beb4ae035586e9293dd2f65268d0b3ab54ddc2396926c49
MD5 7bd9a64eff279edf3590a9daeeab841a
SHA1 f43f638dee6d5737cd9c66f09ea487321dad763b
SHA512 117684cb13da89f1c2f7829d05dc081fbd8225565b40736018a060adb53fc263479d8bf6d216e49670eb25c27b749ca9487836418cc71a855a214bff834f31de
TLSH
T151E0A351261870B75AD013577D5C401589B88E6B0246209E174B5B18030CB67323B379
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 203B
SHA256 453b1acc30fc269c37766168d5ac040a295db8b2c61303f97ae790fb137ac41c
MD5 34a0fcfa7ab16525868d602cad103026
SHA1 bb2c6881d400ebf7d9db4ec705bd1775ecab0a08
SHA512 737370c94021c30d46a5a947ac827dfb402c8162938ea418ba376546c99abc0151240f151c685a9cd6a755f34af748e28f8ed6e2351ab7578789a5bccbfe6c97
TLSH
T1E3D022022224A0AB1AC113E5BE1C8020CBB42F63421325CD638FC3280619EA3631E17D
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 242B
SHA256 69e7005a904d57f1cb7243ea00ab60033121b476a652e13c3677f756c4081006
MD5 d7e435738a50b636ba38703dc149f2ed
SHA1 2e945fcf5ac4fe67810c258fead6e8c8d45b4cb0
SHA512 651cbcf53f5cc02c2df20e14cfa2ee74fa187fc13e17d3e00fb61e826a41e8475ef2f53c8fea516ab7725bdff608fc330ba7c580cd4f04baecb1f70a8f29765f
TLSH
T167D05E412225A0AB1AD153A6AE5C80218AB45E674256299D638B87180619EA3731B1BD
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 269B
SHA256 ec821a320d11205d6d4d07448058f6871c079ee593491390ae4194ba97c546bc
MD5 f136ef36a78387936633e5437c369ce1
SHA1 0243fb22d8bbd1fc01cb5d504676dabe3af3a14e
SHA512 c102dec585564d3b85ce2af3e56aa2dc24c17e4729d9c0fc527051b78077fa638f510f4784eb9b901da2f6735e83a7b9b0bff64967067eb41066fac38a3e50ff
TLSH
T1BCD02B41222590BB1AD113A6AF5C40108AB09E6B0252248C23CB87180518FA3731B1BC
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 317B
SHA256 fee99f2dcd7bf893c75ce8a6c3803bc366e9c26796ea41efff5dd43ce6f1f91c
MD5 da8c62ddedc801578093801e51be84bb
SHA1 eb879124d66e9695e23366bb567b885c3494ff93
SHA512 ee9f515a73cda87b93c54bf73eee4afc5310bc1b08b282a9aeb93b8a3fa87f96e00a3b2204c68b60949b9ac653ebef006d42542cd6732d63c4ee09e9d95e61f4
TLSH
T1E1E07D422224A0BB1AE11396BE1C40118D749E5B0252249C13CF8B18020CF63732B5B8
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 343B
SHA256 151e4afd6a8e1d5c5fb889a0498e3e7da7ec9be3439e3cfb4ecdbaa4749c0175
MD5 71a3bf48f061115372fc465c6f2aeaa5
SHA1 c5018c632602a83b4478cd08021df5042f4872cd
SHA512 1d0482c477556e09764b80d8be1e09d800022026b03ec7c921930754f5514c15d0d8dea475940a79f57fe931dbdbdd757074227adfe67c897f3029caa1777785
TLSH
T164E026522228A0BB5AE113A6BE5C4011CEB49E5A425224AC138F8B18020CF67732B6B8
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads