5980594ca4ddeab632c62839878b9e0565489fbd296adaf68862810b8e32fcfa

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Halo-HDMSoftware-2.10.0-20251217.exe
Size 4.3MB
Sample260723-cmjetsfc46
SHA256 5980594ca4ddeab632c62839878b9e0565489fbd296adaf68862810b8e32fcfa
MD5 f9242662470d2506e3a4d8d3dbff68c6
SHA1 1fff25fa97f43bce4294779a35abc9161f4e8154
SHA512 bf208870afb62cdef65d560f7705b048be4e208c651b920810b10f8fa44b44be863d326118461532887528ba8ecdd4a8562b46c7bb8e9cd7af0a56d0aaef8e92
SSDEEP 98304:oSiufiFr4wS/oKC4EqkOOXoFTep6VWJNueZFsBDnI+:PI4wJKC4EXOya60WJNueZFU
TLSH
T17926023FF268653ED4AA0B3146B39250597BBB60B81A8C1E17F0098DCF764711F3BA56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2700	netsh.exe
472	netsh.exe
4304	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
940	Halo-HDMSoftware-2.10.0-20251217.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\unins000.dat	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\is-MLHJQ.tmp	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\is-SI7T8.tmp	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\is-LU2TO.tmp	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\is-H0BMD.tmp	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\is-HCKR7.tmp	Halo-HDMSoftware-2.10.0-20251217.tmp
File created	C:\Program Files (x86)\HaloDevMan\is-L89EP.tmp	Halo-HDMSoftware-2.10.0-20251217.tmp
File opened for modification	C:\Program Files (x86)\HaloDevMan\unins000.dat	Halo-HDMSoftware-2.10.0-20251217.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halo-HDMSoftware-2.10.0-20251217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halo-HDMSoftware-2.10.0-20251217.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5000-0-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup
behavioral2/memory/5000-8-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup
behavioral2/memory/5000-47-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	Halo-HDMSoftware-2.10.0-20251217.tmp
940	Halo-HDMSoftware-2.10.0-20251217.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	Halo-HDMSoftware-2.10.0-20251217.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 940	5000	Halo-HDMSoftware-2.10.0-20251217.exe	89
PID 940 wrote to memory of 364	940	Halo-HDMSoftware-2.10.0-20251217.tmp	90
PID 364 wrote to memory of 2700	364	cmd.exe	92
PID 364 wrote to memory of 5816	364	cmd.exe	93
PID 364 wrote to memory of 472	364	cmd.exe	95
PID 364 wrote to memory of 4304	364	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Halo-HDMSoftware-2.10.0-20251217.exe
"C:\Users\Admin\AppData\Local\Temp\Halo-HDMSoftware-2.10.0-20251217.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\is-V75U0.tmp\Halo-HDMSoftware-2.10.0-20251217.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V75U0.tmp\Halo-HDMSoftware-2.10.0-20251217.tmp" /SL5="$4011E,3701391,792576,C:\Users\Admin\AppData\Local\Temp\Halo-HDMSoftware-2.10.0-20251217.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\HaloDevMan\FIREWALL.bat" add"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall show rule name="HaloDevMan" verbose
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2700
  - - C:\Windows\SysWOW64\find.exe
      find /I "C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="HaloDevMan" dir=in action=allow program="C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe" profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:472
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="HaloDevMan" dir=out action=allow program="C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe" profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FIREWALL.bat

Path C:\Program Files (x86)\HaloDevMan\FIREWALL.bat
Size 974B
SHA256 e55e71a2b8067f4807b036fb06bbbce1a39e6f55bcab015351089d59725a81a6
MD5 2ff2057112f9c0fc521604020f7951ec
SHA1 423bb59e418ac12080419885609cbfcafae5b8a8
SHA512 2818dfe74972a7d827822047e445bef6e04a1a3c9a1a178417865f65574f538a05872a98cae1e04680350a59046b2826a574e217d3e092d6370a62fb41da52b7
TLSH
T116117B066CAD849262E2F777F3019540991DF05E7B3E1BC43DE76025BF119A101DF447
MD5 SHA1 SHA512 TLSH

Submit Download

HaloDevMan.exe

Path C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe
Size 3.0MB
SHA256 da044970b68fd357d89c08bf5846f2feb81b1dea56b3209722a5960ca98b7cc0
MD5 b4199dd28e744a497743275b3942be6d
SHA1 3ab12988eae0704ad453f1ea3feb9af008a6446e
SHA512 3389a0e0c86ec49aa793aa837ab49eaac0a0dbf6aa2b461937a99e20fcd8d377316d99a74ecfd13f41c579fbea737084e1dbc79efb0ad6781edeb243de57342a
SSDEEP 49152:1pn7SJ4/xRWWr58Oigz7ws+sbKR2NneHzovK+xmB3NHKgCLcYrHmroL0GxNclDxh:1p7n/xkWrGXQURsFhxmJNzCLc2wUIx
TLSH
T10AE51214E3FA0A43F8BF2B78897550508A76FD2AA829D34D0C9571DD4EB2B70CA71763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Halo-HDMSoftware-2.10.0-20251217.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-V75U0.tmp\Halo-HDMSoftware-2.10.0-20251217.tmp
Size 2.9MB
SHA256 c292f418c302193322dd74ccff1cc13eba8b2e63d240dbcd25454769d258420d
MD5 fe81fde6cf5ff1d371cb569bda8be4e1
SHA1 72c1fc88915d7be4b95dd479822b01c998395fbc
SHA512 cf3cbcabf45f625dd7b944fc4c292619353f56f45c2e9fa089b706b7a44661174b675f085822f064f6d8c0f857f59d4939636d0cd2eb5d292234960bb3702931
SSDEEP 49152:wLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvkz:MwSi0b67zeCzt0+yO3kSc
TLSH
T1BAE55B27F7887D3ED06B0B364A37C690983BBB627A128D5757F0094C8F355942E3EA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-10-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/940-9-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/940-12-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/940-14-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/940-6-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/940-37-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/940-46-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/5000-8-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/5000-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/5000-47-0x0000000000400000-0x00000000004CF000-memory.dmp

Download