58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9.exe
Size 4.6MB
Sample260703-g1pafscs21
SHA256 58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9
MD5 a88d0448596e6fbaf86dc025581c6817
SHA1 f43c93b4d71d8035a6467d95b92a7dc7b729c63a
SHA512 61ed4a9a0eaa185a63fcaf449dee4c1372fdf4431253b47ae80843a6e9c87b8407bdc66db3e77cf1c45532f6d5bae4df66fe77007b8935eb8a1a3e68fdf33cf4
SSDEEP 49152:dlsdxuqvFwmv/TaN8++LkPgg1YmGXiJZfVkmsMuY7uRrHGcSKdG9mVz6ZByPR+I8:diX59IqWMRpRmk4wVIDPZkhiJ
TLSH
T1A836BF4FFAA907F8C93DA1F550149202BAC178028F20EE6F78573D660D7BEA85E35B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1340	WindowsHelper.exe
4684	WindowsHelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1340	2596	58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9.exe
"C:\Users\Admin\AppData\Local\Temp\58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
  "C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1340

C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
1⤵
- Executes dropped EXE
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHelper.exe

Path C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
Size 1.6MB
SHA256 6171cdce0230987a5f88871afd118c4a102e2cbe3d00977de4e7ede9cfb2b855
MD5 58146083d21e65e63c52e5d249208ce2
SHA1 bbc721a4584e3cda1f9fd006edb466326fe8ea82
SHA512 15f037657a694c016cce1f0503c9753e6990a0725047e0b5d90d9d4f58ce58066e86276436d136984b193032f72925c32abe7c41d8122bc7112f022f51f33813
SSDEEP 24576:4zEZSoC94pt3AnF6QirpQekE42qxnF5jrIZiEeyA/pzV7fNLHp:KsZ3Qx8pQekE424soEeyA/p
TLSH
T1F675BF1FB79903D9D13A81BD84959341FAD1B8054B30AEDB14692DEA1E27EEC0F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download