0a49dc0d2ce725af347df632539b70afcfd22b38e285920b515143332a5511e9

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TCPOptimizer.exe
Size 668KB
Sample260421-ln3drscs8p
SHA256 0a49dc0d2ce725af347df632539b70afcfd22b38e285920b515143332a5511e9
MD5 d8292150c8ce862a97a923318df07805
SHA1 917f917ff9fe33e199388e5e1d4c0696882d2991
SHA512 3f23dd72d066d3f09a49c5dcf062471cfd412cf65934c25887774c1060d2efa8cb277df5ffb89272c5cb1aab6498e3e82b9d6ec9725b5b7263de60cc9198d475
SSDEEP 6144:h0eD/NMpAte8M0Ic61arFbMAIhTRlDDHbndz+vTEEIeh+b6YzICrz/KiiUy5q7:C1B8g1arhMAURdndzQTEEI7b6Yz3m5W
TLSH
T108E41911F7A0C0F3D2675635CDEA9B7D2265FD60DB21CB873288FE2F68325849A39215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
864	PowerShell.exe
1948	PowerShell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TCPOptimizer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4276	PowerShell.exe
4276	PowerShell.exe
4676	PowerShell.exe
4676	PowerShell.exe
864	PowerShell.exe
864	PowerShell.exe
1948	PowerShell.exe
1948	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4276	PowerShell.exe
Token: SeSecurityPrivilege	4276	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4276	PowerShell.exe
Token: SeLoadDriverPrivilege	4276	PowerShell.exe
Token: SeSystemProfilePrivilege	4276	PowerShell.exe
Token: SeSystemtimePrivilege	4276	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4276	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4276	PowerShell.exe
Token: SeCreatePagefilePrivilege	4276	PowerShell.exe
Token: SeBackupPrivilege	4276	PowerShell.exe
Token: SeRestorePrivilege	4276	PowerShell.exe
Token: SeShutdownPrivilege	4276	PowerShell.exe
Token: SeDebugPrivilege	4276	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4276	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4276	PowerShell.exe
Token: SeUndockPrivilege	4276	PowerShell.exe
Token: SeManageVolumePrivilege	4276	PowerShell.exe
Token: 33	4276	PowerShell.exe
Token: 34	4276	PowerShell.exe
Token: 35	4276	PowerShell.exe
Token: 36	4276	PowerShell.exe
Token: SeDebugPrivilege	4676	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4676	PowerShell.exe
Token: SeSecurityPrivilege	4676	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4676	PowerShell.exe
Token: SeLoadDriverPrivilege	4676	PowerShell.exe
Token: SeSystemProfilePrivilege	4676	PowerShell.exe
Token: SeSystemtimePrivilege	4676	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4676	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4676	PowerShell.exe
Token: SeCreatePagefilePrivilege	4676	PowerShell.exe
Token: SeBackupPrivilege	4676	PowerShell.exe
Token: SeRestorePrivilege	4676	PowerShell.exe
Token: SeShutdownPrivilege	4676	PowerShell.exe
Token: SeDebugPrivilege	4676	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4676	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4676	PowerShell.exe
Token: SeUndockPrivilege	4676	PowerShell.exe
Token: SeManageVolumePrivilege	4676	PowerShell.exe
Token: 33	4676	PowerShell.exe
Token: 34	4676	PowerShell.exe
Token: 35	4676	PowerShell.exe
Token: 36	4676	PowerShell.exe
Token: SeDebugPrivilege	864	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	864	PowerShell.exe
Token: SeSecurityPrivilege	864	PowerShell.exe
Token: SeTakeOwnershipPrivilege	864	PowerShell.exe
Token: SeLoadDriverPrivilege	864	PowerShell.exe
Token: SeSystemProfilePrivilege	864	PowerShell.exe
Token: SeSystemtimePrivilege	864	PowerShell.exe
Token: SeProfSingleProcessPrivilege	864	PowerShell.exe
Token: SeIncBasePriorityPrivilege	864	PowerShell.exe
Token: SeCreatePagefilePrivilege	864	PowerShell.exe
Token: SeBackupPrivilege	864	PowerShell.exe
Token: SeRestorePrivilege	864	PowerShell.exe
Token: SeShutdownPrivilege	864	PowerShell.exe
Token: SeDebugPrivilege	864	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	864	PowerShell.exe
Token: SeRemoteShutdownPrivilege	864	PowerShell.exe
Token: SeUndockPrivilege	864	PowerShell.exe
Token: SeManageVolumePrivilege	864	PowerShell.exe
Token: 33	864	PowerShell.exe
Token: 34	864	PowerShell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4712	TCPOptimizer.exe
4712	TCPOptimizer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3076	4712	TCPOptimizer.exe	79
PID 4712 wrote to memory of 3764	4712	TCPOptimizer.exe	81
PID 4712 wrote to memory of 4276	4712	TCPOptimizer.exe	83
PID 4712 wrote to memory of 4676	4712	TCPOptimizer.exe	87
PID 4712 wrote to memory of 864	4712	TCPOptimizer.exe	89
PID 4712 wrote to memory of 3448	4712	TCPOptimizer.exe	92
PID 4712 wrote to memory of 1948	4712	TCPOptimizer.exe	94

