Analysis
- user interaction
yes - max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Snowhush-Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Snowhush-Setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Snowhush-Setup.exe
- Size 1.1MB
- Sample261027-1bqxjagy6m
- SHA256 07271ee4bf7ca2649627b486ec7ef1ee8536b553ca94c46d609eda4e52fd7740
- MD5 5415717b00e9a476a359de9bd886ed57
- SHA1 8001b7af00316cf980d0ac53c4af6cc36f1d5bd8
- SHA512 87e2b289bbae53d7772e9630ac8835a15114fc9dca2e237026486e745d28d04f08c78cbbaa554837afb57663912a1262da813c7e174f8537dfd2943bd26cd98c
- SSDEEP 12288:GOMtKmH4+MfDs41Y2JLLCjZbYjjLhk6LZCta+Rul+Tz0+Tg+Tx20+T:GOMtEQq7JLLCNkLe6LZwYoz0ogox20o
- TLSH T176359D02B6A291FCD05AC076C2155A73BA72788A0B31BEFB139446353F65BE51F3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5984 Snowhush.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Snowhush.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Snowhush.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5984 Snowhush.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe 5984 Snowhush.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5820 wrote to memory of 5984 5820 Snowhush-Setup.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snowhush-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Snowhush-Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Programs\Snowhush\Snowhush.exe"C:\Users\Admin\AppData\Local\Programs\Snowhush\Snowhush.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5984
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Programs\Snowhush\Snowhush.exe
- Size 709KB
- SHA256 1040510cedbf3df6476e2b03c81a53a0f7d1f75bdd211fc0505796af95162139
- MD5 8c03328064bba4fab354c0af437a00cc
- SHA1 09a3a29b4650d6329364e2e30dfde12faccdc4f2
- SHA512 5fd7d122bcad31a3463674b2e1545106fedd3181088d276af9bbd6ba1ec2234ba62637f2caf3372ba0b1fad246181af1d33d2de92631a680aea739951b726322
- SSDEEP 12288:Fs41Y2JLLCjZbYjjLhk6LZCta+Rul+Tz0+T:uq7JLLCNkLe6LZwYoz0o
- TLSH T1A3F49D12F6A291FCD15AC036C2156633BA72788A0731BAFB579446343F65BE91F3EB04
- MD5 SHA1 SHA512 SSDEEP TLSH