Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
notepad.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
notepad.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target notepad.exe
- Size 11.9MB
- Sample261107-3a2zhsge35
- SHA256 ceafbeea65301f77a71e2bbf8d87c3d93fd5047a979084f81dbd3bb3bc7f49e3
- MD5 633963e21f93a63df0d93aae444eeca9
- SHA1 aa16446add7e4a4741a4b1f3617a73b68b6f56ed
- SHA512 3ae6559e9fa51c4092f21e283fc39d61f121381a031a4a842c5eb71382913fa7d0879f9921cd0348769c6932d9e6c528de31f5e296e671d611f0a430e1a3e639
- SSDEEP 98304:d32IooKXIE+XUDeLfeDt9ygF8Ut7w2w16tCSwKTYEygmYhC8aSl0wI+vCB2lmWE:lKXIE+XUDeLfeZ9ytUABoY8palh+vFQb
- TLSH T15BC65AE330C7A6EDC447C57A4313FD7F999F703A0626A8E75188A6326D26C943B25F09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain notepad.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname notepad.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe 2188 notepad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2188 notepad.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Artemis\cache\guard.old.608d6af4fc28ac0f.tmp
- Size 262B
- SHA256 441c016b492f950a7536330a36edfc639abab10a24a9fc038e3da248e7fe6186
- MD5 a02206724c4e98f557af88d910d3722a
- SHA1 104a089ff9b72c30028518aca7f852989b514464
- SHA512 1e176ae7f9d28c986e38828f5d30dfb8c227b74e67695d355e54d1684f9e036a20a27d521a678aef5fcdefa7a73b832404e869d1f39d8e536dbaeec4e04b6b84
- TLSH T148D095DC55F06347C0D93FF01D1755081C870D70B9E3DB24D54929682569611C11CF70
- MD5 SHA1 SHA512 TLSH