C:\Users\Admin\AppData\Local\Temp\TCPOptimizer.exe
"C:\Users\Admin\AppData\Local\Temp\TCPOptimizer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\netsh.exe
  netsh int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SYSTEM32\netsh.exe
  netsh int ip show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell.exe Get-NetAdapterLso -Name '*'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell.exe Get-NetAdapterChecksumOffload '*'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell.exe Get-NetTCPSetting -SettingName internet
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Windows\SYSTEM32\netsh.exe
  netsh int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell.exe Get-NetOffloadGlobalSetting
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c0db9d1e25c16ac1562af9c9af70372f3d66af4ad23bac83967c327bb3f61d44
MD5 f27bd397fae4f4adfc151b305c196079
SHA1 c42d95148d59ddeaa522ecb475f8340dbad3a91b
SHA512 5e11b9e4822f45dbb7cd32054136aa3231f9b6f3ee43197516a08aba79675a833f10a7aab5896362e67ce398a667de6c2c3637b7124498efcab397900e43b55c
TLSH
T175216533B3ECC125C8D9117A208CAD00B2B5C3C7449E8F8B6A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1437d2dab7153795871a203fdc22fc9cf804a31731d1b2a8f8702e111271bd3f
MD5 0e34935a3ca72cd698b3def2359a2bab
SHA1 7a283b631f441b21479d4d9914ff26fc4f919913
SHA512 db84236557a129ee64e9f47c1bac89c7e07dd77c93d29dda603d030d56d9a173921ffc5d3ed442bd6d5dfcb5158d30611470d96328b127c0e417fa7ca1b8766b
TLSH
T111216533B39DC025C8D9117A208CAD00B2B5C3C7449E8F8B6A84C529957F9DADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 92241a2215a93bc490d09cff3c022d117054fef8d7ea75ef8cfedcf312d84984
MD5 b03233e6a7e732ea6adac05b7ede448c
SHA1 2bc18253cd04e9553c2e3f61d3ff380878a531b8
SHA512 094d8b8f7d02093de889d5b6015634470775f58a10d48b8d280f92c67ceffc4913428a69fe51535f528b2bed47f294489d9ed0a59d954ed7368623e179038f45
TLSH
T143216533B39DC025C8D9117A208CAD00B2B5C3C7449E8F8B6A84C529957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qukt1y1c.ohr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qukt1y1c.ohr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/864-53-0x0000018941130000-0x000001894118D000-memory.dmp

Download

memory/864-54-0x0000018942A90000-0x0000018942AA2000-memory.dmp

Download

memory/1948-70-0x0000024CDD070000-0x0000024CDD082000-memory.dmp

Download

memory/1948-69-0x0000024CDCF80000-0x0000024CDCFDD000-memory.dmp

Download

memory/4276-20-0x000001CA5E7E0000-0x000001CA5E83D000-memory.dmp

Download

memory/4276-1-0x000001CA77030000-0x000001CA77052000-memory.dmp

Download

memory/4276-14-0x000001CA772A0000-0x000001CA772BC000-memory.dmp

Download

memory/4276-15-0x000001CA772C0000-0x000001CA77373000-memory.dmp

Download

memory/4276-21-0x000001CA5E960000-0x000001CA5E972000-memory.dmp

Download

memory/4276-17-0x000001CA77610000-0x000001CA7762C000-memory.dmp

Download

memory/4276-16-0x000001CA77380000-0x000001CA7738A000-memory.dmp

Download

memory/4676-38-0x0000018975120000-0x0000018975132000-memory.dmp

Download

memory/4676-37-0x0000018973240000-0x000001897329D000-memory.dmp

Download

memory/4712-71-0x0000000000BB0000-0x0000000000C2B000-memory.dmp

Download