c03877c24f26d2f98f5ce3f198422b4554c828739cf138bc4dd354287399db8e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.4MB
Sample260702-e7ctwsas5j
SHA256 c03877c24f26d2f98f5ce3f198422b4554c828739cf138bc4dd354287399db8e
MD5 ccb55de575bef37521816444fbf59169
SHA1 f3dc17dd14b74a44da255886f749dd204a998984
SHA512 2e1c1d2827bd660d6f2c37910c3003c7e45630967ac1613abc2bac5f25bcd5c4c1da9b3cd8a40f86f2173b2e7c1ac7c4ff31ff9df5aa557948056be73444d504
SSDEEP 24576:smnLG+qW3YBc39lWG3PvSB1YhBuv4yg9yg8yglyg0yg1yg8N3C8lAAIpnugejRgG:u1Y7yg9yg8yglyg0yg1yg8xZilFugkx7
TLSH
T15765CF4FFAAA03F4D479C079D0117212FAB078124720AEEB76962D674E67EE45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4300	WindowsHelper.exe
3492	WindowsHelper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4300	4436	file.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
  "C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:4300

C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
1⤵
- Executes dropped EXE
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHelper.exe

Path C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
Size 676KB
SHA256 f8198bd9e782ceffe1ec60cc51f37dc14ba50e593bf958fc22d00f5ee5b4e815
MD5 833fc67c895fb218620de10ba579f71a
SHA1 867ce882d15fd237c790953e327f19db500a1aa3
SHA512 6cf1f8d83c59c31415a0bb66c3efd71b02156d47b774896363bbc45a35449543b2e9abca402531c1d341992edddbc46e312c60f1bbb1f6634ba76c8363e076d3
SSDEEP 12288:g2/hJw3o0evtNx/q75cryG9SC+PzJiCbJ4U54pG+8oh4EtG:BJJ/zg2ryYR+PzJiSCk4pGFe4s
TLSH
T124E47C5FFAAD07F5C539A1B6801052017BC1B8168F10AEAB756A3DB20D6BDEC4F39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download