28e0f8625b575d32175bf6c56f7276cef4310f7c13821217a60a9f35ebeda71e

Analysis

max time kernel
148s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WSLDashboard.0.8.0.Portable.x64.exe
Size 20.3MB
Sample260601-nnfacab18n
SHA256 28e0f8625b575d32175bf6c56f7276cef4310f7c13821217a60a9f35ebeda71e
MD5 10519cf22c75fef666c67c8c39930006
SHA1 b6137325373e6b8702b295accfc72270cac47e80
SHA512 f68a670fd2cf5eee56935aad7d1ec66c4360c1d29d1cac09a81a61d48a956ff4245c7c476e0700f539dee45b370f7cd2bb16f546ddaa6a91686f430726c472d1
SSDEEP 98304:WyloEYn9JKO0NQr8z1BrN6zB+vLSVDpr5vJuS2tKWk5PEHYD6+g5C6MasH7zg0zm:hm4IY7eJu3KSB4rFWmssnKn4Ombe9x1
TLSH
T114275B0BE29550F8C05FC174871AA627FA71788D1B2472EF07905B622FAAFD09FB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1912	WSLDashboard.0.8.0.Portable.x64.exe
1912	WSLDashboard.0.8.0.Portable.x64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1912	WSLDashboard.0.8.0.Portable.x64.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 692	1912	WSLDashboard.0.8.0.Portable.x64.exe	80
PID 1912 wrote to memory of 720	1912	WSLDashboard.0.8.0.Portable.x64.exe	82
PID 1912 wrote to memory of 5308	1912	WSLDashboard.0.8.0.Portable.x64.exe	84
PID 1912 wrote to memory of 3084	1912	WSLDashboard.0.8.0.Portable.x64.exe	86
PID 1912 wrote to memory of 1124	1912	WSLDashboard.0.8.0.Portable.x64.exe	88
PID 1912 wrote to memory of 872	1912	WSLDashboard.0.8.0.Portable.x64.exe	90
PID 1912 wrote to memory of 1780	1912	WSLDashboard.0.8.0.Portable.x64.exe	92
PID 1912 wrote to memory of 652	1912	WSLDashboard.0.8.0.Portable.x64.exe	94
PID 1912 wrote to memory of 3884	1912	WSLDashboard.0.8.0.Portable.x64.exe	96
PID 1912 wrote to memory of 3496	1912	WSLDashboard.0.8.0.Portable.x64.exe	98
PID 1912 wrote to memory of 5620	1912	WSLDashboard.0.8.0.Portable.x64.exe	100
PID 1912 wrote to memory of 4336	1912	WSLDashboard.0.8.0.Portable.x64.exe	102
PID 1912 wrote to memory of 5648	1912	WSLDashboard.0.8.0.Portable.x64.exe	104
PID 1912 wrote to memory of 3852	1912	WSLDashboard.0.8.0.Portable.x64.exe	106
PID 1912 wrote to memory of 5904	1912	WSLDashboard.0.8.0.Portable.x64.exe	108
PID 1912 wrote to memory of 5144	1912	WSLDashboard.0.8.0.Portable.x64.exe	110
PID 1912 wrote to memory of 5576	1912	WSLDashboard.0.8.0.Portable.x64.exe	112
PID 1912 wrote to memory of 4560	1912	WSLDashboard.0.8.0.Portable.x64.exe	114
PID 1912 wrote to memory of 5956	1912	WSLDashboard.0.8.0.Portable.x64.exe	116
PID 1912 wrote to memory of 2208	1912	WSLDashboard.0.8.0.Portable.x64.exe	118
PID 1912 wrote to memory of 4684	1912	WSLDashboard.0.8.0.Portable.x64.exe	120
PID 1912 wrote to memory of 1208	1912	WSLDashboard.0.8.0.Portable.x64.exe	122
PID 1912 wrote to memory of 1320	1912	WSLDashboard.0.8.0.Portable.x64.exe	124
PID 1912 wrote to memory of 2280	1912	WSLDashboard.0.8.0.Portable.x64.exe	126
PID 1912 wrote to memory of 2016	1912	WSLDashboard.0.8.0.Portable.x64.exe	128
PID 1912 wrote to memory of 4132	1912	WSLDashboard.0.8.0.Portable.x64.exe	130
PID 1912 wrote to memory of 2052	1912	WSLDashboard.0.8.0.Portable.x64.exe	132
PID 1912 wrote to memory of 1420	1912	WSLDashboard.0.8.0.Portable.x64.exe	134
PID 1912 wrote to memory of 4380	1912	WSLDashboard.0.8.0.Portable.x64.exe	136
PID 1912 wrote to memory of 1820	1912	WSLDashboard.0.8.0.Portable.x64.exe	138
PID 1912 wrote to memory of 1996	1912	WSLDashboard.0.8.0.Portable.x64.exe	140
PID 1912 wrote to memory of 5680	1912	WSLDashboard.0.8.0.Portable.x64.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WSLDashboard.0.8.0.Portable.x64.exe
"C:\Users\Admin\AppData\Local\Temp\WSLDashboard.0.8.0.Portable.x64.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /TN \WSLDashboard\WSLDashboardTask
  2⤵
  PID:692
- C:\Windows\system32\netsh.exe
  "netsh" interface portproxy show all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:720
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5308
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:3084
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1124
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:872
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1780
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:652
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:3884
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:3496
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5620
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:4336
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5648
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:3852
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5904
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5144
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5576
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:4560
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5956
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:2208
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:4684
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1208
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1320
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:2280
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:2016
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:4132
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:2052
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1420
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:4380
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1820
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:1996
- C:\Windows\system32\wsl.exe
  "wsl.exe" -l -v
  2⤵
  PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads