61fcf11e431a34c80d90e8af7f1d6b11eed82397ad21cc986648af0ffeb7e4d3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
898s
max time network
894s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 5.4MB
Sample261020-h66blaew2w
SHA256 61fcf11e431a34c80d90e8af7f1d6b11eed82397ad21cc986648af0ffeb7e4d3
MD5 c79fd7ae32f88a183aa40ba8d6b266c0
SHA1 c1dc6af2ce2995a9721e1959c7f00ee832497af5
SHA512 9b2374d5e82928c604d5c5e209fe9dfd5889dd2e7d878fcb077becfdafe3178d19cfbfb50bd4e936ecfb3a0a8a4dcc175e4ff3cdcd8cf51142fe353d174b5fd2
SSDEEP 49152:svNP0wB6rJBAgTZKW8iyyaluQ7z35x0bR9Ozjc5EBcLJPb4h5J3:sF6BVWpx0zEqND4r
TLSH
T121464A07FCA549E9C0AED635896692537A71BC485B3423D72F60F7382F72BD0AA78740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1960	install.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3932	cmd.exe
4248	ARP.EXE

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5848	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\AhnLabV3.213\install.exe	install.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2688	sc.exe
3524	sc.exe
3284	sc.exe
4396	sc.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
1984	cmd.exe
3852	cmd.exe
1476	cmd.exe
4724	cmd.exe
996	cmd.exe
3024	cmd.exe
3236	cmd.exe
3360	cmd.exe
2712	cmd.exe
4980	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3852	cmd.exe
2564	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5148	ipconfig.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2564	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4192	install.exe
1960	install.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	whoami.exe
Token: SeDebugPrivilege	5848	tasklist.exe
Token: SeDebugPrivilege	3220	whoami.exe
Token: SeDebugPrivilege	4384	whoami.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4532	1960	install.exe	91
PID 4532 wrote to memory of 4976	4532	cmd.exe	93
PID 1960 wrote to memory of 1984	1960	install.exe	94
PID 1984 wrote to memory of 5848	1984	cmd.exe	96
PID 1960 wrote to memory of 3360	1960	install.exe	98
PID 3360 wrote to memory of 5148	3360	cmd.exe	100
PID 1960 wrote to memory of 3852	1960	install.exe	101
PID 3852 wrote to memory of 2564	3852	cmd.exe	103
PID 1960 wrote to memory of 1476	1960	install.exe	105
PID 1960 wrote to memory of 4724	1960	install.exe	107
PID 4724 wrote to memory of 3220	4724	cmd.exe	109
PID 1960 wrote to memory of 996	1960	install.exe	113
PID 996 wrote to memory of 2688	996	cmd.exe	115
PID 996 wrote to memory of 912	996	cmd.exe	116
PID 1960 wrote to memory of 3024	1960	install.exe	117
PID 3024 wrote to memory of 3524	3024	cmd.exe	119
PID 3024 wrote to memory of 3764	3024	cmd.exe	120
PID 1960 wrote to memory of 3236	1960	install.exe	121
PID 3236 wrote to memory of 3284	3236	cmd.exe	123
PID 3236 wrote to memory of 6136	3236	cmd.exe	124
PID 1960 wrote to memory of 2712	1960	install.exe	125
PID 2712 wrote to memory of 4396	2712	cmd.exe	127
PID 1960 wrote to memory of 3932	1960	install.exe	128
PID 3932 wrote to memory of 4248	3932	cmd.exe	130
PID 1960 wrote to memory of 4980	1960	install.exe	131
PID 4980 wrote to memory of 4384	4980	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4192

C:\Program Files\AhnLabV3.213\install.exe
"C:\Program Files\AhnLabV3.213\install.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\cmd.exe
  cmd.exe /C whoami
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\System32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Windows\system32\cmd.exe
  cmd.exe /C tasklist
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\Windows\system32\cmd.exe
  cmd.exe /C "ipconfig -all"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\System32\ipconfig.exe
    ipconfig -all
    3⤵
    - Gathers network information
    PID:5148
- C:\Windows\system32\cmd.exe
  cmd.exe /C "ping 192.168.11.81"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\System32\PING.EXE
    ping 192.168.11.81
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2564
- C:\Windows\system32\cmd.exe
  cmd.exe /C "setintervval 3"
  2⤵
  - Executes a command shell one-liner
  PID:1476
- C:\Windows\system32\cmd.exe
  cmd.exe /C whoami
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\System32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\Windows\system32\cmd.exe
  cmd.exe /C "sc query type= service state= all | findstr /i \"AhnLab V3\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\System32\sc.exe
    sc query type= service state= all
    3⤵
    - Launches sc.exe
    PID:2688
- - C:\Windows\System32\findstr.exe
    findstr /i \"AhnLab V3\"
    3⤵
    PID:912
- C:\Windows\system32\cmd.exe
  cmd.exe /C "sc query type= service state= all | findstr /i \"AhnLab\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\System32\sc.exe
    sc query type= service state= all
    3⤵
    - Launches sc.exe
    PID:3524
- - C:\Windows\System32\findstr.exe
    findstr /i \"AhnLab\"
    3⤵
    PID:3764
- C:\Windows\system32\cmd.exe
  cmd.exe /C "sc query type= service state= all | findstr /i \"AhnLab\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\sc.exe
    sc query type= service state= all
    3⤵
    - Launches sc.exe
    PID:3284
- - C:\Windows\System32\findstr.exe
    findstr /i \"AhnLab\"
    3⤵
    PID:6136
- C:\Windows\system32\cmd.exe
  cmd.exe /C "sc query \"AhnLab V3\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\sc.exe
    sc query \"AhnLab V3\"
    3⤵
    - Launches sc.exe
    PID:4396
- C:\Windows\system32\cmd.exe
  cmd.exe /C "arp -a"
  2⤵
  - Network Service Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\System32\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    PID:4248
- C:\Windows\system32\cmd.exe
  cmd.exe /C whoami
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\System32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2312

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.exe

Path C:\Program Files\AhnLabV3.213\install.exe
Size 5.4MB
SHA256 61fcf11e431a34c80d90e8af7f1d6b11eed82397ad21cc986648af0ffeb7e4d3
MD5 c79fd7ae32f88a183aa40ba8d6b266c0
SHA1 c1dc6af2ce2995a9721e1959c7f00ee832497af5
SHA512 9b2374d5e82928c604d5c5e209fe9dfd5889dd2e7d878fcb077becfdafe3178d19cfbfb50bd4e936ecfb3a0a8a4dcc175e4ff3cdcd8cf51142fe353d174b5fd2
SSDEEP 49152:svNP0wB6rJBAgTZKW8iyyaluQ7z35x0bR9Ozjc5EBcLJPb4h5J3:sF6BVWpx0zEqND4r
TLSH
T121464A07FCA549E9C0AED635896692537A71BC485B3423D72F60F7382F72BD0AA78740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download