a08df6e72fac6582b670fdbdcb22a2c9241739ed57552a619539f6e38eb7edb3

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
builder+bin/out.exe
Size 32KB
Sample260730-tdy8csvxhx
SHA256 a08df6e72fac6582b670fdbdcb22a2c9241739ed57552a619539f6e38eb7edb3
MD5 0ea9146650da844d5554b093b996eb2a
SHA1 ac8c517ace3bfb7593e51a7e36e4131cdcaf6cd1
SHA512 8dc006709d5315f5d3f721f7371526dd267fda3c32e730ef418fa624d9949b8ccd7f3049b9017e3e4517bff21f31afee4064cb13d9e1971cfa2a695062c34103
SSDEEP 384:eQZFbSKQ4ABdh6oPWAe1jO/CDUEhWdieqvUnMXY:e9VrAoPo1jO/UsdJqvLXY
TLSH
T1BCE20A7BA55A7CB2DDB03A301A4DB6205EA59A307F39F8C5D39487452CFD6C0B42854B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	out.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	out.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\services = "C:\\Windows\\services.exe"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\services = "C:\\Windows\\services.exe"	services.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5488	netsh.exe
3152	netsh.exe
1712	netsh.exe
4840	netsh.exe

Deletes itself 1 IoCs

pid	Process
4264	services.exe

Executes dropped EXE 3 IoCs

pid	Process
5228	services.exe
4264	services.exe
4584	services.exe

Windows security modification 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	out.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	out.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	services.exe
File created	C:\Windows\file.bat	out.exe
File created	C:\Windows\services.exe	out.exe
File opened for modification	C:\Windows\file.bat	services.exe
File created	C:\Windows\services.exe	services.exe
File created	C:\Windows\adobe.bat	services.exe
File opened for modification	C:\Windows\file.bat	services.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6108	cmd.exe
4356	cmd.exe
5768	cmd.exe
2544	cmd.exe
2584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	out.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Runs net.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4356	4892	out.exe	88
PID 4356 wrote to memory of 5488	4356	cmd.exe	90
PID 4892 wrote to memory of 5228	4892	out.exe	92
PID 5228 wrote to memory of 5768	5228	services.exe	93
PID 5768 wrote to memory of 3152	5768	cmd.exe	95
PID 5228 wrote to memory of 2544	5228	services.exe	96
PID 2544 wrote to memory of 1136	2544	cmd.exe	98
PID 1136 wrote to memory of 2420	1136	net.exe	99
PID 2544 wrote to memory of 4264	2544	cmd.exe	100
PID 4264 wrote to memory of 2584	4264	services.exe	101
PID 2584 wrote to memory of 1712	2584	cmd.exe	103
PID 4264 wrote to memory of 6108	4264	services.exe	104
PID 6108 wrote to memory of 4840	6108	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\builder+bin\out.exe
"C:\Users\Admin\AppData\Local\Temp\builder+bin\out.exe"
1⤵
- Windows security bypass
- Windows security modification
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "file.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram C:\Users\Admin\AppData\Local\Temp\builder+bin\out.exe allowed ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5488
- C:\Windows\services.exe
  C:\Windows\services.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "file.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram C:\Windows\services.exe allowed ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "adobe.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\SysWOW64\net.exe
      net stop beep
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop beep
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
  - - C:\Windows\services.exe
      C:\Windows\services.exe /do_work
      4⤵
      Windows security bypass
      Adds policy Run key to start application
      Deletes itself
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "file.bat"
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram C:\Windows\services.exe allowed ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1712
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "file.bat"
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6108
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode DISABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1892

C:\Windows\services.exe
C:\Windows\services.exe
1⤵
- Executes dropped EXE
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

adobe.bat

Path C:\Windows\adobe.bat
Size 124B
SHA256 3e4d6630bb97a1329756c6cd3db4db1b86f4c8640f0347c723aff7adc7ce14f5
MD5 2c2520b599bd713a5fcb78bedb97d965
SHA1 c1bd010c2ddc8bf94b9587bb490cad9e1f843d73
SHA512 1723d469f6f44c35719d5a15cc05feeda2504166d666220acdbfe8da7828808208ecb4c3f000136f246f8f2c66665ef5743dee19fcba61fee54fee1eb90d1b92
TLSH
T13BB092EE574B2C7E411239C9F86DC0295628F7D3A0DA3068696C2E2BA540C976A50A66
MD5 SHA1 SHA512 TLSH

Submit Download

file.bat

Path C:\Windows\file.bat
Size 78B
SHA256 6e4291d9af58721d0cba09db33bf1545f9f7f299d88c1743bfb96896d2dfa50b
MD5 d9aa549156024a485db3ea216cf95e36
SHA1 156627f17fee79e7b217eae76f1935d6e3a3dc42
SHA512 5fc69d74e193be78b1cbd799457b59212ab31c8fb0c94095686dbdb5d2019e79b421675323e11007dcd23037cadb78559a7e93422746c9181384d4f85a0893c0
TLSH
T122A011080BAE0082E80A2A202ACA8A002008BA8AB0A022002EA0302AE002A8200A0088
MD5 SHA1 SHA512 TLSH

Submit Download

file.bat

Path C:\Windows\file.bat
Size 40B
SHA256 c7d0b4156b557c67d3e758d86a45e31c70110c989e679097f52f3edaf4963e21
MD5 f5e059efe5ed14466033f1f4357a4a4b
SHA1 ccb28b2be69275c38738947e790c10a2382302c2
SHA512 d36ef9a9fe8b42951648933fdc41b9b61077bfb4221360f9308104f05e88d17ffdb07948a29858d2f4371db1def154cc4b4be57304c322934a763f6e8b8872de
MD5 SHA1 SHA512

Submit Download

file.bat

Path C:\Windows\file.bat
Size 108B
SHA256 a71abd1fdc85f79e998241c9e82c98eeb00cc70a2027a6a6a6a6fa331bbec6e2
MD5 b0034396c9f02a03f580f918c5c726c2
SHA1 c361a0fa2cc1552ed2b6ef68f1186296a0f1b5cf
SHA512 f2ecd7d284a4a89f3485099868d9933fb4281a2274d751458b14a9553157690f2a2850cce74f003fcff2ae5703b1c6bacbfa97370a3b9ed34425c5b6e997c8f9
TLSH
T151B012045BDA8286AC0A76330EE6DE08D0652D5DB5A427841F60E71D600398D99B120A
MD5 SHA1 SHA512 TLSH

Submit Download

services.exe

Path C:\Windows\services.exe
Size 32KB
SHA256 a08df6e72fac6582b670fdbdcb22a2c9241739ed57552a619539f6e38eb7edb3
MD5 0ea9146650da844d5554b093b996eb2a
SHA1 ac8c517ace3bfb7593e51a7e36e4131cdcaf6cd1
SHA512 8dc006709d5315f5d3f721f7371526dd267fda3c32e730ef418fa624d9949b8ccd7f3049b9017e3e4517bff21f31afee4064cb13d9e1971cfa2a695062c34103
SSDEEP 384:eQZFbSKQ4ABdh6oPWAe1jO/CDUEhWdieqvUnMXY:e9VrAoPo1jO/UsdJqvLXY
TLSH
T1BCE20A7BA55A7CB2DDB03A301A4DB6205EA59A307F39F8C5D39487452CFD6C0B42854B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads