82928d420d3aefdbfa3440e45f662caf2b67c05c4acbcc11cb17caaf1a8e1fd5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
netwitch-by-lacflex-setup.exe
Size 1.2MB
Sample260718-gzv2lsdy7x
SHA256 82928d420d3aefdbfa3440e45f662caf2b67c05c4acbcc11cb17caaf1a8e1fd5
MD5 4329d2f807792f8a4c75c542bd96c9da
SHA1 a3b1b182fa1abe7a8d190673700cb6aaf9281517
SHA512 d56065e018360325a1beea915d0019aa40a2971f24bdd4488a911f644ef1c48c43e84eeee603a68155423b5fe170c48036d78ef9b1224ddc8f7819b891e106a0
SSDEEP 24576:RWr2vFTGScxAVu/Suleasb9eSx5l8z7G/7OW2Yt8BO4d2YvRoDd8DnS5C9f+Ce:wrCTG/Jlpw9eSx56+/7L2C8BO82YCDdn
TLSH
T19E45CFA42BEF815EE7E16D7D2ED0E93CF9F9C3902C7B0A0249A11A5CF65AD9C08D1057
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4448	powershell.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Netwitch by Lacflex\Netwitch by Lacflex-logo.png	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Uninstall-Netwitch by Lacflex.ps1	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Uninstall-Netwitch by Lacflex.vbs	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Netwitch by Lacflex.ps1	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Netwitch by Lacflex.vbs	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Netwitch by Lacflex Launcher.exe	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Netwitch by Lacflex.ico	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Netwitch by Lacflex-Task.vbs	powershell.exe
File created	C:\Program Files\Netwitch by Lacflex\Uninstall-Netwitch by Lacflex.bat	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	powershell.exe
4448	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeIncreaseQuotaPrivilege	4448	powershell.exe
Token: SeSecurityPrivilege	4448	powershell.exe
Token: SeTakeOwnershipPrivilege	4448	powershell.exe
Token: SeLoadDriverPrivilege	4448	powershell.exe
Token: SeSystemProfilePrivilege	4448	powershell.exe
Token: SeSystemtimePrivilege	4448	powershell.exe
Token: SeProfSingleProcessPrivilege	4448	powershell.exe
Token: SeIncBasePriorityPrivilege	4448	powershell.exe
Token: SeCreatePagefilePrivilege	4448	powershell.exe
Token: SeBackupPrivilege	4448	powershell.exe
Token: SeRestorePrivilege	4448	powershell.exe
Token: SeShutdownPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeSystemEnvironmentPrivilege	4448	powershell.exe
Token: SeRemoteShutdownPrivilege	4448	powershell.exe
Token: SeUndockPrivilege	4448	powershell.exe
Token: SeManageVolumePrivilege	4448	powershell.exe
Token: 33	4448	powershell.exe
Token: 34	4448	powershell.exe
Token: 35	4448	powershell.exe
Token: 36	4448	powershell.exe
Token: SeIncreaseQuotaPrivilege	4448	powershell.exe
Token: SeSecurityPrivilege	4448	powershell.exe
Token: SeTakeOwnershipPrivilege	4448	powershell.exe
Token: SeLoadDriverPrivilege	4448	powershell.exe
Token: SeSystemProfilePrivilege	4448	powershell.exe
Token: SeSystemtimePrivilege	4448	powershell.exe
Token: SeProfSingleProcessPrivilege	4448	powershell.exe
Token: SeIncBasePriorityPrivilege	4448	powershell.exe
Token: SeCreatePagefilePrivilege	4448	powershell.exe
Token: SeBackupPrivilege	4448	powershell.exe
Token: SeRestorePrivilege	4448	powershell.exe
Token: SeShutdownPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeSystemEnvironmentPrivilege	4448	powershell.exe
Token: SeRemoteShutdownPrivilege	4448	powershell.exe
Token: SeUndockPrivilege	4448	powershell.exe
Token: SeManageVolumePrivilege	4448	powershell.exe
Token: 33	4448	powershell.exe
Token: 34	4448	powershell.exe
Token: 35	4448	powershell.exe
Token: 36	4448	powershell.exe
Token: SeIncreaseQuotaPrivilege	4448	powershell.exe
Token: SeSecurityPrivilege	4448	powershell.exe
Token: SeTakeOwnershipPrivilege	4448	powershell.exe
Token: SeLoadDriverPrivilege	4448	powershell.exe
Token: SeSystemProfilePrivilege	4448	powershell.exe
Token: SeSystemtimePrivilege	4448	powershell.exe
Token: SeProfSingleProcessPrivilege	4448	powershell.exe
Token: SeIncBasePriorityPrivilege	4448	powershell.exe
Token: SeCreatePagefilePrivilege	4448	powershell.exe
Token: SeBackupPrivilege	4448	powershell.exe
Token: SeRestorePrivilege	4448	powershell.exe
Token: SeShutdownPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeSystemEnvironmentPrivilege	4448	powershell.exe
Token: SeRemoteShutdownPrivilege	4448	powershell.exe
Token: SeUndockPrivilege	4448	powershell.exe
Token: SeManageVolumePrivilege	4448	powershell.exe
Token: 33	4448	powershell.exe
Token: 34	4448	powershell.exe
Token: 35	4448	powershell.exe
Token: 36	4448	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4448	4900	netwitch-by-lacflex-setup.exe	89

C:\Users\Admin\AppData\Local\Temp\netwitch-by-lacflex-setup.exe
"C:\Users\Admin\AppData\Local\Temp\netwitch-by-lacflex-setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Setup-Netwitch by Lacflex.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Netwitch by Lacflex Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Netwitch by Lacflex Launcher.exe
Size 367KB
SHA256 6d5b179dc28489afaccdf53c8bb4da65a5d6c93513fbb172335294ba7b91c97b
MD5 cca099a7a293b21e695fcc288fe9dc7d
SHA1 9a85e235ad316351e1ec3f28d9b827df1be5d561
SHA512 ce81ca693e0dfbc5354b10e7177de7991f69eb8b5908b5012d7216316109de34f8ffe1c86b66f8d653ab0a348a1d395769d048b6db8d26884a4237f71ddc2239
SSDEEP 6144:z9xYGBzxlC1kFLYnPnqTIsAHL+Ov5xjZnlboUd/nUDndzB+8kKlQziLP5RlKn9xp:LRkqjAxx7pdPUDn7+wiIbeWf+QLby
TLSH
T12784C4A42BEF815EE7E1697D2ED0E93CF9F9C3902C7B0A4249A11E4CF659E9C18D0057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Netwitch by Lacflex-Task.vbs

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Netwitch by Lacflex-Task.vbs
Size 317B
SHA256 0751a0ff803625ad97af46bfa39201f8e206fae98e2d51ac497753b92dc3cb65
MD5 849330cbf26b4beb05ab76861144f77b
SHA1 4c923548fffcfbf2374c16ede69ec71bf5fe1fac
SHA512 a504d549c89f808b24bbf97822f38e777de2276b3f6e68c39a7fb3f3ca8e0e956e9d066a8d1a57b6dd1c0d32560c7c2870684bfaa03585473662054d61eb064a
TLSH
T1E2E07DABEF8EFF114DCA81F38761A4291C4191DB312CA4684E54C5210044BB64DC7F12
MD5 SHA1 SHA512 TLSH

Submit Download

Netwitch by Lacflex-logo.png

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Netwitch by Lacflex-logo.png
Size 488KB
SHA256 ddcc946a7fe02fbffb88867300a44f2bc064f15aa42a433dcd888f9011ad4a46
MD5 7cdbe64fed5e931decddf0fa9aee064a
SHA1 2b6dee53dad3a36eaa5a96ad9a8a81743624fdd0
SHA512 0dd68d86e70ddaeec0a1d3e9e88dc6c90465dc454c32b2b9f7225618cbee616028d306b8a32d516e83a0c310f82a787ab787e542f1fb3df23301830aea7e40bf
SSDEEP 12288:9wMxAXXvL1XNa1a8eORFpKHJ+gtnmquWbJpGy2f/JT7:9wCkL1Oa+sHJpXbjIV
TLSH
T120B4232D95CBA4DB5258310A424EC0B4D34703D93F0B5F2918EF95EAAA76D9306F7F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Netwitch by Lacflex.ico

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Netwitch by Lacflex.ico
Size 361KB
SHA256 38be33f20d4342d82ca8bfb5052ed0c027920bdd8b162a81ff5aeebb1930b38c
MD5 61b9663ead9673622816a7e284633f38
SHA1 80994d1ff4498e4b15cca0ee5946562c6098c98a
SHA512 7f993915240ceca0af704163ef7e072663e10fba059bb1c82b38e4f571565aa09228759418c99e3e06f35dfc424c21adf28c6458ede8699b8bf0984e95c1fd94
SSDEEP 6144:PYGBzxlC1kFLYnPnqTIsAHL+Ov5xjZnlboUd/nUDndzB+8kKlQziLP5RlKn9xSe3:LRkqjAxx7pdPUDn7+wiIbeWf+QLby
TLSH
T19D74C4A42BEF815EE7E16D7D2AD0E93CF9F9C3902C7B0A4249A11E4CF659E9C18D0057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Netwitch by Lacflex.ps1

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Netwitch by Lacflex.ps1
Size 21KB
SHA256 013055f7ae13a1e55f07981e2ff2d35033fcee863c1c6e5f203a5b12fa3d9125
MD5 8a09bcaf165fd0d286b0205d19b218a7
SHA1 49d5afe7fb1742ecc99b34c8bd7f905ce6be47a4
SHA512 c012d709117c0a70823373cbfabe5827afd96e719d88124f3d0462878752e53f6729f3c35a422f8a9261a922bd212efda047823a7934701dc621488f1375267c
SSDEEP 384:HoV7r5LW5HYyCUbHt2eyHD5F+Vm3mXyHDfUrmDmwH3Ywh3jwwSNwwXts2fgNgvck:vtmU
TLSH
T1ECA2553A3A5A84449BCB74591DEEC148AA283237310DDC1875EF9384FF1B534CEB97A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Netwitch by Lacflex.vbs

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Netwitch by Lacflex.vbs
Size 297B
SHA256 5805717564882b9c0cc016c3a1448ac16ff587ee795cf92af22de79a15ad89d6
MD5 7e8cca09d25921890f35918c0b726b4d
SHA1 1d97dd0d21cde3f148ce95a9714db97e28fc060c
SHA512 27c2aaee1e2e176eb8814c4f888d1fceb76e80053bd3754418a3d29faa5c448650c2d46d0495b5d99fa5d5871876a9f51202c68166300488485a8a3df4e47808
TLSH
T11CE02B1BFD28E76A9F9BCAFA01F2C91C8967A0182204D2115DF0CD6D74082B44EB63C2
MD5 SHA1 SHA512 TLSH

Submit Download

Setup-Netwitch by Lacflex.ps1

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Setup-Netwitch by Lacflex.ps1
Size 57KB
SHA256 ac2ec2db674b3aa6a2be070bcf2dcf5a6b41ffa51ea3c7a6872de4e5b06ba72d
MD5 6c4ed4b2f7cd984c0cc937685c844f8f
SHA1 1bdbed7c363dd69fcb33bc3a8689fa9308dee757
SHA512 1cab8c81f7a483073b10efac94f0c67dcd6eb5b4631f7dcc506c307b415edf5f6df78f544c9616d1f72c431776587c3eb6658d07de2f1d05ecdfb0f58476c7b1
SSDEEP 768:vUbMIYTXrGjAr5JBSuOrvfmz7oF/yc0IuANhnKOCxi7Rlh/EV:sgIYF5JBSuOM7oF6c0IuANhnKY/W
TLSH
T19743943F93A92A106E8A324A436AB5911D100477222DA4D439EFC60FBFD5835CDF77B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall-Netwitch by Lacflex.bat

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Uninstall-Netwitch by Lacflex.bat
Size 63B
SHA256 34ea582501e1f237e61c1ca3753184ccf6f5f5908df143ccca2486952746591c
MD5 c91ea12d1e8a4c650cbd089248e594c9
SHA1 10f482981f19fba6afb00477b1172986c07f4309
SHA512 9970cbe612cd4b0be91424d0210078d0528d90401f69446d284fb195aada8ec09c48c59ad0ce3ca042d40c1c792cc43fcf00b8401a509309f7374d0ce1d19494
TLSH
T18FA0023F4B8E95506E56454113534198630E44D3546B945014B7A012154D9BB9C8B6C3
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall-Netwitch by Lacflex.ps1

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Uninstall-Netwitch by Lacflex.ps1
Size 9KB
SHA256 1dc9b4bbc72eab43e87bc74be287ad6b2710b1a0d45d7f27b173e89688443123
MD5 70d4a3c6ad87e5158f3169769d9a5a7d
SHA1 dc5333a2360c3cfd9d600ba8e1a971bc5a21eac4
SHA512 cd7133001e17362f2eccef5c7dde6d49d45dda899c6ffbc9ece7b497e4ddd3a169aa86f3d0e2288e577ab8ee5b42b6660441bd8c3445c7454d74affcba930810
SSDEEP 192:SUyWBHO3duVKRqXkzuN9TkO8x4yysH5yynQHOJk6rLMpIOeOwUDLv8lKe2DP/yrY:SUK8KRqXkzuN9kOYmH6M6fWv8lKehwSA
TLSH
T18622647EB3ED5091AFC56747159BD1842E251137201C6E0439EFC344EF8A63A8FBA39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall-Netwitch by Lacflex.vbs

Path C:\Users\Admin\AppData\Local\Temp\NetwitchByLacflexSetup-db74b27041744192a87ce544290fb14e\Uninstall-Netwitch by Lacflex.vbs
Size 307B
SHA256 bd15a687b9f12d4834519e89ae38818c25711ca78fb9e6ab546c4cfef14e06fd
MD5 58d8f082520cf2e372ca0d5941749793
SHA1 892a19d53970da52412ba111d80332b389f69ed2
SHA512 b0596e118c4011a95bc20d86c1d1fc6cfd42883d66b7d6192ef67e281ca0b544d55e7f76bbe9593c416dc10790e8cc734b69974c6b66682cb8fb8611bc9b590d
TLSH
T172E0271BFD18D7695F5BC67601F3C91C865760141214D1115DF0CD5D740D2B44E763C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4448-33-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-32-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-36-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-37-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-38-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-40-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-34-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-41-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-42-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-64-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-61-0x0000012330F10000-0x0000012330F2E000-memory.dmp

Download

memory/4448-45-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-47-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-35-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-30-0x000001232EC00000-0x000001232EC22000-memory.dmp

Download

memory/4448-60-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4448-59-0x0000012330EE0000-0x0000012330EEA000-memory.dmp

Download

memory/4448-58-0x0000012332F00000-0x0000012332FB2000-memory.dmp

Download

memory/4448-57-0x0000012330EC0000-0x0000012330EDE000-memory.dmp

Download

memory/4900-1-0x0000000000CA0000-0x0000000000DDC000-memory.dmp

Download

memory/4900-4-0x0000000001650000-0x0000000001662000-memory.dmp

Download

memory/4900-2-0x0000000001640000-0x000000000164A000-memory.dmp

Download

memory/4900-26-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4900-27-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4900-44-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download

memory/4900-0-0x00007FFE9C01F000-0x00007FFE9C020000-memory.dmp

Download

memory/4900-65-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp

Download