ef54981c57651894e2d55d52783504c4f1914df26e609122f3de0c21046e649b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64da6bd5_.exe
Size 284KB
Sample260709-wtbhcaf13w
SHA256 ef54981c57651894e2d55d52783504c4f1914df26e609122f3de0c21046e649b
MD5 f3802fab90bd72afa7dbde86cfe5853f
SHA1 8a3eb41b80d3cb596e2bde974140ac34f8daefbf
SHA512 eab56e8a12b381d520c9483df3eedfa027a37b70552ba9d4ab83545788fb3c53bffd666e1085f20e3d85ed9cf6cbf68fa7dc7731398dce239d7d5bfa8b9b48ad
SSDEEP 6144:T9rzTqJHwyXPZpHr+GQEtD4c/WArEkpx/b134h4P:T9LEzXPZpHr+GQEnf1xj1Iq
TLSH
T17A543B3897E79D72DADC4779D0129006BBF1660787C6F36B10585AE09C033E4E662BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\$pwnWindowsHealth.exe"	64da6bd5_.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3932	powershell.exe
3932	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3516	Process not Found
4852	$pwnWindowsHealth.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5304	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
5084	64da6bd5_.exe
3932	powershell.exe
3932	powershell.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	64da6bd5_.exe
Token: SeIncBasePriorityPrivilege	5084	64da6bd5_.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeShutdownPrivilege	3516	Process not Found
Token: SeCreatePagefilePrivilege	3516	Process not Found
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe
Token: SeDebugPrivilege	4852	$pwnWindowsHealth.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1916	5084	64da6bd5_.exe	88
PID 1916 wrote to memory of 5936	1916	cmd.exe	90
PID 5084 wrote to memory of 4256	5084	64da6bd5_.exe	91
PID 4256 wrote to memory of 2100	4256	cmd.exe	93
PID 5084 wrote to memory of 3932	5084	64da6bd5_.exe	94
PID 3516 wrote to memory of 4440	3516	Process not Found
PID 5084 wrote to memory of 5032	5084	64da6bd5_.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\64da6bd5_.exe
"C:\Users\Admin\AppData\Local\Temp\64da6bd5_.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /delete /f /tn "WindowsHealth" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn "WindowsHealth"
    3⤵
    PID:5936
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /rl highest /tn "WindowsHealth" /tr "\"C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe\"" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /rl highest /tn "WindowsHealth" /tr "\"C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming" -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\64da6bd5_.exe" -ErrorAction SilentlyContinue; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF846.tmp.bat""
  2⤵
  PID:5032
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5304
- - C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe
    "C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe"
    3⤵
    PID:1248

C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe
"C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe
"C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe"
1⤵
PID:4800

C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe
"C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe"
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BasicRootkit.dll

Path C:\Users\Admin\AppData\Local\Temp\BasicRootkit.dll
Size 13KB
SHA256 034ba1de657750175614a6670f006f5bb4ebce820315b4c8cfe2976bbe9d2ba1
MD5 083fbf5c10380b49171d55f6096ee05a
SHA1 d58ac48b772e476843fe98cc7403d6f312a5d94a
SHA512 a632824d6ff0e29bd6ed71ee6c88fb1d92d4783c498fa011f20dddb949fe0c600c824e111b5460bf135fa62649428ef108fa09253d8d807f76bffc6db4b1302d
SSDEEP 192:V0hbd0XezCMrLti3Y9krHtsP8KwmdkVMVwCgTA8R:ihp0X8txLGW7Vw4
TLSH
T1CB520A8AFB0954E9C97F40F9C8775E1AE2F9B410472267AF072052590EF23D2B17EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpF846.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF846.tmp.bat
Size 161B
SHA256 435640fa33a040eb1bf1b976b4e8613c4a816bd2eb19b32362a1c64b0833004f
MD5 17005848dd505213f27e06401b49e473
SHA1 9cd58be07aa92896cc32e9c3000e4579a691a2fd
SHA512 6de2276a169e6cec4d693fe675a98f53c6e1957e470790f586f25694d12ade5adfc9a4b9952518146ffb351e1487780756aa2889702d88d5d23530d543d42d50
TLSH
T13AC0804169D5E55E2405141306BBD5DD92765D153F41A70087045509758045EF4E5281
MD5 SHA1 SHA512 TLSH

Submit Download

$pwnWindowsHealth.exe

Path C:\Users\Admin\AppData\Roaming\$pwnWindowsHealth.exe
Size 284KB
SHA256 ef54981c57651894e2d55d52783504c4f1914df26e609122f3de0c21046e649b
MD5 f3802fab90bd72afa7dbde86cfe5853f
SHA1 8a3eb41b80d3cb596e2bde974140ac34f8daefbf
SHA512 eab56e8a12b381d520c9483df3eedfa027a37b70552ba9d4ab83545788fb3c53bffd666e1085f20e3d85ed9cf6cbf68fa7dc7731398dce239d7d5bfa8b9b48ad
SSDEEP 6144:T9rzTqJHwyXPZpHr+GQEtD4c/WArEkpx/b134h4P:T9LEzXPZpHr+GQEnf1xj1Iq
TLSH
T17A543B3897E79D72DADC4779D0129006BBF1660787C6F36B10585AE09C033E4E662BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3516-30-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/3932-33-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-35-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-45-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-43-0x0000025DB5090000-0x0000025DB509A000-memory.dmp

Download

memory/3932-40-0x0000025DB4FD0000-0x0000025DB5082000-memory.dmp

Download

memory/3932-39-0x0000025DB4FB0000-0x0000025DB4FCE000-memory.dmp

Download

memory/3932-36-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-34-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-32-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-31-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-29-0x0000025DB4F20000-0x0000025DB4F42000-memory.dmp

Download

memory/3932-26-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-23-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-24-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/3932-25-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-10-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-9-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-3-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-13-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-12-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-0-0x00000156CF3C0000-0x00000156CF40E000-memory.dmp

Download

memory/5084-14-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-11-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-4-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-5-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-8-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-2-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-7-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-6-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-47-0x00007FFDAA240000-0x00007FFDAABE4000-memory.dmp

Download

memory/5084-1-0x00007FFDAA3CF000-0x00007FFDAA3D0000-memory.dmp

Download