03a234060541b686ac4265754aff43df9325c21383f90e17f831e67965d717f8

Analysis

user interaction
yes
max time kernel
55s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Optimizer-16.7.exe
Size 2.5MB
Sample260807-yfrcrasdpc
SHA256 03a234060541b686ac4265754aff43df9325c21383f90e17f831e67965d717f8
MD5 7f57207f221db2b08e27d64bc9121b28
SHA1 3bfc4b12a533ee1ce62e5d348027d4ac90ab49db
SHA512 7cc44ff1c3210db2478f4e37fef23669f0425b1b1672fc5f53956890daccb84b32fa25c8da9f7ce0cd1deb9e697e46cdae0762a0af818f98b93544b8e39f8a25
SSDEEP 24576:zv5MZtiOMKNOJMv9EC8oJ8VxHuDBjk38WuBcAbwoA/BkjSHXP36RMG:zxMZtiOMK9EC8oa6CSA/Bkj0
TLSH
T176C5291333E84927F2AE677F9071093D53B9AA3F9A77C74E7814B89E84957028907723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion execution persistence privilege_escalation spyware

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Optimizer-16.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	Optimizer-16.7.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
7	raw.githubusercontent.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3944	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1616	cmd.exe
2784	cmd.exe
3744	cmd.exe
4236	cmd.exe
440	cmd.exe
5048	cmd.exe
5484	cmd.exe
3708	cmd.exe
5352	cmd.exe
2936	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1748	ipconfig.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Desktop\AutoEndTasks = "1"	Optimizer-16.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Desktop\HungAppTimeout = "1000"	Optimizer-16.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000"	Optimizer-16.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	Optimizer-16.7.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"	Optimizer-16.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	Optimizer-16.7.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	Optimizer-16.7.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"	Optimizer-16.7.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	Optimizer-16.7.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	Optimizer-16.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	Optimizer-16.7.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4376	Optimizer-16.7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	Optimizer-16.7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3956	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 5484	4376	Optimizer-16.7.exe	91
PID 5484 wrote to memory of 3944	5484	cmd.exe	93
PID 4376 wrote to memory of 1616	4376	Optimizer-16.7.exe	94
PID 1616 wrote to memory of 1748	1616	cmd.exe	96
PID 4376 wrote to memory of 3708	4376	Optimizer-16.7.exe	97
PID 3708 wrote to memory of 1888	3708	cmd.exe	99
PID 4376 wrote to memory of 2784	4376	Optimizer-16.7.exe	100
PID 2784 wrote to memory of 1728	2784	cmd.exe	102
PID 4376 wrote to memory of 3744	4376	Optimizer-16.7.exe	103
PID 3744 wrote to memory of 6076	3744	cmd.exe	105
PID 4376 wrote to memory of 4236	4376	Optimizer-16.7.exe	106
PID 4236 wrote to memory of 2132	4236	cmd.exe	108
PID 4376 wrote to memory of 4464	4376	Optimizer-16.7.exe	109
PID 4464 wrote to memory of 2036	4464	control.exe	110

C:\Users\Admin\AppData\Local\Temp\Optimizer-16.7.exe
"C:\Users\Admin\AppData\Local\Temp\Optimizer-16.7.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\sc.exe
    sc config "RemoteRegistry" start= disabled
    3⤵
    - Launches sc.exe
    PID:3944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ipconfig /flushdns
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:1748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv4 set dnsservers Ethernet static 8.8.8.8 primary
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\system32\netsh.exe
    netsh interface ipv4 set dnsservers Ethernet static 8.8.8.8 primary
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv4 add dnsservers Ethernet 8.8.4.4 index=2
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\netsh.exe
    netsh interface ipv4 add dnsservers Ethernet 8.8.4.4 index=2
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv6 set dnsservers Ethernet static 2001:4860:4860::8888 primary
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 set dnsservers Ethernet static 2001:4860:4860::8888 primary
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv6 add dnsservers Ethernet 2001:4860:4860::8844 index=2
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 add dnsservers Ethernet 2001:4860:4860::8844 index=2
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2132
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" "C:\Windows\System32\ncpa.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\ncpa.cpl",
    3⤵
    - Modifies registry class
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv4 set dnsservers Ethernet static 8.8.8.8 primary
  2⤵
  - Executes a command shell one-liner
  PID:440
- - C:\Windows\system32\netsh.exe
    netsh interface ipv4 set dnsservers Ethernet static 8.8.8.8 primary
    3⤵
    PID:2752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv4 add dnsservers Ethernet 8.8.4.4 index=2
  2⤵
  - Executes a command shell one-liner
  PID:5048
- - C:\Windows\system32\netsh.exe
    netsh interface ipv4 add dnsservers Ethernet 8.8.4.4 index=2
    3⤵
    PID:2880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv6 set dnsservers Ethernet static 2001:4860:4860::8888 primary
  2⤵
  - Executes a command shell one-liner
  PID:5352
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 set dnsservers Ethernet static 2001:4860:4860::8888 primary
    3⤵
    PID:3652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh interface ipv6 add dnsservers Ethernet 2001:4860:4860::8844 index=2
  2⤵
  - Executes a command shell one-liner
  PID:2936
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 add dnsservers Ethernet 2001:4860:4860::8844 index=2
    3⤵
    PID:1916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Optimizer.log

Path C:\ProgramData\Optimizer\Optimizer.log
Size 315B
SHA256 8d49d1e23a565651df1010f6e2fe0e69dde044402cddb3945c07d933e0416c5d
MD5 23b398cb4c26e26e805cd0fdc04ed59a
SHA1 9c71ee5d4298ab6e78ff2509191f0e9cfe848688
SHA512 34b62a8249a824ffc0aba3d06d591017a339aa3545664dc4b55325cacfdcc94c85848d713f58d04806257714b22d67f13776873e027dd2b3141c571569fc0a92
TLSH
T155E07D1C116FE570307828B4A113652BB745C030F5A2A2DB304CD8E46E93E9D476F55F
MD5 SHA1 SHA512 TLSH

Submit Download

Optimizer.log

Path C:\ProgramData\Optimizer\Optimizer.log
Size 824B
SHA256 0d738de96f83d824772fb8ab92bf88a7d641494ab864b9637a4d3496c7878a5b
MD5 b4bf2d0c50b9ce0ba12f829e189815a1
SHA1 4ba46ade8d267390cb24ab306daee205a901e8b9
SHA512 969c6f1a1831a5c9857121aeee2f1eaae48e600473990b793729c2493de462732958712ce8b88e18cfccfc573bf1caee220add2ab837ec6a90c9eaa58c5f8730
TLSH
T17F011E4D91EB85B0319410B1BC071B2FFB18A010A03A7A6973FCE4843ED1EBD079DA8E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4376-30-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-3-0x0000019B026C0000-0x0000019B02772000-memory.dmp

Download

memory/4376-24-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-25-0x0000019B1B7B0000-0x0000019B1B826000-memory.dmp

Download

memory/4376-26-0x0000019B1B060000-0x0000019B1B082000-memory.dmp

Download

memory/4376-27-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-28-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-0-0x00007FFE86D2F000-0x00007FFE86D30000-memory.dmp

Download

memory/4376-31-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-32-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-33-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-34-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-35-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-36-0x0000019B1B120000-0x0000019B1B13E000-memory.dmp

Download

memory/4376-37-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-38-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-40-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-39-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-72-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-48-0x0000019B1F6A0000-0x0000019B1F6BE000-memory.dmp

Download

memory/4376-49-0x0000019B1F6C0000-0x0000019B1F772000-memory.dmp

Download

memory/4376-51-0x0000019B1F920000-0x0000019B1F93A000-memory.dmp

Download

memory/4376-50-0x0000019B21AF0000-0x0000019B21CF4000-memory.dmp

Download

memory/4376-52-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-53-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-2-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-69-0x0000019B1F700000-0x0000019B1F712000-memory.dmp

Download

memory/4376-70-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-45-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-73-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-75-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-1-0x0000019B00810000-0x0000019B00A8A000-memory.dmp

Download

memory/4376-96-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-97-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-98-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download

memory/4376-99-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp

Download