4001ded600c0ec4d2de02d7043c375aac786060d898c51ca138081e2764d5484

Analysis

user interaction
yes
max time kernel
58s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
paso2.exe
Size 6.3MB
Sample260419-c171cagy2w
SHA256 4001ded600c0ec4d2de02d7043c375aac786060d898c51ca138081e2764d5484
MD5 1ebbfb7705f075dcd18452d16366b4d4
SHA1 a132c3cd8cc161fca308996fe4ed7fc853a783fc
SHA512 3fffc167b53ce381bb6be318e272ace6d07caab9a363fa4a9d5f122dfa09b2905a8c5992f2b8fd3dbcb362bbdafd8e9f582ef878d9daad23e3df645e2e26e696
SSDEEP 98304:IemgaSc/brrQ8QyOY6vKmpEqGfEMZlEWTXQxLCLwFU5d58Al871Snu9KBsB6EGfT:IJxSczXWmWyq8lnbECLXaUnu9KZq
TLSH
T1DB663342E5E1CE00D7E41D31816794A0D3729D85A672F74A6BAC79F2BD333B898162F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
704	netsh.exe
4664	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	paso2.exe

Executes dropped EXE 1 IoCs

pid	Process
3284	ferramentatmp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\OntSoftwareBroardcaster.ini	ferramentatmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ferramentatmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	paso2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3284	ferramentatmp.exe
3284	ferramentatmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 704	3132	paso2.exe	91
PID 3132 wrote to memory of 4664	3132	paso2.exe	93
PID 3132 wrote to memory of 3284	3132	paso2.exe	97

C:\Users\Admin\AppData\Local\Temp\paso2.exe
"C:\Users\Admin\AppData\Local\Temp\paso2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall show rule name="Ferramenta para ONT"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:704
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall add rule name="Ferramenta para ONT" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\ferramentatmp.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\ferramentatmp.exe
  "C:\Users\Admin\AppData\Local\Temp\ferramentatmp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.xml

Path C:\ProgramData\OntWizard\data.xml
Size 486B
SHA256 547e15000d84e5db6e12639c85dbf31a2f5634d801bf28f4d1e05ebb1f06f7df
MD5 40ed4ca890b13adbadf997ec54dd9b6b
SHA1 e0d982de31ae0dee2945b52691f0255794a44437
SHA512 faca95fdb03b0e20f12e738a76867f1cc0893ac9bc48eb02ed5654f8f80b3bf814cbeb3af517a3efe5d39b0621b4461d223f454d6ab13f226cf46355449ae5e1
TLSH
T1E4F0D8CA05F0CB40E85A05F29A1687608EC806DF17925C3D3CAF4D495FF8EE2579F094
MD5 SHA1 SHA512 TLSH

Submit Download

ferramentatmp.exe

Path C:\Users\Admin\AppData\Local\Temp\ferramentatmp.exe
Size 4.1MB
SHA256 19cb07c8f6f53df9494a834f902a1bb3d155fbca4fca43eb3c7d43f0d9c2d92c
MD5 4a0434ea2a66a29a1089c80a3cb411f4
SHA1 a2564cb12bf40d89365df46e0adfdb3909ddc6ae
SHA512 2a549b38c43039be59d633fc0040e1575082892fb08e8db1fbdedc292c9e15e604acf3d6d2f530f19cdae9213f47124e8204b4cc5e1cb1e9f623066db27f1217
SSDEEP 98304:mRUoiMZhwsFVC32g+VxkJEMd8G6zkQ70xSFx9cSHj8OFWhRbegpBti9N:m9ldViprQ70QfrDz0hRbegpBsP
TLSH
T1A6163BF1F64180ADD5222379850AA2E579FABD308B7101F76194FA292D349C2493FE7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3132-8-0x0000017DF78E0000-0x0000017DF78F0000-memory.dmp

Download

memory/3132-9-0x0000017DF78E0000-0x0000017DF78F0000-memory.dmp

Download

memory/3132-4-0x0000017DF78E0000-0x0000017DF78F0000-memory.dmp

Download

memory/3132-5-0x0000017DF78E0000-0x0000017DF78F0000-memory.dmp

Download

memory/3132-7-0x0000017DF52F0000-0x0000017DF52FC000-memory.dmp

Download

memory/3132-6-0x0000017DF73C0000-0x0000017DF7715000-memory.dmp

Download

memory/3132-0-0x0000017DF4910000-0x0000017DF4F66000-memory.dmp

Download

memory/3132-3-0x0000017DF8D20000-0x0000017DF9566000-memory.dmp

Download

memory/3132-10-0x0000017DF73C0000-0x0000017DF7715000-memory.dmp

Download

memory/3132-12-0x0000017DF78E0000-0x0000017DF78F0000-memory.dmp

Download

memory/3132-13-0x0000017DF73C0000-0x0000017DF7715000-memory.dmp

Download

memory/3132-2-0x0000017DF5320000-0x0000017DF5321000-memory.dmp

Download

memory/3132-1-0x0000017DF78E0000-0x0000017DF78F0000-memory.dmp

Download

memory/3132-34-0x0000017DF73C0000-0x0000017DF7715000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads