Analysis
- user interaction
yes - max time kernel
26s - max time network
23s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bypass.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bypass.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target bypass.exe
- Size 1.3MB
- Sample260716-e2nzzacz5r
- SHA256 c8a4d2b721925c313f6add4c9d9d9519cc1adf5e7ba65432e945804ac90ec764
- MD5 cd37c51f5517746bae492122a88f4e45
- SHA1 5a6fd663ede67dfd391d6494934770692e6fed54
- SHA512 1b8e9e395f4e4ca8560e8cbd5eee6875e50d7ad755c60252dcbc91c94a4975ee0f5cae3e4ab7b0f1ce4d21fcf869d6315f6a6d2611dccfbf33dee60611af294f
- SSDEEP 24576:clB+NwBI8hBbUBc3UGpQFCfHAxK2Yy3AqjYWL30ZezVqxJh1:cnMNibUsVpQFCfAxKm3AqnL306q/h
- TLSH T1D8559D07A54B58ACD09BD9B8436B5902DB21744B4736FCEF11CA95B72F3B2E48B39702
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions bypass.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools bypass.exe - Modifies Windows Firewall 2 TTPs 6 IoCs
pid Process 1832 netsh.exe 4032 netsh.exe 3832 netsh.exe 728 netsh.exe 4736 netsh.exe 4272 netsh.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bypass.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bypass.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe 5084 bypass.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5084 bypass.exe Token: SeDebugPrivilege 5084 bypass.exe Token: SeDebugPrivilege 5084 bypass.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5084 wrote to memory of 728 5084 bypass.exe 88 PID 5084 wrote to memory of 4736 5084 bypass.exe 90 PID 5084 wrote to memory of 4272 5084 bypass.exe 92 PID 5084 wrote to memory of 1832 5084 bypass.exe 95 PID 5084 wrote to memory of 4032 5084 bypass.exe 97 PID 5084 wrote to memory of 3832 5084 bypass.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\bypass.exe"C:\Users\Admin\AppData\Local\Temp\bypass.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_80" dir=out action=block protocol=TCP localport=80 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:728
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_443" dir=out action=block protocol=TCP localport=443 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4736
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_1355" dir=out action=block protocol=TCP localport=1355 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4272
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_80" dir=out action=block protocol=TCP localport=80 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1832
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_443" dir=out action=block protocol=TCP localport=443 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4032
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_1355" dir=out action=block protocol=TCP localport=1355 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3832
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2