b9f71ed4b08c93a7fc5468bee23660e3129e1cf9c84100d4d40ad70fb7c851fa

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:20

Target
RuntimeBroker.exe
Size 7.3MB
Sample260508-phrxmact2r
SHA256 b9f71ed4b08c93a7fc5468bee23660e3129e1cf9c84100d4d40ad70fb7c851fa
MD5 def4f909eeed327ab949d99a810ff64e
SHA1 3668e6ca6e282334535c796a3a8817c6a23b6a50
SHA512 c56efc554d1aa59345da04e1c82c0a2b825d0b9392a33f956bc2074439c65f8dec85556df406f745edb3107b0fd5e8ba65497846627865dbe61c211102d2006c
SSDEEP 98304:0i3Qm0vuJyIvFbWMVqqLKYhebCtjlKSObn+:7CpQvK17
TLSH
T118765B53F66290ECC16DC1B4831A6632FB32B88A073476EB57D086213E66FD06B3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 5880	3224	RuntimeBroker.exe	79
PID 3224 wrote to memory of 5000	3224	RuntimeBroker.exe	81
PID 3224 wrote to memory of 5848	3224	RuntimeBroker.exe	83

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall show rule "name=Runtime Broker"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:5880
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall add rule "name=Runtime Broker" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:5000
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall add rule "name=Runtime Broker" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:5848