f5c1412ab5a1e0e22fab02e4ab0c5197700b6d6d055fef3d7fc7364cca759644

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FFHAX.exe
Size 24.2MB
Sample260801-drllesch23
SHA256 f5c1412ab5a1e0e22fab02e4ab0c5197700b6d6d055fef3d7fc7364cca759644
MD5 66c5cadc8faa78940f3ffd8b230b9dc1
SHA1 fca4b97c7cb58415f788d359627c764f41de6c14
SHA512 aa80b87e67b48818a7180a5f1decf8a43f6863f4f6b2dd6337b7190e8a4d03612c188953f3bfa8e1e4620d9aca51f54b04198851aaa921b3c6a21c71b3b245cb
SSDEEP 393216:XbNRgtJeJnX9fwtX8Io3KQZrUMGDU4PQUQxqfLzQQaL+F5oL5A:rNRgnktYp8IHQZFGnP9QQzQDL+F5oy
TLSH
T13C47338362D70DF9DDD26BB841DB6236AB35FE708A3E8F2B9500C53118136D26D6EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence privilege_escalation trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FFHAX_Loader.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	FFHAX.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4852	netsh.exe
1112	netsh.exe
2192	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FFHAX_Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FFHAX_Loader.exe

Executes dropped EXE 1 IoCs

pid	Process
3352	FFHAX_Loader.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FFHAX_Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3352	FFHAX_Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe
2240	FFHAX.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	FFHAX.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3352	FFHAX_Loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4852	2240	FFHAX.exe	89
PID 2240 wrote to memory of 1112	2240	FFHAX.exe	91
PID 2240 wrote to memory of 2192	2240	FFHAX.exe	93
PID 2240 wrote to memory of 3352	2240	FFHAX.exe	95

C:\Users\Admin\AppData\Local\Temp\FFHAX.exe
"C:\Users\Admin\AppData\Local\Temp\FFHAX.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall delete rule name="FFHAX_SAFE_BLOCK_STOCK_UPDATE"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4852
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall delete rule name="FFHAX_SAFE_BLOCK_ZERMANGO_OUT"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1112
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall delete rule name="FFHAX_SAFE_BLOCK_CDN_ZERMANGO"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2192
- C:\Users\Admin\AppData\Local\FfhaxSafeRuntime\FFHAX_Loader.exe
  "C:\Users\Admin\AppData\Local\FfhaxSafeRuntime\FFHAX_Loader.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of FindShellTrayWindow
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FFHAX_Loader.exe

Path C:\Users\Admin\AppData\Local\FfhaxSafeRuntime\FFHAX_Loader.exe
Size 9.2MB
SHA256 07adaf89f13876351fc4915c44a7b7308e6d63fb0708fda056e9b281b6884a41
MD5 93f6b7b91387f0a294c29d310db0b2a7
SHA1 b4cb129de7b5760977dbed507defa1851ba6aff5
SHA512 250940e9469d0df97c43e8cafe3a90c353a25fac895c8fada58cf861663f9df8f8b6f52f3a167f01ed6f166c2fcf8dd68b15cb10865c61c7f18cea89368ef87b
SSDEEP 196608:cfQ5uslk1RzunNRDstj66vmJTrX9f2y4jtXqvLjIjcUAGNT:DbNRgtJeJnX9fwtX8IoU
TLSH
T1ACA6331B82F956B2F297B0F40ECD01E57906E6F44B7EC31EB417B9C6643282B6A8DD05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safe.log

Path C:\Users\Admin\AppData\Local\FfhaxSafeRuntime\safe.log
Size 669B
SHA256 97657dfd837261be483e7cec50e9b1c08d0e61752735216f0c0cb46491dba63c
MD5 42e3a788ebf2e7e8927c7f0a3004427f
SHA1 950199f4f06a6c6985904d32e2d3b9fea12a7c2b
SHA512 de82834a18b2e9ba2265c57b8828e4302c43e1078cf0f1201a226bcae216447e7a4585cb00907e48129b268e510fbf5bdda86e3472e5934454ff53cff6420db6
TLSH
T1180199CAA8F1E4A51496B30B93698398931CBE0A562C0AF33124801E71E74EA870D67F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2240-39-0x00007FF6D3E20000-0x00007FF6D55E2000-memory.dmp

Download

memory/3352-25-0x00007FF6ADF50000-0x00007FF6AF3F1000-memory.dmp

Download

memory/3352-32-0x00007FF6ADF50000-0x00007FF6AF3F1000-memory.dmp

Download

memory/3352-33-0x00007FF6ADF50000-0x00007FF6AF3F1000-memory.dmp

Download

memory/3352-34-0x00007FF6ADF50000-0x00007FF6AF3F1000-memory.dmp

Download

memory/3352-35-0x00007FF6ADF50000-0x00007FF6AF3F1000-memory.dmp

Download

memory/3352-36-0x00007FF6ADF50000-0x00007FF6AF3F1000-memory.dmp

Download