1237eeb4ba4aa65688c21b64e5f2e7256c06c4fcd23b415f56754b0fa9b44100

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
2s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rapid Tweaks Network Tweaks.exe
Size 100KB
Sample260715-x2caaacz4l
SHA256 1237eeb4ba4aa65688c21b64e5f2e7256c06c4fcd23b415f56754b0fa9b44100
MD5 eead8c6daca64b514a1bda792a8f9560
SHA1 86d490925f281f31e53059420cedf43571dba4f1
SHA512 d658dcb1f1210995833bc37bbf5cfca29a7b3bfc022ff06d6b7d3e444ec4acd27bce5ecaf8b8b93a1357b96f6fc4a5880ae1727fcafe84e4a0ea5ac5bb5eae85
SSDEEP 1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfDwTDHga5L:T7DhdC6kzWypvaQ0FxyNTBfDWHgal
TLSH
T166A36D41B3E102F7E6F2053100A6E27F97366E249724A9DBC7DC2D437912AD1A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rapid Tweaks Network Tweaks.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6060	ipconfig.exe
3056	ipconfig.exe
5232	ipconfig.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4972	3204	Rapid Tweaks Network Tweaks.exe	88
PID 4972 wrote to memory of 3308	4972	cmd.exe	89
PID 4972 wrote to memory of 1076	4972	cmd.exe	90
PID 4972 wrote to memory of 4156	4972	cmd.exe	91
PID 4972 wrote to memory of 5012	4972	cmd.exe	92
PID 4972 wrote to memory of 3976	4972	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\Rapid Tweaks Network Tweaks.exe
"C:\Users\Admin\AppData\Local\Temp\Rapid Tweaks Network Tweaks.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\37FE.tmp\37FF.tmp\3800.bat "C:\Users\Admin\AppData\Local\Temp\Rapid Tweaks Network Tweaks.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\netsh.exe
    netsh int ip reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3308
- - C:\Windows\system32\netsh.exe
    netsh interface ipv4 reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1076
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4156
- - C:\Windows\system32\netsh.exe
    netsh interface tcp reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5012
- - C:\Windows\system32\netsh.exe
    netsh winsock reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3976
- - C:\Windows\system32\netsh.exe
    netsh winsock reset catalog
    3⤵
    PID:256
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5232
- - C:\Windows\system32\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:6060
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3800.bat

Path C:\Users\Admin\AppData\Local\Temp\37FE.tmp\37FF.tmp\3800.bat
Size 6KB
SHA256 597132525727b1d133a8d2bcefac888981a2a1da65d48b4e8701da05618e2725
MD5 45e764a600e7862b733aa62fdb5a6752
SHA1 71a8d48b708e205cf3f2177612d6bb5ed2fc8890
SHA512 0761643edf653101e57476201b508bcb5a8e677d9febdcf8b6a6154a9e05874ac09ee57ae0de32480074380ca2598ea8cd6b16395e5c863ef6145fef667b9c06
SSDEEP 96:iDZLdKTzl1oi2IcGWEOimjOCNNWFn137rSVWI:iDZLdKTzluLIcGWEOimjOCNNWYWI
TLSH
T124E19A11BD2F5B3BDE4DD079A1134A037DA96A8F86442FE3776A250F00235A38538EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads