6faf7305719e418860f6d60cbd0295227f1468f3348e624d3a5827bf4420f8c4

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6faf7305719e418860f6d60cbd0295227f1468f3348e624d3a5827bf4420f8c4.exe
Size 2.2MB
Sample260709-rda5esbx3l
SHA256 6faf7305719e418860f6d60cbd0295227f1468f3348e624d3a5827bf4420f8c4
MD5 f52d1f3565a013ef78c7482c59f7e34c
SHA1 de20113b157edb98c9cf3afc427a5f26d8dd8b7d
SHA512 7a7829c4194886e916d0c5525f75f25301071db6de7e96846d2c7fec0eb1167a3e64cb5f0035fc36dda29cfecc4bc08fa652697881aabdc88024c168abbbf5af
SSDEEP 24576:k1+wuqT5PcnlHc9HcwRc6HcwFcj5cylHcTHcPHc6ia3FiMOaMktEih7MY2lQK6IS:kAJqTFp/aMX3K/adI75vaTyxGjzPLmB
TLSH
T1B5B5010FEA9903F9C83995F490119221B795B8168F50DEFB39693D3A5D67EAC0F36B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2764	WindowsHelper.exe
2392	WindowsHelper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2764	2552	6faf7305719e418860f6d60cbd0295227f1468f3348e624d3a5827bf4420f8c4.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6faf7305719e418860f6d60cbd0295227f1468f3348e624d3a5827bf4420f8c4.exe
"C:\Users\Admin\AppData\Local\Temp\6faf7305719e418860f6d60cbd0295227f1468f3348e624d3a5827bf4420f8c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
  "C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:2764

C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
1⤵
- Executes dropped EXE
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHelper.exe

Path C:\Users\Admin\AppData\Local\WindowsHelper\WindowsHelper.exe
Size 1.6MB
SHA256 624d60a2b31bff63d6b495bcbe706e5bfd1217e41d477f393cf84b637a4bcf4c
MD5 bf24bb7f8aa0c82dfe0a28da0f1aae90
SHA1 8e42b4014025a16683cc07942e6b342757758921
SHA512 7579efe300a2851357f6d2ee1b0cef99bd3cd06eaf479580961a57cb9ac89426a5770a4f14dd36c28a935592610b943161c6c055ffb12eacc80d0521c0c4d991
SSDEEP 24576:Apx/stdtndL84WO+8yi2ZTSR9s6nYJdKPadU/kb7SVBsSl8:MktTdLq8yiDc0AU/kK
TLSH
T13875BF5FB79813D9D13A817D84A59741FAE1B8054B209FDB109A2DEA1E27EEC0F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download