c6bc91613bfdcebd8f1b46871a4f3bce0639bfe4a0438f1452e156778c90140a

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LAUNCHER.ps1
Size 4KB
Sample260814-my5sbasthx
SHA256 c6bc91613bfdcebd8f1b46871a4f3bce0639bfe4a0438f1452e156778c90140a
MD5 a835b3ea37f73108673ef30fef2ec6c5
SHA1 531db6db8009af8a3dce954a1a730636daa8e700
SHA512 4ee80883c61d08dd176148afe323d23936c6bba6d92b2093affd782f6f5a212a1c1c3ec2d39860047ceab09cc18483ea548f8bec16929421c962b7e6068134d4
SSDEEP 96:aNmi3mPELpcET9NpIxBH8TC38zM2UJ8zr:Pi34EdcWIXH8FUJO
TLSH
T126A12135F105250E85F6169E0502B26CFC96C07752CB09C4B15C82AABBF6BAE4B36DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1436	PowerShell.exe
5760	powershell.exe
2556	powershell.exe
4316	powershell.exe
3560	powershell.exe
1360	powershell.exe
3512	powershell.exe
5324	powershell.exe
2520	powershell.exe
2068	powershell.exe
1508	powershell.exe
3528	powershell.exe
5576	powershell.exe
3052	powershell.exe
1544	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2448	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1436	PowerShell.exe
1436	PowerShell.exe
3512	powershell.exe
3512	powershell.exe
1508	powershell.exe
1508	powershell.exe
1508	powershell.exe
5324	powershell.exe
5324	powershell.exe
5760	powershell.exe
5760	powershell.exe
2520	powershell.exe
2520	powershell.exe
2556	powershell.exe
2556	powershell.exe
3528	powershell.exe
3528	powershell.exe
4316	powershell.exe
4316	powershell.exe
5576	powershell.exe
5576	powershell.exe
3052	powershell.exe
3052	powershell.exe
1544	powershell.exe
1544	powershell.exe
1360	powershell.exe
1360	powershell.exe
3560	powershell.exe
3560	powershell.exe
2068	powershell.exe
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	PowerShell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2448	1436	PowerShell.exe	90
PID 1436 wrote to memory of 2644	1436	PowerShell.exe	91
PID 1436 wrote to memory of 4144	1436	PowerShell.exe	92
PID 1436 wrote to memory of 3512	1436	PowerShell.exe	93
PID 1436 wrote to memory of 4084	1436	PowerShell.exe	95
PID 1436 wrote to memory of 1508	1436	PowerShell.exe	96
PID 1436 wrote to memory of 5324	1436	PowerShell.exe	99
PID 1436 wrote to memory of 5760	1436	PowerShell.exe	101
PID 1436 wrote to memory of 2520	1436	PowerShell.exe	103
PID 1436 wrote to memory of 2556	1436	PowerShell.exe	105
PID 1436 wrote to memory of 3528	1436	PowerShell.exe	107
PID 1436 wrote to memory of 4316	1436	PowerShell.exe	109
PID 1436 wrote to memory of 5576	1436	PowerShell.exe	111
PID 1436 wrote to memory of 3052	1436	PowerShell.exe	113
PID 1436 wrote to memory of 1544	1436	PowerShell.exe	115
PID 1436 wrote to memory of 1360	1436	PowerShell.exe	117
PID 1436 wrote to memory of 3560	1436	PowerShell.exe	119
PID 1436 wrote to memory of 2068	1436	PowerShell.exe	121

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LAUNCHER.ps1
1⤵
- Drops file in Drivers directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:2448
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy delete v4tov4 listenport=443 listenaddress=127.0.0.1
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2644
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=443 listenaddress=127.0.0.1 connectport=4443 connectaddress=127.0.0.1
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe
  "C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe"
  2⤵
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 9184a425e20d7e45bc653b61164a5b48200ba83d2c46df2c94227fdc17b79af4
MD5 97ef5fc4f03645e585b0ead64488f8db
SHA1 e6c85461cb7630842d339b14b5941ba964f01eec
SHA512 b74a8045f9cda500d245a4afdf6edd25c28548c3cff3a5a2df64de478b3f8df81ce9be5a0a8667ba417de6454318cc25aa586623eb77fe26cb483ff7ed870c1b
SSDEEP 1536:rKLmHhYoiz8KMSfKQ1CflJntCUp9Y3h4iUxAR40i71Yi68nv2gOdB4V3CNBQkj2E:rKLmHhYoiz8KMSfKQ1CflJnQUp9Y3qif
TLSH
T155637392E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_z3dna4eb.mgj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z3dna4eb.mgj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1436-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-4-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/1436-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-17-0x000001F953030000-0x000001F9530E2000-memory.dmp

Download

memory/1436-18-0x000001F9530F0000-0x000001F9530FA000-memory.dmp

Download

memory/1436-16-0x000001F953010000-0x000001F95302E000-memory.dmp

Download

memory/1436-19-0x000001F953120000-0x000001F95313E000-memory.dmp

Download

memory/1436-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-24-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-22-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-25-0x000001F953740000-0x000001F9538B6000-memory.dmp

Download

memory/1436-26-0x000001F953AD0000-0x000001F953CDA000-memory.dmp

Download

memory/1436-23-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-3-0x000001F952F80000-0x000001F952FA2000-memory.dmp

Download

memory/1436-39-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-38-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/1436-36-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/3512-35-0x0000027BAB3D0000-0x0000027BAB3DA000-memory.dmp

Download

memory/3512-34-0x0000027BAB3C0000-0x0000027BAB3C6000-memory.dmp

Download

memory/3512-33-0x0000027BAB390000-0x0000027BAB398000-memory.dmp

Download

memory/3512-32-0x0000027BAB3E0000-0x0000027BAB3FC000-memory.dmp

Download

memory/3512-31-0x0000027BAB380000-0x0000027BAB38A000-memory.dmp

Download