17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5

Resubmissions

20/07/2026, 18:41

260720-xbwagabz5k10

18/07/2026, 22:36

260718-2jnmtahs6t10

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Private Bypass/yonetici calistir sonra loaderi aç.bat
Size 636B
Sample260718-2jnmtahs6t
SHA256 17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5
MD5 6de192f8e7f86649535e833623974a6b
SHA1 4e2cdb3c243fe656884fe199e21e9e45c4ec567a
SHA512 35e50867a9628d84cf43ed2ea79ecec38734dc1eac3011a13ac442fb998e31d31a965864bf6edee0d5bf9854725a312880582f39296737b303df9456c3ba69cc
TLSH
T198F0810A84EC85CF38D2FB3437D3A722471E75ADB963A2E91F91901D008828326ED48F
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1032	netsh.exe
4336	netsh.exe
5688	netsh.exe
2608	netsh.exe
5572	netsh.exe
5112	netsh.exe
3416	netsh.exe
1604	netsh.exe
1320	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4348	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 5572	4348	cmd.exe	90
PID 4348 wrote to memory of 5112	4348	cmd.exe	91
PID 4348 wrote to memory of 3416	4348	cmd.exe	92
PID 4348 wrote to memory of 1604	4348	cmd.exe	93
PID 4348 wrote to memory of 1032	4348	cmd.exe	94
PID 4348 wrote to memory of 4336	4348	cmd.exe	95
PID 4348 wrote to memory of 1320	4348	cmd.exe	96
PID 4348 wrote to memory of 5688	4348	cmd.exe	97
PID 4348 wrote to memory of 2608	4348	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Private Bypass\yonetici calistir sonra loaderi aç.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5572
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5112
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3416
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1604
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1032
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile firewallpolicy blockinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4336
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1320
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5688
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall set rule all new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2608