df4e36252bf8a2b1dee291bcaf9e0505246cacc1d1ea9db3494f30c8506ba0cb

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b622c451fcc9d83aad8bf45b1c42b5f.exe
Size 93KB
Sample260710-dpeebsdw9w
SHA256 df4e36252bf8a2b1dee291bcaf9e0505246cacc1d1ea9db3494f30c8506ba0cb
MD5 1b622c451fcc9d83aad8bf45b1c42b5f
SHA1 2e70ac7f1bdfc2f9912448ee2b6c2c478bef3aab
SHA512 df877ef862a83c54a397958742b17503c5938d1f585ae9f0aafcd21eaf8edace67229d089f1e638e57d97cf735819d17726edd6a1e266f42ff82882f5a8e1999
SSDEEP 1536:UUNJD/HBZbszKu9AZp77r1jEwzGi1dD8DlgS:UUUzK4AZtHCi1dyy
TLSH
T19993E94977E52524E0BF56F75471F2014E34B48B1612E39D98F219AA0B33AC44F8AFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1092	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: 33	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe
Token: SeIncBasePriorityPrivilege	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1092	4008	1b622c451fcc9d83aad8bf45b1c42b5f.exe	86

C:\Users\Admin\AppData\Local\Temp\1b622c451fcc9d83aad8bf45b1c42b5f.exe
"C:\Users\Admin\AppData\Local\Temp\1b622c451fcc9d83aad8bf45b1c42b5f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1b622c451fcc9d83aad8bf45b1c42b5f.exe" "1b622c451fcc9d83aad8bf45b1c42b5f.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1092