8192fc2de75163a001245f6b61dcc174563cefa5727ea5055587276bd59daaa1

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Base-FirewallRules-Update.bat
Size 2KB
Sample260709-alg49saz5m
SHA256 8192fc2de75163a001245f6b61dcc174563cefa5727ea5055587276bd59daaa1
MD5 756dbe9f32fe00800142d49c947107cc
SHA1 1d200199c3dc6ab3722804d61c67223167ae7323
SHA512 8d847811dd6ad43ca775af9293ef2f16cafc813e35e5213a0d35a2d389f7e4efda51d146c8c03d5bf6601aa233bb5f54b6c230f259e8165714c6425a2afecc87
TLSH
T10851E940867D6AE25A83EBB9B9426B10020CB34EFA5C7CC81B936207E4516A913FF45B
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 17 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5400	netsh.exe
1392	netsh.exe
5004	netsh.exe
4244	netsh.exe
1312	netsh.exe
1084	netsh.exe
236	netsh.exe
1820	netsh.exe
3696	netsh.exe
480	netsh.exe
712	netsh.exe
4728	netsh.exe
5080	netsh.exe
4012	netsh.exe
5904	netsh.exe
5900	netsh.exe
1872	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4728	4060	cmd.exe	89
PID 4060 wrote to memory of 236	4060	cmd.exe	90
PID 4060 wrote to memory of 5080	4060	cmd.exe	91
PID 4060 wrote to memory of 1820	4060	cmd.exe	92
PID 4060 wrote to memory of 5400	4060	cmd.exe	93
PID 4060 wrote to memory of 4012	4060	cmd.exe	94
PID 4060 wrote to memory of 1392	4060	cmd.exe	95
PID 4060 wrote to memory of 5904	4060	cmd.exe	96
PID 4060 wrote to memory of 5004	4060	cmd.exe	97
PID 4060 wrote to memory of 3696	4060	cmd.exe	98
PID 4060 wrote to memory of 4244	4060	cmd.exe	99
PID 4060 wrote to memory of 1312	4060	cmd.exe	100
PID 4060 wrote to memory of 480	4060	cmd.exe	101
PID 4060 wrote to memory of 5900	4060	cmd.exe	102
PID 4060 wrote to memory of 1084	4060	cmd.exe	103
PID 4060 wrote to memory of 1872	4060	cmd.exe	104
PID 4060 wrote to memory of 712	4060	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Base-FirewallRules-Update.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - NPLEX-Port-3151" dir=out action=allow remoteip=45.60.18.60,45.60.20.60,45.60.12.60,45.60.16.60,45.60.14.60 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4728
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - NPLEX-Port-3151" dir=in action=allow remoteip=45.60.18.60,45.60.20.60,45.60.12.60,45.60.16.60,45.60.14.60 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:236
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Datacap-Port-9000" dir=out action=allow localport=9000 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5080
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Datacap-Port-9000" dir=in action=allow localport=9000 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1820
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - StarPlus-Port-3125 (DB)" dir=in action=allow localport=3125 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5400
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - StarPlus-Port-4125 (SPPDA)" dir=in action=allow localport=4125 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4012
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - VendorEDI-Port-22 (RetailInsights)" dir=out action=allow remoteip=52.7.164.206 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1392
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSIntegration-Ports-3900,3901,3902" dir=in action=allow localport=3900-3902 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5904
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSEvolutionPOS-Port-8000" dir=in action=allow localport=8000 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5004
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSIntPortal4-Port-8001" dir=in action=allow localport=8001 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3696
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSPOSServices-Port-8002" dir=in action=allow localport=8002 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4244
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - StarPlus-Port-3150 (ASDCProcessor)" dir=in action=allow localport=3150 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1312
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - TherapyManagement-Port-8004" dir=in action=allow localport=8004 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:480
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - AsPayServer.exe" program="c:\Program Files\Auto-Star\StarPlus\AsPayServer.exe" dir=in action=allow protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5900
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - WRSA.exe (Webroot AV/AM)" program="C:\Program Files (x86)\Webroot\WRSA.exe" dir=in action=allow profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1084
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Kaseya-Port-5721 (agent)" dir=out action=allow remoteip=174.36.80.49 protocol=tcp localport=5721 profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1872
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Kaseya-Port-443 (downloads)" dir=out action=allow remoteip=52.239.154.100 protocol=tcp localport=443 profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:712