11674759efd15e5f5ca11e41ad6a051f1469786cecd9d52cd854d11f20b81f5b

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11674759efd15e5f5ca11e41ad6a051f1469786cecd9d52cd854d11f20b81f5b.dll
Size 416KB
Sample260724-qyn2caer5x
SHA256 11674759efd15e5f5ca11e41ad6a051f1469786cecd9d52cd854d11f20b81f5b
MD5 05446413e1f3aafaf5b3988cda28ba6b
SHA1 4044f2c2ea38151973af6dce3e2a26bf51e39096
SHA512 fbeda4ec133a3f17ed768d2c1b2cd9474720dc6f0a6cfce4cb1b3b08181f488680380a6edd769e3488fae2ac06e19d6765c42a94280685158646fe2d139829ed
SSDEEP 12288:vhtN8getUq6iOA9pRGWWdKrp8m7oXFOqPT/VyH:5tOtp689pF3t8KoXFD0
TLSH
T18E9412BE43180F1DC3D22078595F7768B7EC89BB396E06EA5D4F0925B010AF8A787D52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
204	netsh.exe
4312	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinMSFWXMCX\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\11674759efd15e5f5ca11e41ad6a051f1469786cecd9d52cd854d11f20b81f5b."	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2400	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5344	cmd.exe
5892	CMD.exe
3240	cmd.exe
5128	cmd.exe
1136	CMD.exe
2440	cmd.exe
4840	cmd.exe
1840	cmd.exe
5156	cmd.exe
5036	cmd.exe
4328	cmd.exe
1120	CMD.exe
1408	cmd.exe
3468	cmd.exe
4800	cmd.exe
2228	cmd.exe
1412	cmd.exe
4324	cmd.exe
3372	cmd.exe
4192	cmd.exe
4424	cmd.exe
1716	CMD.exe
4824	cmd.exe
2804	cmd.exe
4272	cmd.exe
5864	cmd.exe
5948	cmd.exe
824	cmd.exe
564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112
Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6116	rundll32.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 6116	4744	rundll32.exe	87
PID 6116 wrote to memory of 564	6116	rundll32.exe	89
PID 6116 wrote to memory of 4328	6116	rundll32.exe	90
PID 6116 wrote to memory of 1412	6116	rundll32.exe	91
PID 6116 wrote to memory of 824	6116	rundll32.exe	92
PID 6116 wrote to memory of 5948	6116	rundll32.exe	93
PID 6116 wrote to memory of 2228	6116	rundll32.exe	94
PID 6116 wrote to memory of 5036	6116	rundll32.exe	95
PID 6116 wrote to memory of 5128	6116	rundll32.exe	96
PID 6116 wrote to memory of 5864	6116	rundll32.exe	97
PID 6116 wrote to memory of 4192	6116	rundll32.exe	98
PID 6116 wrote to memory of 1840	6116	rundll32.exe	99
PID 6116 wrote to memory of 4840	6116	rundll32.exe	100
PID 6116 wrote to memory of 4800	6116	rundll32.exe	101
PID 6116 wrote to memory of 4324	6116	rundll32.exe	102
PID 6116 wrote to memory of 3240	6116	rundll32.exe	103
PID 6116 wrote to memory of 3468	6116	rundll32.exe	104
PID 6116 wrote to memory of 2440	6116	rundll32.exe	105
PID 6116 wrote to memory of 4824	6116	rundll32.exe	106
PID 6116 wrote to memory of 5156	6116	rundll32.exe	107
PID 6116 wrote to memory of 3372	6116	rundll32.exe	108
PID 6116 wrote to memory of 1408	6116	rundll32.exe	109
PID 6116 wrote to memory of 4272	6116	rundll32.exe	110
PID 6116 wrote to memory of 5344	6116	rundll32.exe	111
PID 6116 wrote to memory of 2804	6116	rundll32.exe	114
PID 6116 wrote to memory of 4424	6116	rundll32.exe	115
PID 6116 wrote to memory of 5892	6116	rundll32.exe	139
PID 6116 wrote to memory of 1716	6116	rundll32.exe	140
PID 6116 wrote to memory of 1136	6116	rundll32.exe	141
PID 6116 wrote to memory of 1120	6116	rundll32.exe	142
PID 4324 wrote to memory of 1128	4324	cmd.exe	147
PID 2440 wrote to memory of 6088	2440	cmd.exe	149
PID 5128 wrote to memory of 3600	5128	cmd.exe	150
PID 4272 wrote to memory of 5072	4272	cmd.exe	151
PID 4840 wrote to memory of 1880	4840	cmd.exe	152
PID 4424 wrote to memory of 4368	4424	cmd.exe	153
PID 4800 wrote to memory of 5548	4800	cmd.exe	154
PID 4192 wrote to memory of 1208	4192	cmd.exe	155
PID 1136 wrote to memory of 4312	1136	CMD.exe	156
PID 5892 wrote to memory of 2400	5892	CMD.exe	157
PID 5344 wrote to memory of 6084	5344	cmd.exe	158
PID 3372 wrote to memory of 4320	3372	cmd.exe	159
PID 3240 wrote to memory of 3012	3240	cmd.exe	160
PID 1120 wrote to memory of 204	1120	CMD.exe	161
PID 1408 wrote to memory of 5928	1408	cmd.exe	162
PID 2228 wrote to memory of 3156	2228	cmd.exe	163
PID 4824 wrote to memory of 5952	4824	cmd.exe	164
PID 1716 wrote to memory of 2620	1716	CMD.exe	165
PID 1840 wrote to memory of 4900	1840	cmd.exe	166
PID 5864 wrote to memory of 4244	5864	cmd.exe	167
PID 2620 wrote to memory of 5380	2620	net.exe	168
PID 5156 wrote to memory of 2664	5156	cmd.exe	170
PID 3468 wrote to memory of 4552	3468	cmd.exe	171
PID 2804 wrote to memory of 4268	2804	cmd.exe	172
PID 5036 wrote to memory of 3996	5036	cmd.exe	173

