c8a4d2b721925c313f6add4c9d9d9519cc1adf5e7ba65432e945804ac90ec764

Analysis

user interaction
yes
max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:26

Target
bypass.exe
Size 1.3MB
Sample260716-e2nzzacz5r
SHA256 c8a4d2b721925c313f6add4c9d9d9519cc1adf5e7ba65432e945804ac90ec764
MD5 cd37c51f5517746bae492122a88f4e45
SHA1 5a6fd663ede67dfd391d6494934770692e6fed54
SHA512 1b8e9e395f4e4ca8560e8cbd5eee6875e50d7ad755c60252dcbc91c94a4975ee0f5cae3e4ab7b0f1ce4d21fcf869d6315f6a6d2611dccfbf33dee60611af294f
SSDEEP 24576:clB+NwBI8hBbUBc3UGpQFCfHAxK2Yy3AqjYWL30ZezVqxJh1:cnMNibUsVpQFCfAxKm3AqnL306q/h
TLSH
T1D8559D07A54B58ACD09BD9B8436B5902DB21744B4736FCEF11CA95B72F3B2E48B39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	bypass.exe
Token: SeDebugPrivilege	3332	bypass.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3556	3332	bypass.exe	88
PID 3332 wrote to memory of 5972	3332	bypass.exe	90
PID 3332 wrote to memory of 4464	3332	bypass.exe	92