1e3a6c2d4905c6b06ce8c1180feae38aa3a2226371d037b34f22a3303ed3dca2

Analysis

user interaction
yes
max time kernel
5s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 11:45

Target
vgx.exe
Size 1.8MB
Sample260503-nw6r9sgv21
SHA256 1e3a6c2d4905c6b06ce8c1180feae38aa3a2226371d037b34f22a3303ed3dca2
MD5 24425682e6f16a4a0f0a6d594c38f58a
SHA1 06f460da6df6bddfd8d423e021987620dbc3f191
SHA512 1d9306cfee0666a217f1e5d6835a6d58bf4a64a80570e967e8426884311f8e02ef53eeea59e79cc59bd700af397a0eeb562631598cbfc645320906c7fd68d808
SSDEEP 49152:IhE/VPh9NmifjMpKsxZ4ThkRpjRJzij9a1CGiicJ:IO/3GpjRHN
TLSH
T1CF958E169BD521ACF3B3E1BCCAB64912E672BC05036059DB16E45BDC0F37AC8477A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2192	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	vgx.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3852	2292	vgx.exe	79
PID 2292 wrote to memory of 3708	2292	vgx.exe	80
PID 3708 wrote to memory of 2192	3708	cmd.exe	81
PID 2292 wrote to memory of 896	2292	vgx.exe	82
PID 2292 wrote to memory of 1336	2292	vgx.exe	83

C:\Users\Admin\AppData\Local\Temp\vgx.exe
"C:\Users\Admin\AppData\Local\Temp\vgx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0F
  2⤵
  PID:1336