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11674759efd15e5f5ca11e41ad6a051f1469786cecd9d52cd854d11f20b81f5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11674759efd15e5f5ca11e41ad6a051f1469786cecd9d52cd854d11f20b81f5b.dll,#1
  2⤵
  - Server Software Component: Terminal Services DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md C:\Windows\Migration\sdd
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md C:\Windows\ehome\sdd
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md C:\Windows\AppPatch\sdd
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md C:\Windows\Branding\sdd
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md C:\Windows\Performance\sdd
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\INF /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\INF /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\INF /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\INF /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\INF\Wdeilay.PNF /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\INF\Wdeilay.PNF /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\INF\Wdeilay.PNF /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\INF\Wdeilay.PNF /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\windows\Temp /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\windows\Temp /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\windows\Temp /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\windows\Temp /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\windows\Temp\FWXMRZ /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\windows\Temp\FWXMRZ /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\windows\Temp\FWXMRZ /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\windows\Temp\FWXMRZ /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Users\Administrator\AppData\Local\Temp /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Users\Administrator\AppData\Local\Temp /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Users\Administrator\AppData\Local\Temp /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Users\Administrator\AppData\Local\Temp /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\Migration\sdd /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\Migration\sdd /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\ehome\sdd /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\ehome\sdd /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\AppPatch\sdd /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\AppPatch\sdd /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\Branding\sdd /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5156
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\Branding\sdd /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\Performance\sdd /e /t /p Administrators:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\Performance\sdd /e /t /p Administrators:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\Migration\sdd /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\Migration\sdd /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\ehome\sdd /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\ehome\sdd /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\AppPatch\sdd /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\AppPatch\sdd /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\Branding\sdd /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\Branding\sdd /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cacls.exe C:\Windows\Performance\sdd /e /t /p everyone:F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\Performance\sdd /e /t /p everyone:F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4368
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C sc config WerSvc start= DISABLED
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\SysWOW64\sc.exe
      sc config WerSvc start= DISABLED
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2400
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C net stop WerSvc
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\net.exe
      net stop WerSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WerSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C Netsh advfirewall set currentprofile state off
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\SysWOW64\netsh.exe
      Netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4312
- - C:\Windows\SysWOW64\CMD.exe
    CMD /C Netsh advfirewall set privateprofile state off
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\netsh.exe
      Netsh advfirewall set privateprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k MyServicesMSFWXMCX
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

FWXMRZWJ20260724.INI

Path C:\windows\Temp\FWXMRZ\FWXMRZWJ20260724.INI
Size 121B
SHA256 be745e47b1af682ccecdadff470a6335c91aea58e1df7f9d75219119e9581972
MD5 6d9c4d571d34ffade5228253408ddd35
SHA1 732fd4eb1ce4428f35c2e7ca2cc75a192dc9d4c3
SHA512 833f354041ac01614f1adc0387a21c5ccf4c4cb56a60d79f86ad2e35a856eb04e84cb66c7c57ea94861f48d9fcebd35666d5ea4f1ca73918900e17972447b386
TLSH
T1CEB02220E838F803FA0200808C802CAF80B033A0A8FB0002F0CFB2880E800F88CFF0C0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6116-13-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-9-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-2-0x00000000028E0000-0x00000000028E2000-memory.dmp

Download

memory/6116-1-0x0000000002890000-0x00000000028CE000-memory.dmp

Download

memory/6116-5-0x0000000002890000-0x00000000028CE000-memory.dmp

Download

memory/6116-7-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-3-0x00000000028F0000-0x00000000028F1000-memory.dmp

Download

memory/6116-12-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-11-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-10-0x0000000010001000-0x0000000010024000-memory.dmp

Download

memory/6116-0-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-8-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-6-0x0000000010000000-0x00000000100DA000-memory.dmp

Download

memory/6116-16-0x0000000002890000-0x00000000028CE000-memory.dmp

Download

memory/6116-4-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads