aa25348b2dca476227c075ca15e996cabca3aa66bfce31bc4c8ab2b296dacdf6

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AFK_Helper_v1_11.exe
Size 768KB
Sample260724-ad4nasxwhy
SHA256 aa25348b2dca476227c075ca15e996cabca3aa66bfce31bc4c8ab2b296dacdf6
MD5 79ed506bf7df411bd7bf2014b6de4afe
SHA1 3f3e5b605ae739685b70d46ad8740d8a33d3b2b8
SHA512 e1abb70cdf6e015bdb8b74dfdde9a22e51d850eca7b4701c3bc9173eeff235995898bcb3367b1b423e1e9f37476ae4e427fd09eda8d302cc3ecacc48a79c6218
SSDEEP 24576:lU+9XNrenyktDLdYNtcdvQNC9wHAP5c1gfxJSfQ:Z5OVeyffxJSo
TLSH
T135F4AE56F69A41F7D981307012B9E7329938E6752334AAC3BBE43E781E351C2AD3934D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AFK_Helper_v1_11.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1908	WINWORD.EXE
1908	WINWORD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
7012	AFK_Helper_v1_11.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
7012	AFK_Helper_v1_11.exe
7012	AFK_Helper_v1_11.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
7012	AFK_Helper_v1_11.exe
7012	AFK_Helper_v1_11.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
6272	OpenWith.exe
5328	OpenWith.exe
4108	OpenWith.exe
6284	OpenWith.exe
4692	OpenWith.exe
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE
1908	WINWORD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 5416	1908	WINWORD.EXE	99

C:\Users\Admin\AppData\Local\Temp\AFK_Helper_v1_11.exe
"C:\Users\Admin\AppData\Local\Temp\AFK_Helper_v1_11.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6284

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SkipShow.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5416

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SkipShow.docx" /o ""
1⤵
PID:1812

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SkipShow.docx" /o ""
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD4C73.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 322B
SHA256 3accc78f966aa4b24cd465de0398c2dff3c763b6fa7fd3ade57d64858f0679bd
MD5 fb8c9bb44b34f7c27e3d4ea1faf2c004
SHA1 66e6831ac59d33222cc59a1431929654d58cd972
SHA512 a55344f34001ea6e520a6371df6da5358de72fedaf07429d8107a6b2d3db0840d18f77a80c709eaae4da575eb038f29698ddd966ed4a48bae9f06e1cf84b8668
TLSH
T1F3E0B6477B26F3F5A7BD99B438BA5CE5EBF10C09DB9E022446EC1C480E9215B24DB818
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 24abe504da1305b6c5a9b7f060c535d93069e7e2569c080102e8c9b9a6dcf400
MD5 b70895d0f2cd81ab2980e05994abb9b5
SHA1 d64e88fee4b85f219caeb31d53e677d416156f0d
SHA512 8cd1591ef95fbc37e3fe8250514ab75971d0a8e54f51faa013d067f0c21781960230846d930bda1f2d280ae429431bd801a21a11cbb8d153c071c7a7f78404b1
TLSH
T134512F121BCF6F2FE09243BA492E4346D7317C11E7206A0D5184576FAC26D50CF88BAA
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 b1e4678c2f64356d6f64f7eea3fee0b18fbfb930c2e3abcc3babfb5b383fd34d
MD5 8bd1c298d8f0068bddb8a44589b72e9a
SHA1 b60f6a977cb5693fb1065b0d66d6855d758db413
SHA512 c4fdcf364ecf370eba23398edda4a674ef35870703e56cccc93b33ff5e7fb56a4ee2ea315798bb7922604bcdf026bad9b4f26c508095bf2fd80f28e2c2b997ce
TLSH
T185512F121BCF6F2FE09243BA492E4346D7317C11E7206A0D5184576FAC26D50CF88BAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1812-87-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1812-88-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1812-86-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1812-85-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1908-77-0x00007FFCCEA60000-0x00007FFCCEA70000-memory.dmp

Download

memory/1908-78-0x00007FFCCEA60000-0x00007FFCCEA70000-memory.dmp

Download

memory/1908-73-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1908-75-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1908-74-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1908-76-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

memory/1908-72-0x00007FFCD1380000-0x00007FFCD1390000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads