9df41ebe1a2c61bbc382a85a7788e127e4dafada4955a1b6c3dfcaf460bd714f

Resubmissions

09-07-2024 13:39

240709-qydwdayanf 7

09-07-2024 07:52

09-07-2024 06:42

09-07-2024 06:34

09-07-2024 05:47

Analysis

max time kernel
141s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

netsh.exe
Size

116KB
MD5

52b4651083081201e243e97ed965b60a
SHA1

92f2b4e5e5ca66486f4062ab27b8af23d6ad564a
SHA256

3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44
SHA512

d8ebadcfdcd0ddedd27d50347473a274b22601ba17d683c6b20274ffdd0765fb15e4f9799bff4928e1e23f5f9af274e8a925df4975902ec5dd2ecfea694f6f43
SSDEEP

1536:mpcHB7pj43bXYGgPRdIM5uTKWN7tX26bKmGaZ9:mpUzjyXYGofIiuT1N7tX2KB

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

C:\Users\Admin\AppData\Local\Temp\netsh.exe
"C:\Users\Admin\AppData\Local\Temp\netsh.exe"
1⤵
- Event Triggered Execution: Netsh Helper DLL
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads