1f68a34dae60f58331ee5523db8215243df5312108ee2ec2e3dea1d78de00485

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msu.exe
Size 4.7MB
Sample261024-ea23hsstcs
SHA256 1f68a34dae60f58331ee5523db8215243df5312108ee2ec2e3dea1d78de00485
MD5 705fa5067334d72fa90ddf4d3316d4eb
SHA1 b5a4149f12a8fe8be5462eeb53c031d7f43028ff
SHA512 f5136ec678eb1f33ba2516adba61f3605e5766b0cc25025b41262b98de60521af3ee3573185b5b7cf0e2fa301a649b87edf47c14179646416844d1cee3f3d1f3
SSDEEP 49152:EPLIzKIeuqANwW/g7UQbThgk1GekT8kpYpW+dCT2v:EWPsNweORpYAmt
TLSH
T17D366C06BEA105DDC49BD23CC8AB52427AB97C484B3673DB1F00B6392E767D09A7CB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msu.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4348	msu.exe
4348	msu.exe
4348	msu.exe
4348	msu.exe
4348	msu.exe
4348	msu.exe

C:\Users\Admin\AppData\Local\Temp\msu.exe
"C:\Users\Admin\AppData\Local\Temp\msu.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-0-0x000000014D2B0000-0x000000014D388000-memory.dmp

Download

memory/4348-1-0x000000014D2B0000-0x000000014D388000-memory.dmp

Download

memory/4348-2-0x000000014D2B0000-0x000000014D388000-memory.dmp

Download

memory/4348-3-0x000000014D2B0000-0x000000014D388000-memory.dmp

Download