3e02bd5889c7dae5e847cc52024e5f2704cf3f052eea9156af90ece68d99edab

Analysis

max time kernel
0s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
userspace_spoofer.exe
Size 70KB
Sample260817-g7gh7avdkd
SHA256 3e02bd5889c7dae5e847cc52024e5f2704cf3f052eea9156af90ece68d99edab
MD5 0f2cd466e79109f7154e5ce7cad9fe6f
SHA1 56f80ae3c0658b93f7331d6d7322cb65abd3d971
SHA512 9a0105ddb912eced88b467aa0848f1c9ad453743a2877a8c20aaea887c649e4d86783afd86848ab293d901ecd057ab994f030564987a24b5b36d9fac14731765
SSDEEP 768:bZu2xFp21K4s0qW2f+lfF7FiLJDMCzDkcSWFTpl0BQ2TD3r1I1AG:AC2Zs0qEoJMCOBQ2TD3uuG
TLSH
T1586332E57AD95CC6EA74A27C52E9C231363CF9E08A534B07D52026321B13FD17EE92C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4688	3308	userspace_spoofer.exe	89
PID 4688 wrote to memory of 3652	4688	cmd.exe	90
PID 3308 wrote to memory of 4688	3308	userspace_spoofer.exe	89
PID 4688 wrote to memory of 3652	4688	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\userspace_spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\userspace_spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface set interface "Ethernet" admin=disable 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\netsh.exe
    netsh interface set interface "Ethernet" admin=disable
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads