3d343daa888e30d5d0e02e811ff847350136a6a9abf46ee020d2aff2672a16ea

Analysis

max time kernel
28s
max time network
29s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/10/2026, 22:22

Target
setup.exe
Size 258KB
Sample261022-2an7zsys3p
SHA256 3d343daa888e30d5d0e02e811ff847350136a6a9abf46ee020d2aff2672a16ea
MD5 30c71e35f983df666d188ab021f2a2ba
SHA1 23b7ab96c08d4d731186a685fec1c5d672073771
SHA512 858092d7c02d13a648cff5aac41253069b038c182e360dac470c819fa0236821d996a8b29c36055b57ac35d698e0b6c678e6dbc7be80cfa44cecad16a37cf139
SSDEEP 6144:lfWS5FYJSzhVjzr7wFhIhJZVZDMJQHbVYPt3gYX:lluAznjzP4W1VZDM3PtX
TLSH
T1D2445A5A73B40CE8F823817DC592DB06EB72B8524760E6CF47A086576F236E19C3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	Calculator.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3120	4420	setup.exe	82

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:3120

C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3752

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact