3723998a293f21bebfbd405bfa55c9eeb07e6587d330a78186e375a8e596a35e

Analysis

user interaction
yes
max time kernel
28s
max time network
18s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svt.exe
Size 4.5MB
Sample261027-pxhmhatyct
SHA256 3723998a293f21bebfbd405bfa55c9eeb07e6587d330a78186e375a8e596a35e
MD5 d312eb7efbe2935eea6be2d3f3dc4329
SHA1 e14b4e26591f3822e1b5f7d12a4e825b131b61b3
SHA512 75cc51e16ea1513f0f101f1c71cb3c9da78620b0ab75e322efb05635eefa408284a0e977ff133eec758ec3cb473eb3352ccdbbf417cd27523767f9c7c9c2d645
SSDEEP 49152:ZSyrMfjzTdFTAp3NWlTXgt53iDViQK9m93pKngt53iDViQK9m93pKl+cKb0aztfP:Bo/spw63iUQKU73iUQKU+9KAaz1UjT
TLSH
T1A8260221B6A541DDD2BBE1B48B376907E7723442173065EB02D089AE1F37AD14E7FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4656	svt.exe
4656	svt.exe
4656	svt.exe
4656	svt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5264	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4656	svt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2332	4656	svt.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svt.exe
"C:\Users\Admin\AppData\Local\Temp\svt.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "svt"
  2⤵
  PID:2332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads