Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 17:05
Behavioral task
behavioral1
Sample
b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe
- Size 93KB
- Sample260810-vmarssdn41
- SHA256 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e
- MD5 56b397b416d27f3c29e1989d6965e9a4
- SHA1 67f661823a97ae62018d7d891170a894376b3bef
- SHA512 af4d6856eb988c82c1e8a67b1fe99f2082510200a3b5e30376ae54bf101c0beb57c23475912adedfc0b1431aac01f027f833d5dd40a9ef1a78a0b6b5d197de61
- SSDEEP 1536:JijJD/HBZbszKu9AZpd7r1jEwzGi1dDsDsgS:JiCzK4AZ3HCi1dqF
- TLSH T1E693E94977E56524E0BF56F75471F2004E35B48B1602E39D98F219AA0B33AC44F8AFEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 3232 netsh.exe 4480 netsh.exe 4588 netsh.exe - Creates a file in the Startup directory 1 TTPs 6 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c2f0f2a2c1797603c9710deaa5cf03d3Windows Update.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c2f0f2a2c1797603c9710deaa5cf03d3Windows Update.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification C:\autorun.inf b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File created F:\autorun.inf b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification F:\autorun.inf b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification C:\Windows\SysWOW64\Explower.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Explower.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe File opened for modification C:\Program Files (x86)\Explower.exe b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: 33 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe Token: SeIncBasePriorityPrivilege 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5260 wrote to memory of 3232 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 89 PID 5260 wrote to memory of 4588 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 91 PID 5260 wrote to memory of 4480 5260 b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe"C:\Users\Admin\AppData\Local\Temp\b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe"1⤵
- Creates a file in the Startup directory
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe" "b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3232
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4588
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe" "b931949190f3623eee3e16133eeb0aa44db39ac157eb3114b7bf6736b67feb6e.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4480
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1