3d343daa888e30d5d0e02e811ff847350136a6a9abf46ee020d2aff2672a16ea

Analysis

max time kernel
30s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:22

Target
setup.exe
Size 258KB
Sample261022-2an7zsys3p
SHA256 3d343daa888e30d5d0e02e811ff847350136a6a9abf46ee020d2aff2672a16ea
MD5 30c71e35f983df666d188ab021f2a2ba
SHA1 23b7ab96c08d4d731186a685fec1c5d672073771
SHA512 858092d7c02d13a648cff5aac41253069b038c182e360dac470c819fa0236821d996a8b29c36055b57ac35d698e0b6c678e6dbc7be80cfa44cecad16a37cf139
SSDEEP 6144:lfWS5FYJSzhVjzr7wFhIhJZVZDMJQHbVYPt3gYX:lluAznjzP4W1VZDM3PtX
TLSH
T1D2445A5A73B40CE8F823817DC592DB06EB72B8524760E6CF47A086576F236E19C3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 940	4664	setup.exe	88
PID 940 wrote to memory of 6136	940	calc.exe	89

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6136

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact