Analysis
- max time kernel
46s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NetDisabler_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NetDisabler_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target NetDisabler_x64.exe
- Size 1.1MB
- Sample260812-jemkvabc39
- SHA256 267b5deaabf18fbc7058263a8c96553d3c061d967eb939f9e9d0aa2a8f9bbf1a
- MD5 b4cc6e6e94e5f21cdd53aa62c6e343d4
- SHA1 2f78da7cf1041335a161ec6c1cb74939b65dc95d
- SHA512 9bade01db2d1911bcaa1263f2779cd9786d415b0ff2114ea37c00b176d02b0655f783abc651280c3def277a2afc513a8fd7f2864d3529b00d06ee1baf4c359a3
- SSDEEP 24576:Z2DW/xbFX2YIbqQsu3/PNLvQiHyfk+izeth27HOK5:Z2EZXXQsW/PNrQa962D5
- TLSH T15945BF59F6A444E5C47AE57ACE46C23BE3F1BC08577597CB02A04E6A1F33BD0693A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 NetDisabler_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 NetDisabler_x64.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5824 NetDisabler_x64.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe 5824 NetDisabler_x64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NetDisabler_x64.exe"C:\Users\Admin\AppData\Local\Temp\NetDisabler_x64.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5m8f2z4w.tmp
- Size 154KB
- SHA256 d7f04f94ec44d4464222e090746ec44332172ec26fec49b059079a131ab7f3df
- MD5 82996c54aeb64e9c0649890ad8575742
- SHA1 3e083291968eae397c32c8ad594a99467cf29f68
- SHA512 265c3c63d295e3bff236fa92cfa5776c92f73c7b9a0a50195a936d54b64d498ce7d80e861017ed4e720f4b4545fe4cd8054b83870dde83fd0a18fa7933fdbaef
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\NetDisabler.ini
- Size 2KB
- SHA256 7d806d3cab3ed7f60df5a8c34ed89f69b5c1520e90d698900bed0ba7e49b7646
- MD5 826991145ee1ac3d570f7b6eb25e337e
- SHA1 2a444c76e864f33275cd0ff520f28d826f7f031a
- SHA512 f7424d90f1d02e0b6c53559d852f9c17933e4e635a0dd5249c481b28f23c835b33e6845dd7daa6764ecab7c9f1fd805bcdac0ab7af3abe8a1f01c20cc8d499e1
- TLSH T1E4515E4A16F50118F2F7BF80EEB4AA724B367C06AD7CD98C08D00D5D09F1A908566FEB
- MD5 SHA1 SHA512 TLSH