b9abebc9cfb88a2ca58b30c43cac66fa28efaa73498857a5466869bd5683e05a

Analysis

user interaction
yes
max time kernel
8s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UidBypass 1.4.exe
Size 28.8MB
Sample260705-wyncpsaw6r
SHA256 b9abebc9cfb88a2ca58b30c43cac66fa28efaa73498857a5466869bd5683e05a
MD5 43338613d83afbac7c6aab08f38ee2bd
SHA1 46ce2a9f323b636f49a113d63128e467b10fa832
SHA512 bb7c0fe94834286c6f702a6fd97f54463734faed73f46d3421b72e9340e7ad3eb058a5ceb7458f258b721e0bf1f7129e589eca06f5279967053608f3f48a1d24
SSDEEP 393216:H7Vr+zmtlkWSVec+oGvqbZkVwoYa3R4e5vyHkYAarnJn+DvpLc:pynVeZbUAaL2vu
TLSH
T1E767BE15A2B581E5D677C278C2568733EB7138A403305AEB1169DAB11FB3EE05E7F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	UidBypass 1.4.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	UidBypass 1.4.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	UidBypass 1.4.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5100	netsh.exe

Loads dropped DLL 2 IoCs

pid	Process
4912	UidBypass 1.4.exe
4912	UidBypass 1.4.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
3	raw.githubusercontent.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4912	UidBypass 1.4.exe
4912	UidBypass 1.4.exe
4912	UidBypass 1.4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	UidBypass 1.4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	UidBypass 1.4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 5100	4912	UidBypass 1.4.exe	86

C:\Users\Admin\AppData\Local\Temp\UidBypass 1.4.exe
"C:\Users\Admin\AppData\Local\Temp\UidBypass 1.4.exe"
1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UIDBypassDll.dll

Path C:\Users\Admin\AppData\Local\Temp\UIDBypassDll.dll
Size 15.6MB
SHA256 3bdc2455f020a315c6286b951ab170d00500eaf192d1e7a359674f00cdece6eb
MD5 386bbe1d11aa479b8d9768a2ad89ccb9
SHA1 e5360035486549dd06bb511c2d94a0b8358859fb
SHA512 c03797c3c1a047d4c3e08baccbe5fde144a26df64189208fba2ce2a6f65fa3428c100710177d5f4f730a5569971be6d2047e8d8930aeb8244df106974b6bb6fb
SSDEEP 393216:3SVec+oGvqbZkVwoYa3R4e5vyHkYAarnJ:iVeZbUAaL
TLSH
T103F69D196576D2E8D667C178D2579B17EF22309403202FFB217ACAB11E93EE02D7E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cimgui.dll

Path C:\Users\Admin\AppData\Local\Temp\cimgui.dll
Size 1.4MB
SHA256 60ec992bcebd354d59f235ed97cdc3b0eea62c2def53c4a71f22937e500fa80b
MD5 7225d6dafc75934427c75401a2093b1c
SHA1 2f8dff8ed737b9277ca77f4f155d89b5eb034428
SHA512 74454f45172df9ad303b86d12e1e2e4c61f0af22e61c78fc552965b28e0ee3a9924ff5525aa1b54cb675644c3ed5fd9a1a78705650233370290245230a0a7f81
SSDEEP 24576:dxpSt6hFfYauZMAijqVBeF0oC8Rv2YISRCmudelw5K39YPMNi+nZoLKWdZCL:HFQau7AMBeF0xxBSruUr39YPMc+nGKRL
TLSH
T1AF659E8AA3F500A8E0BBA174D566A71FE6B1786017308ADF03D4019D5FB77E052BBB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4912-4-0x0000022E9C970000-0x0000022E9C980000-memory.dmp

Download