3723998a293f21bebfbd405bfa55c9eeb07e6587d330a78186e375a8e596a35e

Analysis

user interaction
yes
max time kernel
61s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:42

Target
svt.exe
Size 4.5MB
Sample261027-pxhmhatyct
SHA256 3723998a293f21bebfbd405bfa55c9eeb07e6587d330a78186e375a8e596a35e
MD5 d312eb7efbe2935eea6be2d3f3dc4329
SHA1 e14b4e26591f3822e1b5f7d12a4e825b131b61b3
SHA512 75cc51e16ea1513f0f101f1c71cb3c9da78620b0ab75e322efb05635eefa408284a0e977ff133eec758ec3cb473eb3352ccdbbf417cd27523767f9c7c9c2d645
SSDEEP 49152:ZSyrMfjzTdFTAp3NWlTXgt53iDViQK9m93pKngt53iDViQK9m93pKl+cKb0aztfP:Bo/spw63iUQKU73iUQKU+9KAaz1UjT
TLSH
T1A8260221B6A541DDD2BBE1B48B376907E7723442173065EB02D089AE1F37AD14E7FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	svt.exe
4116	svt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3320	4116	svt.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svt.exe
"C:\Users\Admin\AppData\Local\Temp\svt.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "svt"
  2⤵
  PID:3320

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact