7e10bf4e1997a044917126ff1055a6bee8438a7cb9996432067ff29af6f533fc

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 10:45

Target
xNet Free Utility v6.0.bat
Size 28KB
Sample260625-mtpwasbs3m
SHA256 7e10bf4e1997a044917126ff1055a6bee8438a7cb9996432067ff29af6f533fc
MD5 409c45854a4cee4c572447150c656b54
SHA1 ace82c9941cab9a35e0a17ac87d35808200424d3
SHA512 54d0b98e7bf78ed333b3d86d08bb7d52c7d2373458aa1167ee9854cc3e03236d2870c7ea21c2fd2b85968ab31134d16d578177ebffb3aac8650e8e9be8b60ea9
SSDEEP 768:Ju6Oz0ohpo862I0o3fyymfw2bzjCDPLTLGu6Oz0ohpo862I0o3fJ5OTpL8pLspLB:Ju6Oz0ohpo862I0o3fyyb2baTLGu6Oz/
TLSH
T127D23426385A0F698955F2B9A677851DB71223C3DC021FC0FDEF181E1393A4A5239DED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3472	reg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 420	5744	cmd.exe	90
PID 5744 wrote to memory of 3472	5744	cmd.exe	91
PID 5744 wrote to memory of 2056	5744	cmd.exe	92
PID 5744 wrote to memory of 624	5744	cmd.exe	93
PID 5744 wrote to memory of 2036	5744	cmd.exe	94
PID 5744 wrote to memory of 1408	5744	cmd.exe	95
PID 5744 wrote to memory of 988	5744	cmd.exe	96
PID 5744 wrote to memory of 2120	5744	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xNet Free Utility v6.0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\system32\mode.com
  MODE 50,6
  2⤵
  PID:420
- C:\Windows\system32\reg.exe
  Reg.exe add HKLM /F
  2⤵
  - Modifies registry key
  PID:3472
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg add "HKCU\Console" /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
  2⤵
  PID:624
- C:\Windows\system32\mode.com
  MODE 22,6
  2⤵
  PID:2036
- C:\Windows\system32\mode.com
  MODE 94,15
  2⤵
  PID:1408
- C:\Windows\system32\mode.com
  MODE 22,6
  2⤵
  PID:988
- C:\Windows\system32\mode.com
  MODE 120,34
  2⤵
  PID:2120

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact