20ac36d927f5106010f069f2b787fddb3aca8e8a93a076c2cafd8ec046d16e61

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shttp3.exe
Size 124KB
Sample261030-g5stfadf98
SHA256 20ac36d927f5106010f069f2b787fddb3aca8e8a93a076c2cafd8ec046d16e61
MD5 68a4d128bf8655df1ea17c21ebe061b3
SHA1 62e65bb9ce28b8bf3ccfc8078dd8636d4eaca18f
SHA512 d52c4369942b0930e0dfe417ac66fb4227b1b1b7c3471b379d4a5f7d251cd587078b9decbadfe3aae9f49620c2659783ca6c3a76f47d735d9ffd3cf4e3e7e3c9
SSDEEP 3072:Om7Zbo9aJ8JrCdkLDTYoILzONBu0JBr2qnOovPel++wOx8:OmG82Jea/cTzOO0JvtOYw
TLSH
T178C31273669296ABD912C5738B6F63919B7AC35093809494408895FFFC782ECFC34B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2888	http.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\http.exe = "c:\\shttps\\http.exe"	shttp3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shttp3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	http.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2888	http.exe

C:\Users\Admin\AppData\Local\Temp\shttp3.exe
"C:\Users\Admin\AppData\Local\Temp\shttp3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3052

\??\c:\shttps\http.exe
c:\shttps\http.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

http.exe

Path C:\shttps\http.exe
Size 96KB
SHA256 5effcda059c723f82b1d29ec212b5193e5c0f5e66f1f859084735ebcbfed6bfe
MD5 b2b922051e3060bf0c0a08fcab7949fd
SHA1 a9ad44077d9d6885a1d288f8f2d81a186351fc40
SHA512 f6c7e203a59159df01c6b54001acf844b1eaa2167b4a670a0f873fc66f880085868d5d2c650755f22c83cf4885f1ecf9e72ff27ebeb71a044652b503c46cd289
SSDEEP 1536:Lm81MlVZoTizljwKfIpqsQsC87kkoLrAA4vqQOzBkEJvkxsMIClRJfBfK5EJypnU:Lm84u0RwdEsdprof4vqxzBvJvWMClR3z
TLSH
T1E3A312B35596AAE8DB15C573871F1714EB39C3049282945862C848FFF8916BCFD34B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http.cfg

Path \??\c:\shttps\http.cfg
Size 37B
SHA256 25a7693031bcc2bb860f765fb5e43a83451ed82e4cdae70e9dd2b7feaac00849
MD5 2472582290b4b2efa9ab56c99faabcc5
SHA1 7cf42d8fa364d6c6238edf7cbaf144eb7dc2ea80
SHA512 98c5a5801d4e3544bfcc39ca45dbb8bf3ed1c5a84a649aa152cc08d8f23f0318e117da233b3fec0a44b5909dfd51f5cac7977988a345f86fb9a77d40f73a237a
MD5 SHA1 SHA512

Submit Download

memory/2888-8-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/2888-12-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3052-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3052-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3052-14-0x0000000000400000-0x000000000042A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads