73d9d511a2372403ba903e96160712b0447f987aa6ac12b522874180005d8fa4

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scodeupdate.exe
Size 356KB
Sample261101-b455gsba55
SHA256 73d9d511a2372403ba903e96160712b0447f987aa6ac12b522874180005d8fa4
MD5 a624a18d9d86d9b7e9894f880d80707c
SHA1 550a642d711385f7f122a085434a95519ffc9d10
SHA512 5b84597007b96a7569ef70147316c1dde8c3df4e3bdbcf7a7d494ca79201ac6c4f726178a507d411412874332a73a0fb967fc171567d796331e008183e506316
SSDEEP 6144:lw7Hu0qFciO/qtBjejL3/OFk4fDiMEjRePmX5V+q9BgU:6Stci7ajL2nDZEjRePmX5
TLSH
T1C1746C25EA6808FCE173D1B8CD674802D6727C8E0375AADF239059A21F176E49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\scodeupdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scodeupdate.exe"	scodeupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\scodeupdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scodeupdate.exe"	scodeupdate.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	scodeupdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	scodeupdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	scodeupdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	scodeupdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5136	scodeupdate.exe
4792	scodeupdate.exe

C:\Users\Admin\AppData\Local\Temp\scodeupdate.exe
"C:\Users\Admin\AppData\Local\Temp\scodeupdate.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
PID:5136

C:\Users\Admin\AppData\Local\Temp\scodeupdate.exe
C:\Users\Admin\AppData\Local\Temp\scodeupdate.exe
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads