b392a070e84aa7048435520c8739ef8b1ee8240887a9a992103049f5c2504108

Analysis

user interaction
yes
max time kernel
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
leEF.exe
Size 128KB
Sample260716-wdk2vaes2x
SHA256 b392a070e84aa7048435520c8739ef8b1ee8240887a9a992103049f5c2504108
MD5 5dc2f224fd26dab59f6a0d860fda887b
SHA1 542cd9e327e7195690c322de50d154493fdd90bf
SHA512 1f3a575a470fd97d023be018c799ffb1fa9385eae3cda024f9af41a729617651b063cea4ff9a1a9ec3500a71ad758ecb98d9ad9b2d008d81f53d4039b4dc003e
SSDEEP 3072:M/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSaWN:Ptzsb5Uh28+V1WW69B9VjMdxPedN9ug/
TLSH
T1E5D3275BB2E01189EBB581F6D5920786EB7074721721A3DB1B7423B71B2B8C59F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

execution persistence

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4900	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4340	2844	leEF.exe	88
PID 4340 wrote to memory of 4344	4340	cmd.exe	89
PID 4340 wrote to memory of 4900	4340	cmd.exe	90
PID 4340 wrote to memory of 5052	4340	cmd.exe	91
PID 4340 wrote to memory of 2376	4340	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\leEF.exe
"C:\Users\Admin\AppData\Local\Temp\leEF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\60F2.tmp\60F3.tmp\6104.bat C:\Users\Admin\AppData\Local\Temp\leEF.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\xcopy.exe
    xcopy /i /y "C:\Users\Admin\AppData\Local\Temp\modules\*.exe" "C:\Users\Admin\AppData\Roaming\WinDllArchx64\"
    3⤵
    PID:4344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "\WinDeffenderStartup" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\WinDeffenderStartup" /f
    3⤵
    PID:5052
- - C:\Windows\system32\cmd.exe
    cmd /c "python --version >nul 2>&1 && python main.py || (py --version >nul 2>&1 && py main.py || (echo Python not found & pause))"
    3⤵
    PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6104.bat

Path C:\Users\Admin\AppData\Local\Temp\60F2.tmp\60F3.tmp\6104.bat
Size 1KB
SHA256 942697cb26ab75af4fb0b241a6c20da1c2d0c2480915ff5f65375af2c8b8cbf8
MD5 831bac896c7af3ec4c9a2aabe90b7906
SHA1 12c8f34c751760781322dbd64278e474da728143
SHA512 1649ea0756fc9273156c46113c84bbe4b55f9c37fbe586134d7038d9025f96bb3f4833d9e469987a633990aa674d47109c14b71d7bc28b5b55e2cb1d9f031709
TLSH
T1D031665D394C7E2D4A05CAFAADC65B0133EA40FB510425CCE4A680597D1D3DC234FF29
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads