55c64bbb78ab2a3cab6d5b9999f79d400f4ad44a92e6b723f04d638d79cb209a

Resubmissions

27/07/2026, 22:12

260727-14sltsscmf10

27/07/2026, 22:07

260727-11vxsaszhw10

27/07/2026, 21:57

260727-1t5hmsszbs10

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.Helix/manicode/freebuff.exe
Size 117.8MB
Sample260727-14sltsscmf
SHA256 55c64bbb78ab2a3cab6d5b9999f79d400f4ad44a92e6b723f04d638d79cb209a
MD5 7a32778a8fc027145090b3074d682de1
SHA1 429b53881ba198e1adb2f41f36b1d35de623f5f8
SHA512 fcee6b0d0fc0c543807a80876e056f9bd02e062b81c361f9f62c731b5198f3f74cd3ad9e2db4b54bc56e231c1e274399a3e0575151f7519a2fcf8fb6b21b7d0b
SSDEEP 786432:vMKVpL0NlvnOMVDLz9/W6PD3m6klrs9wbyfuGpgl5/8OzDuGe3F3/zEsm9iK5enm:vMKVSNV3z9/rmJAwbrF5e5A
TLSH
T1BB489E03B2E75498E0BBC134D6FA5723A532BC454B3055FF26584B312F72AE0AB7AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4100	freebuff.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1164	powershell.exe
6096	powershell.exe
4324	powershell.exe
1212	powershell.exe
2944	powershell.exe
2852	powershell.exe
2384	powershell.exe
5824	powershell.exe
5824	powershell.exe
4796	powershell.exe
2140	powershell.exe
4296	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2912	powershell.exe
4296	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2280	cmd.exe
5060	cmd.exe
2020	cmd.exe
5876	cmd.exe
4520	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5824	powershell.exe
5824	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
2140	powershell.exe
2140	powershell.exe
1164	powershell.exe
1164	powershell.exe
6096	powershell.exe
6096	powershell.exe
4796	powershell.exe
2852	powershell.exe
2852	powershell.exe
4796	powershell.exe
2140	powershell.exe
1164	powershell.exe
4796	powershell.exe
2852	powershell.exe
6096	powershell.exe
4324	powershell.exe
4324	powershell.exe
2384	powershell.exe
2384	powershell.exe
1212	powershell.exe
1212	powershell.exe
4324	powershell.exe
1212	powershell.exe
2384	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
5824	powershell.exe
5824	powershell.exe
5824	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	2140	powershell.exe
Token: SeSecurityPrivilege	2140	powershell.exe
Token: SeTakeOwnershipPrivilege	2140	powershell.exe
Token: SeLoadDriverPrivilege	2140	powershell.exe
Token: SeSystemProfilePrivilege	2140	powershell.exe
Token: SeSystemtimePrivilege	2140	powershell.exe
Token: SeProfSingleProcessPrivilege	2140	powershell.exe
Token: SeIncBasePriorityPrivilege	2140	powershell.exe
Token: SeCreatePagefilePrivilege	2140	powershell.exe
Token: SeBackupPrivilege	2140	powershell.exe
Token: SeRestorePrivilege	2140	powershell.exe
Token: SeShutdownPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeSystemEnvironmentPrivilege	2140	powershell.exe
Token: SeRemoteShutdownPrivilege	2140	powershell.exe
Token: SeUndockPrivilege	2140	powershell.exe
Token: SeManageVolumePrivilege	2140	powershell.exe
Token: 33	2140	powershell.exe
Token: 34	2140	powershell.exe
Token: 35	2140	powershell.exe
Token: 36	2140	powershell.exe
Token: SeIncreaseQuotaPrivilege	4796	powershell.exe
Token: SeSecurityPrivilege	4796	powershell.exe
Token: SeTakeOwnershipPrivilege	4796	powershell.exe
Token: SeLoadDriverPrivilege	4796	powershell.exe
Token: SeSystemProfilePrivilege	4796	powershell.exe
Token: SeSystemtimePrivilege	4796	powershell.exe
Token: SeProfSingleProcessPrivilege	4796	powershell.exe
Token: SeIncBasePriorityPrivilege	4796	powershell.exe
Token: SeCreatePagefilePrivilege	4796	powershell.exe
Token: SeBackupPrivilege	4796	powershell.exe
Token: SeRestorePrivilege	4796	powershell.exe
Token: SeShutdownPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeSystemEnvironmentPrivilege	4796	powershell.exe
Token: SeRemoteShutdownPrivilege	4796	powershell.exe
Token: SeUndockPrivilege	4796	powershell.exe
Token: SeManageVolumePrivilege	4796	powershell.exe
Token: 33	4796	powershell.exe
Token: 34	4796	powershell.exe
Token: 35	4796	powershell.exe
Token: 36	4796	powershell.exe
Token: SeIncreaseQuotaPrivilege	2852	powershell.exe
Token: SeSecurityPrivilege	2852	powershell.exe
Token: SeTakeOwnershipPrivilege	2852	powershell.exe
Token: SeLoadDriverPrivilege	2852	powershell.exe
Token: SeSystemProfilePrivilege	2852	powershell.exe
Token: SeSystemtimePrivilege	2852	powershell.exe
Token: SeProfSingleProcessPrivilege	2852	powershell.exe
Token: SeIncBasePriorityPrivilege	2852	powershell.exe
Token: SeCreatePagefilePrivilege	2852	powershell.exe
Token: SeBackupPrivilege	2852	powershell.exe
Token: SeRestorePrivilege	2852	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5824	4100	freebuff.exe	90
PID 4100 wrote to memory of 2280	4100	freebuff.exe	91
PID 4100 wrote to memory of 4296	4100	freebuff.exe	92
PID 2280 wrote to memory of 4960	2280	cmd.exe	93
PID 4296 wrote to memory of 2912	4296	powershell.exe	94
PID 4100 wrote to memory of 5060	4100	freebuff.exe	95
PID 5060 wrote to memory of 2920	5060	cmd.exe	97
PID 4100 wrote to memory of 2020	4100	freebuff.exe	98
PID 4100 wrote to memory of 2852	4100	freebuff.exe	100
PID 4100 wrote to memory of 4796	4100	freebuff.exe	101
PID 4100 wrote to memory of 2140	4100	freebuff.exe	102
PID 4100 wrote to memory of 1164	4100	freebuff.exe	103
PID 4100 wrote to memory of 6096	4100	freebuff.exe	104
PID 4100 wrote to memory of 5876	4100	freebuff.exe	105
PID 5876 wrote to memory of 3216	5876	cmd.exe	112
PID 4100 wrote to memory of 2384	4100	freebuff.exe	113
PID 4100 wrote to memory of 1212	4100	freebuff.exe	114
PID 4100 wrote to memory of 4324	4100	freebuff.exe	115
PID 6096 wrote to memory of 3376	6096	powershell.exe	119
PID 4100 wrote to memory of 2944	4100	freebuff.exe	121
PID 4100 wrote to memory of 4520	4100	freebuff.exe	123
PID 4520 wrote to memory of 2096	4520	cmd.exe	125
PID 4100 wrote to memory of 5824	4100	freebuff.exe	127

C:\Users\Admin\AppData\Local\Temp\.Helix\manicode\freebuff.exe
"C:\Users\Admin\AppData\Local\Temp\.Helix\manicode\freebuff.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command (Get-Host).UI.RawUI.BackgroundColor
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Start-Process -FilePath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile -NonInteractive -Command \"try { Wait-Process -Id 4100 -ErrorAction Stop } catch {}; if (Test-Path -LiteralPath ''C:\Users\Admin\AppData\Local\Temp\codebuff-watchdog-disarm-4100-ybdn41a1p8b'') { Remove-Item -LiteralPath ''C:\Users\Admin\AppData\Local\Temp\codebuff-watchdog-disarm-4100-ybdn41a1p8b'' -Force -ErrorAction SilentlyContinue } else { $b=[byte[]](27,91,63,49,48,52,57,108,27,91,63,49,48,48,48,108,27,91,63,49,48,48,50,108,27,91,63,49,48,48,51,108,27,91,63,49,48,48,54,108,27,91,63,49,48,48,52,108,27,91,63,50,48,48,52,108,27,91,60,117,27,91,62,52,59,48,109,27,91,63,50,53,104); $s=[Console]::OpenStandardOutput(); $s.Write($b, 0, $b.Length); $s.Flush() }\"' -NoNewWindow"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -Command "try { Wait-Process -Id 4100 -ErrorAction Stop } catch {}; if (Test-Path -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\codebuff-watchdog-disarm-4100-ybdn41a1p8b') { Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\codebuff-watchdog-disarm-4100-ybdn41a1p8b' -Force -ErrorAction SilentlyContinue } else { $b=[byte[]](27,91,63,49,48,52,57,108,27,91,63,49,48,48,48,108,27,91,63,49,48,48,50,108,27,91,63,49,48,48,51,108,27,91,63,49,48,48,54,108,27,91,63,49,48,48,52,108,27,91,63,50,48,48,52,108,27,91,60,117,27,91,62,52,59,48,109,27,91,63,50,53,104); $s=[Console]::OpenStandardOutput(); $s.Write($b, 0, $b.Length); $s.Flush() }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:2020
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_ComputerSystemProduct | select Name,Vendor,Version,IdentifyingNumber,UUID | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:3216
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance MS_Systeminformation -Namespace \"root/wmi\" | select systemsku | fl "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:2096
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_bios | select Version, SerialNumber, SMBIOSBIOSVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...