54b1583953ef7e6ab4e4faef751a49b7adddbf05b9680328a948b13d3634ce7a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hello.exe
Size 2.8MB
Sample260602-3cacaags9j
SHA256 54b1583953ef7e6ab4e4faef751a49b7adddbf05b9680328a948b13d3634ce7a
MD5 96e2d9bc1ba9808826708ca635ea7abc
SHA1 c2775c4d052c5af6a198855f944bf75794124a47
SHA512 bc86d798c5336813af82123961fe23c10c67c0b19ccfc2bc717b36a8e8298a5b2b0d7370accc30ea763575ca62d4db804cccc4065fdeccd65d4f7ecef5663c99
SSDEEP 49152:x1DjWMYjaBYMiRAfcZtnXtEpJuexODXqT2+Qhg:+ZtEYwd
TLSH
T15BD58E4673B400FDD5A7C1B88A5B591BEB7174060370DBEF16D0896A6F23AE21E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2912	netsh.exe
2828	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
5040	hello.exe
4032	hello.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
1	api.ipify.org
1	ip-api.com
3	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4740	cmd.exe
1240	netsh.exe
4040	cmd.exe
3336	netsh.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	hello.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	hello.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	hello.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	hello.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe
5040	hello.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3220	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	hello.exe
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeDebugPrivilege	4032	hello.exe
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE
Token: SeShutdownPrivilege	3220	Explorer.EXE
Token: SeCreatePagefilePrivilege	3220	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE
3220	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 5040	4028	hello.exe	80
PID 5040 wrote to memory of 1756	5040	hello.exe	81
PID 1756 wrote to memory of 1852	1756	cmd.exe	83
PID 1852 wrote to memory of 848	1852	net.exe	84
PID 5040 wrote to memory of 2912	5040	hello.exe	85
PID 5040 wrote to memory of 3220	5040	hello.exe	54
PID 3220 wrote to memory of 5028	3220	Explorer.EXE
PID 4032 wrote to memory of 1144	4032	hello.exe	89
PID 1144 wrote to memory of 2180	1144	cmd.exe	91
PID 2180 wrote to memory of 4332	2180	net.exe	92
PID 4032 wrote to memory of 2828	4032	hello.exe	93
PID 5040 wrote to memory of 4040	5040	hello.exe	95
PID 4040 wrote to memory of 3336	4040	cmd.exe	97
PID 5040 wrote to memory of 2504	5040	hello.exe	98
PID 4032 wrote to memory of 4740	4032	hello.exe	100
PID 4740 wrote to memory of 1240	4740	cmd.exe	102
PID 5040 wrote to memory of 3068	5040	hello.exe	103
PID 5040 wrote to memory of 1476	5040	hello.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\AppData\Local\Temp\hello.exe
  "C:\Users\Admin\AppData\Local\Temp\hello.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\Music\Music Samples\hello.exe
    "C:\Users\Admin\Music\Music Samples\hello.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c net session >nul 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:848
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Host Support" dir=in action=allow program="C:\Users\Admin\Music\Music Samples\hello.exe" enable=yes profile=any protocol=any >nul 2>&1
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2912
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c netsh wlan show profile
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3336
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c dir
      4⤵
      PID:2504
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c __FR__STREAM_START|15|50
      4⤵
      PID:3068
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c __FR__STREAM_STOP
      4⤵
      PID:1476

C:\Users\Admin\Music\Music Samples\hello.exe
"C:\Users\Admin\Music\Music Samples\hello.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\system32\cmd.exe
  cmd.exe /c net session >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4332
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Host Support" dir=in action=allow program="C:\Users\Admin\Music\Music Samples\hello.exe" enable=yes profile=any protocol=any >nul 2>&1
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2828
- C:\Windows\system32\cmd.exe
  cmd.exe /c netsh wlan show profile
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

frozen_started.txt

Path C:\Users\Admin\AppData\Local\Temp\frozen_started.txt
Size 33B
SHA256 9ce2538714b8027313c5719a384593aa1f68f9697f52bf9eb6decabf0843e112
MD5 46f3615544f7dc264e233bcaed9e91bc
SHA1 009c5aa89d4307c080815c6cedbe70e9fb002ad0
SHA512 cf804f0cda43f938e6787f324fee7aff89151bba53a38e75347ea2d952ad496e91ff2adbee62b37ddeac7886c666c1144c081fc844b0ed2c6f1a21e40b74dfda
MD5 SHA1 SHA512

Submit Download

frozen_started.txt

Path C:\Users\Admin\AppData\Local\Temp\frozen_started.txt
Size 22B
SHA256 39350e37d7a15b231dc23ff61233e2a510316105b0e8eea1b3ca35f727c6588a
MD5 40465ebdcc6258cba476c869b2be2181
SHA1 c7288044a521deacfa7ed76d7a83b1a0a6695b4b
SHA512 50b6bbfea7a1bb569e98321130e447b75501c80e2002476b45280e2971b9b62fd574bcb2a92869301577d900d9f1d18e569c7c17399b07a2a6453100dde3aab6
MD5 SHA1 SHA512

Submit Download

frozen_trace.log

Path C:\Users\Admin\AppData\Local\Temp\frozen_trace.log
Size 148B
SHA256 7cfb48f862c56ab0ac7ded483026943eb03b71fe27870b2818eb4a9de62234db
MD5 2606ff6985ef995eacb4183cafcf89b9
SHA1 ba2a8c38809d84426164b93aa43385049d648249
SHA512 053827677df0640e390a360f51a6d5b78834a82cc9888d683e9f456a4c8b119086ec147f3cd645d247baee89191248142bd47857768554c276d090f47191bd3a
TLSH
T1DBC048D4975E02A67C97CEC4B321FF9ADA8500102B7C4650439F72B7699502DE80B1BF
MD5 SHA1 SHA512 TLSH

Submit Download

frozen_trace.log

Path C:\Users\Admin\AppData\Local\Temp\frozen_trace.log
Size 267B
SHA256 3b537016b1de59ef128f4237f12f41cb1d8ce3a41d898eeadcaad42b5cdc95b8
MD5 f47179ec8475e828d08166d1f68f16b0
SHA1 d6631f00cc8098ee1edc703bc05a49642725f1fe
SHA512 442d30d0936083fca4f024aced210d6ab3dec9ebd9608886695d8aad356b9c3a60c47921f4c1255063ed9468e8ccf29eca3e1db59374961d821fb983c5834837
TLSH
T19FD01CD4871E43AB7C93CEC4E221AFDAEA8000002B38022003DF73B3298101CE81B0BF
MD5 SHA1 SHA512 TLSH

Submit Download

hello.exe

Path C:\Users\Admin\Music\Music Samples\hello.exe
Size 2.8MB
SHA256 54b1583953ef7e6ab4e4faef751a49b7adddbf05b9680328a948b13d3634ce7a
MD5 96e2d9bc1ba9808826708ca635ea7abc
SHA1 c2775c4d052c5af6a198855f944bf75794124a47
SHA512 bc86d798c5336813af82123961fe23c10c67c0b19ccfc2bc717b36a8e8298a5b2b0d7370accc30ea763575ca62d4db804cccc4065fdeccd65d4f7ecef5663c99
SSDEEP 49152:x1DjWMYjaBYMiRAfcZtnXtEpJuexODXqT2+Qhg:+ZtEYwd
TLSH
T15BD58E4673B400FDD5A7C1B88A5B591BEB7174060370DBEF16D0896A6F23AE21E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3220-23-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-27-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-25-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-28-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-22-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-21-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-16-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-14-0x0000000002DF0000-0x0000000002E0F000-memory.dmp

Download

memory/3220-29-0x0000000002E50000-0x0000000002E51000-memory.dmp

Download

memory/3220-15-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download

memory/3220-24-0x0000000002E10000-0x0000000002E37000-memory.dmp

Download